Mozilla revokes Linux release signing subkey after private repository exposure
Mozilla has revoked the OpenPGP signing subkey used to authenticate Firefox and Thunderbird downloads for Linux after an unencrypted copy was accidentally committed to one of its private code repositories. The company says the repository was private and its review of available audit records found no evidence of unauthorised access.
The move affects more than future releases. Users who import the revocation will find that older Firefox and Thunderbird files signed with the retired subkey no longer verify. Mozilla published a replacement subkey on Monday with fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3, valid until 5 August 2028.
A compromise-class revocation changes verification
The revoked subkey, fingerprint 09BE ED63 F346 2A2D FFAB 3B87 5ECB 6497 C1A2 0256, was announced in April 2025 and had been due to expire in March 2027. Mozilla normally rotates this signing subkey roughly every two years, but this replacement comes about seven months early.
Mozilla has not said that the key was taken, how long it was stored in the repository, or how the exposure was discovered. However, the published revocation certificate carries OpenPGP reason code 2, “key material has been compromised”, and the note “We no longer trust this key.” The revocation was generated on 6 August 2026 at 11:14 UTC.
That designation has a material operational consequence. Under the OpenPGP model described in RFC 4880, a superseded or retired key can leave earlier signatures valid, while a key revoked for compromise makes every signature produced by it suspect. Mozilla’s primary key, 14F26682D0916CDD81E37B6D61B7B526D98F0353, remains in place; the action applies to the signing subkey.
RPM users may need to replace a stale key
Most Firefox and Thunderbird users do not need to act. Manual signature verifiers need both the new key and the old-key revocation. Firefox users installing Mozilla RPM packages may encounter update failures on some distributions, because importing the new key can report success while the stale repository key remains installed.
Mozilla’s documented remediation is to remove matching old RPM keys, import the current Mozilla signing key, then clear DNF metadata. On openSUSE, the equivalent RPM commands are followed by zypper refresh. Thunderbird has no official RPM packages, so this RPM-specific issue does not apply to Thunderbird.
The company did not identify the private repository or describe the safeguards added after the incident. It also did not state whether its APT repository is affected; Debian and Ubuntu .deb packages use a different key and are not among the affected formats. The event follows supply-chain concerns highlighted by npm-chain incidents and CI exposure, where npm-chain incidents showed how developer and CI environments can become routes to sensitive material, and reinforces the need for organisations to test key rotation and revocation handling before an update fails.