Mozilla revokes Firefox signing key after unencrypted copy lands in GitHub
- ID
- 13028
- Status
- summarized
- Published
- 11 Aug 2026, 7:36 PM
- Fetched
- 11 Aug 2026, 8:18 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/11/mozilla-revokes-firefox-signing-key-after-unencrypted-copy-lands-in-github/5285908
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 4.5
- Created
- 11 Aug 2026, 8:22 PM
- Tags
- Audience
- developerssaas_startup_founders
What happened
Mozilla revoked a GPG private subkey used to sign Firefox and Thunderbird Linux releases after an unencrypted copy was accidentally committed to a private GitHub repo accessible to a small number of employees. Audit logs showed no evidence of unauthorized access, but Mozilla did not disclose how the key landed in GitHub or how long it was exposed. Users manually verifying GPG signatures or running Firefox via Mozilla's RPM repo on Fedora 42 or earlier, RHEL, Rocky, AlmaLinux, openSUSE, or SUSE must manually remove the old key and import its replacement.
Why it matters
If you verify Firefox/Thunderbird signatures on Linux or manage RPM-based deployments on older distros, you need to swap keys now—older signed releases will fail verification after importing the revocation. For everyone else, this is a reminder that private signing keys in source control—even private repos with authorized personnel—is a real failure mode that happened to a major project, and Mozilla's silence on duration and cause means you can't assume their exposure window was trivial.
Discussion angle
Mozilla couldn't or wouldn't say how long the key sat in GitHub or how it got there—what does that gap tell us about incident transparency at major open-source projects, and how would you handle disclosure if this happened to your own signing infrastructure?