**Mozilla** has proactively updated the GPG key used to sign its **Firefox** and **Thunderbird** releases after the previous key was accidentally exposed on **GitHub**. In a recent blog post, **Mozilla** detailed the incident, explaining that an unencrypted copy of the GPG signing subkey was inadvertently committed to a private **GitHub** repository. This key is crucial for verifying the authenticity of Linux tarballs, RPM packages, and checksum files for both applications. ### Low Risk, High Precaution Despite the exposure, **Mozilla** asserts that the risk of a supply chain attack – where threat actors could distribute malicious installers signed with the exposed key – is low. This assessment is based on two key factors: * **Limited Access:** The private **GitHub** repository's access was restricted to a small group of **Mozilla** employees, all of whom already had authorized access to the key through other secure means. * **No Evidence of Compromise:** An internal review of audit records found no evidence that the key was accessed by unauthorized parties during its exposure. Upon discovering the incident, **Mozilla** immediately revoked the compromised key and implemented measures to prevent similar issues in the future. ### User Actions Required for Manual Verification and RPM Users Most **Firefox** and **Thunderbird** users will not need to take any action. However, specific user groups are advised to perform updates: * **Manual GPG Signature Verifiers:** Users who manually verify GPG signatures must import the new signing key and the revocation for the old key. These are available through the latest **Firefox Nightly KEY** files and `keys.openpgp.org`. * **Linux RPM Package Users:** Linux users who install **Firefox** using RPM packages may need to manually update their systems. **Mozilla** has provided detailed instructions for various distributions, including **Fedora 43** and later, **Fedora 42** and older, **RHEL/Rocky/Almalinux**, and **openSUSE/SUSE-based** distributions, to ensure continued access to the latest updates. It's important to note that **Thunderbird** does not provide official RPM packages, so no RPM-specific action is required for **Thunderbird** users. ### Key Details The new signing subkey is set to expire on August 5, 2028. This incident underscores the critical importance of secure key management and the potential vulnerabilities even within private repositories. **Mozilla's** swift action and transparent communication aim to maintain user trust and the integrity of its software distribution pipeline.