AI Weekly Malaysia

Mozilla revoked the OpenPGP subkey used to sign Firefox and Thunderbird Linux downloads after an unencrypted copy was accidentally committed to a private internal repository. The revocation certificate uses reason code 2 ("key material has been compromised"), which invalidates all past signatures—not just future ones—meaning older tarballs stop verifying once the revocation is imported. No evidence of external access exists, but Mozilla rotated the key ~7 months early anyway; the new subkey (fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3) is valid until August 5, 2028.

Why: If you manually verify Firefox/Thunderbird Linux download signatures or install via Mozilla's RPM packages, you must import the new subkey and the old key's revocation certificate or your verification and updates will break. The choice of reason code 2 over a benign rotation reason is worth noting for anyone designing key-rotation policy: it trades forward compatibility of old signatures for a conservative security posture.

Mozilla revoked a GPG private subkey used to sign Firefox and Thunderbird Linux releases after an unencrypted copy was accidentally committed to a private GitHub repo accessible to a small number of employees. Audit logs showed no evidence of unauthorized access, but Mozilla did not disclose how the key landed in GitHub or how long it was exposed. Users manually verifying GPG signatures or running Firefox via Mozilla's RPM repo on Fedora 42 or earlier, RHEL, Rocky, AlmaLinux, openSUSE, or SUSE must manually remove the old key and import its replacement.

Why: If you verify Firefox/Thunderbird signatures on Linux or manage RPM-based deployments on older distros, you need to swap keys now—older signed releases will fail verification after importing the revocation. For everyone else, this is a reminder that private signing keys in source control—even private repos with authorized personnel—is a real failure mode that happened to a major project, and Mozilla's silence on duration and cause means you can't assume their exposure window was trivial.