Mozilla Rotates Firefox and Thunderbird Signing Keys After GitHub Leak
The company revoked a GPG subkey used for Linux artifacts after an unencrypted copy was accidentally committed to a private repository.
Mozilla has revoked and rotated a GPG signing subkey used for Firefox and Thunderbird release artifacts after an unencrypted copy of the key was accidentally committed to a private GitHub repository. The company took the action to ensure the continued integrity of its software distribution pipeline.
The exposed key was a GPG signing subkey specifically used for certain release artifacts, including checksum files, RPM packages, and Linux tarballs. According to the Mozilla Security Blog, the exposure was limited because the key was committed to a private repository, meaning access was restricted to a small group of authorized Mozilla personnel. Following the discovery, Mozilla conducted a review of available audit records and found no evidence that any unauthorized parties accessed the key while it was present in the repository.
The Role of GPG Signing
Software distributors rely on GPG (GNU Privacy Guard) keys to digitally sign release files. This cryptographic process allows end users to verify that the software they download is authentic and has not been tampered with by a third party during transit. By checking the signature against a known public key, users can confirm that the file originated from the official developer and remains in its original state.
Supply Chain Risks
While Mozilla found no evidence of unauthorized access in this instance, the compromise of a signing key represents a critical security risk. Such an event could potentially enable a supply chain attack, where a malicious actor possessing a private signing key could distribute compromised versions of a browser. Because these malicious files would appear to be officially signed by Mozilla, they could bypass standard security checks on user systems, leading to widespread installation of malware or spyware.
Remediation and Prevention
In response to the incident, Mozilla has issued a new subkey to replace the revoked one. The company stated that it has also implemented new safeguards designed to prevent similar occurrences in the future. Users who manually verify signatures for Linux-based Firefox and Thunderbird installations will need to update their trusted keys to match the new subkey issued by the company.