Mozilla has revoked a cryptographic subkey used to sign Firefox and Thunderbird releases after discovering that an unencrypted copy of the private key had been accidentally committed to a private GitHub repository. The company disclosed the mishap on Monday, noting that access to the repository was limited to a small number of Mozilla staff who were already authorised to use the key through other means, and that audit logs showed no evidence of unauthorised access. Nonetheless, storing an unencrypted signing key in source control fell short of best practice, prompting Mozilla to revoke and replace it, and to introduce additional safeguards against a repeat.

The exposed subkey was used to sign Linux tarballs, RPM packages and checksum files, which allow users and package managers to confirm that Firefox and Thunderbird releases genuinely came from Mozilla and were not tampered with. Most users won't need to do anything, but anyone manually verifying GPG signatures must import the new key and the old one's revocation. The change is more involved for RPM users: Fedora 43 and later should fetch the new key automatically via DNF, while those on Fedora 42 or earlier, RHEL, Rocky Linux, AlmaLinux, openSUSE or SUSE must manually remove the old key and import its replacement. Mozilla has not explained how the key ended up on GitHub or how long it was exposed, and did not respond to The Register's questions on the matter.