Mozilla Revokes Firefox Linux Signing Key After Private Repo Exposure

Mozilla has revoked the cryptographic signing key used to authenticate Firefox and Thunderbird downloads for Linux after an unencrypted copy was accidentally committed to one of the company's own private code repositories. The compromised subkey, 09BE ED63 F346 2A2D FFAB 3B87 5ECB 6497 C1A2 0256, was published in April 2025 and had been scheduled to remain valid until March 2027. Mozilla revoked it roughly seven months ahead of schedule, citing reason code 2 ("key material has been compromised") in a revocation certificate generated on August 6, 2026 at 11:14 UTC, signed by the primary key 14F26682D0916CDD81E37B6D61B7B526D98F0353. Per RFC 4880, a compromise-class revocation invalidates every signature the key ever produced, which is why older Firefox and Thunderbird downloads will also fail verification once users import the revocation.

Mozilla's internal review of available audit logs found no evidence of unauthorized access to the private repository, and the company has not stated that the key was extracted by an external party. Everyone who could see the private repo already had legitimate access, but the leak potential was enough to warrant a full revocation rather than a routine rotation. The replacement subkey, with fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3, was published Monday and is valid until August 5, 2028. This is the first revocation on the Mozilla signing key in its history, though five earlier subkeys have been retired via normal expiry since 2015.

Most Firefox and Thunderbird users will need to take no action. The two affected groups are those who manually verify GPG signatures, who must import the new key and the revocation certificate, and users installing Firefox from Mozilla's RPM packages, some of whom will hit a failed update and need to swap the key manually. On certain distributions, dnf handles the transition automatically, fetching the updated key and prompting the user to confirm the fingerprint; on others it fails outright with errors such as "importing the key did not help." The incident underscores how a single slip in repository hygiene can cascade into a global package verification overhaul, and why routinely verifying the chain of trust on downloaded software matters. Admins can confirm their distribution's key transition is clean by running an SSL/TLS checker against Mozilla's download endpoints and a browser fingerprint test to ensure their client is reporting the expected TLS characteristics when fetching updates.