Mozilla Revokes Firefox's Linux Signing Key After a Leak into a Private Repository

Mozilla has invalidated the cryptographic key used to sign the Linux downloads of Firefox and Thunderbird. The reason: an unencrypted copy of the key was accidentally committed to one of the company's internal private repositories. It's this key that lets a user — or a distribution packaging the browser — confirm that a downloaded tarball really came from Mozilla and hasn't been tampered with.

So far there's no sign that the key reached anyone outside the company. The repository was private, a review of the available audit logs turned up no unauthorized access, and everyone who could have seen the code already had legitimate rights to it. Even so, Mozilla decided to revoke the key.

The cost of the decision

The decision isn't free for those who verify signatures. Files signed with the old key stop passing verification the moment a user imports the revocation — and that applies not only to future builds but to older builds of Firefox and Thunderbird as well. Most users need to do nothing. Two groups will have to act: those who verify signatures by hand (they need to import the new key and the revocation certificate for the old one), and those who install the browser from Mozilla's RPM packages — for them the update may fail with an error, and the key will have to be swapped manually.

The new subkey, published on Monday, has the fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3 and is valid until August 5, 2028.

A revocation, not a rotation

OpenPGP lets the owner specify a machine-readable reason for revocation, and under the RFC 4880 standard this matters fundamentally: if a key is simply replaced or retired, its previous signatures remain valid, whereas a revocation on the grounds of compromise casts doubt on every signature it ever produced. The Hacker News decoded the published certificate and found reason code 2 — “key material has been compromised” — generated on August 6, 2026, at 11:14 UTC, with the note “We no longer trust this key.” Mozilla's own description of the incident, however, doesn't directly claim the key was stolen.

It's the subkey that was revoked; the primary key stays in place. The replacement came roughly seven months ahead of schedule: this subkey is usually rotated every two years, and the revoked one — announced in April 2025 — was valid until March 2027. The publication notes that the previous five subkeys, going back to 2015, were retired routinely, on expiry — this is the first revocation on this particular key.

Mozilla did not say which repository the key ended up in, how long it sat there, or how it came to light. The company is silent about the APT repository for Debian and Ubuntu, which uses a different key; the .deb format didn't make the list of affected ones. The disclosure came a week after the attack on the npm packages keyv and cacheable, in which attackers spread a worm to harvest keys and credentials from developers' machines.

Source: The Hacker News