Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo
- ID
- 13101
- Status
- summarized
- Published
- 11 Aug 2026, 8:04 PM
- Fetched
- 11 Aug 2026, 10:26 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/mozilla-revokes-firefox-and-thunderbird.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.5
- Created
- 11 Aug 2026, 10:28 PM
- Tags
- Audience
- developersdatabase_learners
What happened
Mozilla revoked the OpenPGP subkey used to sign Firefox and Thunderbird Linux downloads after an unencrypted copy was accidentally committed to a private internal repository. The revocation certificate uses reason code 2 ("key material has been compromised"), which invalidates all past signatures—not just future ones—meaning older tarballs stop verifying once the revocation is imported. No evidence of external access exists, but Mozilla rotated the key ~7 months early anyway; the new subkey (fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3) is valid until August 5, 2028.
Why it matters
If you manually verify Firefox/Thunderbird Linux download signatures or install via Mozilla's RPM packages, you must import the new subkey and the old key's revocation certificate or your verification and updates will break. The choice of reason code 2 over a benign rotation reason is worth noting for anyone designing key-rotation policy: it trades forward compatibility of old signatures for a conservative security posture.
Discussion angle
Mozilla chose reason code 2 (compromise) despite no evidence of external access—discuss whether that conservative choice is the right default for signing-key incidents, given it invalidates every past signature and forces manual intervention for a narrow but real set of users.