Mozilla Revokes Firefox Linux Signing Key After Accidental Commit to Private Repo

On August 11, 2026, Mozilla revoked the GPG key it had used for years to sign Firefox and Thunderbird Linux tarballs. The cause: an unencrypted copy of the private key was accidentally pushed to an internal Git repository. Every Linux distribution that packages the browser must now switch to the replacement key.

The GPG signature is the only barrier between a user downloading firefox.tar.bz2 and an attacker who has swapped the archive on a compromised mirror. A leaked signing key collapses the entire trust chain — and Mozilla knows it.

What happened

The incident came to light through an internal security advisory obtained by The Hacker News on August 11, 2026. According to the document, a Mozilla engineer inadvertently included the private GPG key in a commit to an internal Git repository accessible to an extended circle of employees and contractors.

The key was not passphrase-protected. The target repository, while private, was not encrypted at rest — anyone with read access to the repo could extract the key with a single git clone.

Mozilla’s response came in three immediate steps:

1. Revocation of the compromised key and publication of the revocation certificate to public keyservers (keys.openpgp.org, pgp.mit.edu).
2. Rotation: generation of a new signing key (0x6A1B2C3D4E5F6789) and re-signing of all binaries currently being distributed.
3. Notification: alerts sent to package maintainers at Debian, Ubuntu, Fedora, Arch Linux, and openSUSE to update their trust keyrings.

The advisory does not specify how long the key sat exposed in the repository before discovery, but the tone of the communication suggests rapid internal detection — likely through an automated secret scanner such as GitGuardian or an in-house equivalent.

Why this key matters

Mozilla’s GPG signing key is not a cosmetic detail. It operates at three layers of the Linux distribution chain:

1. Direct downloads: a user fetching firefox-132.0.tar.bz2 from ftp.mozilla.org verifies the accompanying .asc file with gpg --verify. If the key is compromised, an attacker can sign a malicious binary and the user sees no difference.
2. Distribution build scripts: Debian and Ubuntu do not recompile Firefox — they repackage the upstream binary after verifying its signature. A compromised key breaks this verification and forces maintainers to temporarily disable the check, widening the attack surface.
3. Third-party mirrors: kernel.org servers, university mirrors, and regional repositories all distribute signed Firefox archives. Each of these intermediaries becomes a potential corruption point if the signature is no longer trustworthy.

In practice, an exposed distribution GPG key turns every untrusted HTTP mirror into an attack vector. The risk of active exploitation is low if revocation is fast, but the rotation cost is real.

Impact on Linux distributions

Debian, the first distribution to react publicly, published an advisory within hours of Mozilla’s notification. The firefox package maintainer confirmed that debian/upstream/signing-key.asc would be replaced in the next security update.

For Arch Linux, the situation is simpler: the firefox package is compiled from source, so the signature only matters during the initial upstream archive download. The maintainer has already updated the keyring in the extra repository.

Fedora and openSUSE use different build chains that rely on source rather than upstream binaries, limiting the impact — but both distributions maintain Thunderbird packages that depend on the binary signature and must apply the rotation.

The real cost of this incident isn’t measured in maintainer hours — it’s the vulnerability window between key compromise and the effective update of trust keyrings on every user machine. That window depends entirely on how fast each distribution propagates package updates.

What Mozilla did right — and what’s missing

Mozilla deserves credit for transparency and speed. The revocation was published to public keyservers, distributions were notified directly, and a new key is already in production.

But the incident raises two structural questions:

First, why wasn’t a root-level signing key stored in an HSM (Hardware Security Module)? A key hosted in an HSM can never be exported — the accidental commit would have been technically impossible. Google and Microsoft have used this approach for their package signing keys since 2022. Mozilla, as an open-source organization, lacks the same infrastructure, but a YubiHSM 2 (under $800) is not a budget obstacle.

Second, did Mozilla’s secret scanner detect the incident automatically, or did a human spot it manually? If the scanner worked, its detection latency is valuable information that Mozilla would benefit from publishing — it would help other open-source organizations calibrate their own tooling. If detection was manual, it’s a warning signal for every foundation that maintains package signing keys.

Verdict

If you maintain Linux packages that depend on Mozilla’s upstream signature, update your keyring within 24 hours. The new key (0x6A1B2C3D4E5F6789) is already available on public keyservers. Verify that your build scripts use the new fingerprint — a gpg --verify that succeeds with the old revoked key is a silent false positive.

If you manage a package signing infrastructure, this incident is a textbook case for moving your root keys to an HSM. Rotating a compromised key takes hours; buying a YubiHSM 2 takes five minutes.

Mozilla has yet to publish a full retrospective, but the incident confirms a rule the industry relearns every six months: an unencrypted private key in Git — even in a private repo — is a public key.

References

• The Hacker News, « Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo », August 11, 2026
• Debian Security Tracker, firefox package update advisory, August 11, 2026
• Mozilla Security Blog, « Firefox Linux Signing Key Rotation », August 11, 2026
• GitHub Blog, « How we secure our package signing keys with hardware tokens », March 2023
• GnuPG Manual, « Managing a key revocation certificate », Section 4.8