Mozilla Revokes Signing Key

Overview

Mozilla has revoked the cryptographic signing key used for Firefox and Thunderbird Linux downloads after an unencrypted copy was mistakenly committed to one of its private code repositories. While there is no evidence of unauthorized access, Mozilla took the precautionary step of revoking the key to preserve trust in its software supply chain.

Why the Key Matters

• Verification of downloads: The signing key ensures that tarballs and packages come directly from Mozilla and have not been tampered with.
• Impact of revocation: Once revoked, older downloads signed with the key stop verifying, affecting users who manually check signatures or install RPM packages.
• New subkey published: Fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3, valid until August 5, 2028.

Technical Details

• Reason code 2: The revocation certificate cites “key material has been compromised,” generated on August 6, 2026.
• Subkey revocation: Signed by the primary key 14F26682D0916CDD81E37B6D61B7B526D98F0353, which remains valid.
• Early rotation: The revoked subkey was scheduled to run until March 2027 but was retired seven months early.
• RPM impact: Some distributions handle the swap automatically; others require manual removal of the old key and import of the new one.

bash

sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353
sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg
sudo dnf clean all

• Debian/Ubuntu unaffected: Their .deb packages use a different key.

Supply Chain Context

This disclosure comes just a week after attackers hijacked a GitHub account behind keyv and cacheable npm packages, publishing a worm designed to harvest repository, registry, cloud, and private‑key material from developer environments. The timing underscores the fragility of cryptographic trust in modern software supply chains.

What Users Should Do

• Import the new key: Required for RPM users to continue updates.
• Remove old key: Prevents verification errors.
• Verify fingerprints: Always confirm the published fingerprint before trusting a new key.
• Monitor advisories: Stay updated on Mozilla’s security communications.

Expert in the Cloud Insight

Mozilla’s decision to revoke the key—even without evidence of misuse—shows a proactive approach to cryptographic hygiene. In the age of supply‑chain attacks, organizations must assume that any exposed key is compromised. For defenders, the lesson is clear: rotate keys regularly, enforce strict repository safeguards, and treat cryptographic assets as crown jewels.