Mozilla has recently announced the replacement of the GPG key used to digitally sign artifacts of Firefox and Thunderbird releases. This includes tar archives, RPM packages, and files with checksums. This decision was made following an incident where an encrypted copy of the key was unintentionally added to the company’s private repository on GitHub, which was accessible to a limited number of project participants who had access to the key through internal services.
An analysis of the audit logs did not show any evidence of third-party access to the key while it was in the GitHub repository. For the majority of users, replacing the key will not require any action. However, users who manually verify digital signatures or install RPM packages with official Firefox builds from Mozilla will need to explicitly import the new public key and revoke the old one.
For users of Fedora up to release 42 (the key will be replaced automatically in Fedora 43), as well as RHEL, Rocky, and Almalinux, the following commands need to be run:
| Command: | sudo rpm -e –allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353 |
|---|---|
| Command: | sudo rpm –import https://packages.mozilla.org/rpm/firefox/signing-key.gpg |
| Command: | sudo dnf clean all |
For openSUSE and SUSE users, specific steps need to be taken to ensure the key replacement process is completed successfully.