Mozilla Accidentally Put a Firefox Signing Key on GitHub. Here's Why You're Probably Fine.
A private key used to authenticate Firefox and Thunderbird downloads was briefly stored in the wrong place. Mozilla has replaced it and found no sign anyone misused it.
Key points
- Mozilla announced on Monday that it accidentally stored a private GPG signing key, used to verify Firefox and Thunderbird downloads, in a GitHub repository.
- The repository was private and restricted to a small group of Mozilla developers who already had legitimate access to the key.
- Mozilla's review of access logs found no evidence that an unauthorised person ever saw or copied the key.
- Mozilla has revoked the old key and issued a new one; most users need to do nothing.
- Anyone who manually checks digital signatures on Firefox or Thunderbird packages will need to import the new key.
A GPG signing key is essentially a secret stamp of approval. When Mozilla releases Firefox, it uses this key to produce a digital signature, a cryptographic tag that proves the file came from Mozilla and wasn't tampered with after it left the building. Someone who stole that key could stamp their own malicious files with what looks like Mozilla's seal of approval.
That's the worst-case picture. The actual picture is considerably less alarming.
How did this happen?
Somebody on Mozilla's team accidentally committed, meaning uploaded, an unencrypted copy of the key to a GitHub code repository. This one was set to private, visible only to a small group of Mozilla developers, and every one of them already had authorised access to the key through other channels.
Mozilla checked its audit logs, the records of who accessed the repository and when, and found no sign that anyone outside that circle ever reached the key.
Could criminals have used this to push fake Firefox updates?
The barriers were steep. The repository was private, access was limited, and even if someone had obtained the key undetected, they'd still have needed a way to get tampered files onto users' computers, perhaps by corrupting a download mirror or tricking someone into visiting a fake site. A multi-step attack, not a simple one. This is the same supply-chain threat pattern we covered on 29 July when a single malicious web page was enough to compromise Firefox and Tor Browser: the theoretical risk is real; the execution is hard.
Mozilla's statement was direct: "Our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository."
Still, Mozilla revoked the key (formally cancelling it so it can no longer be trusted) and issued a fresh one, and has added controls to stop the same mistake happening again.
| Detail | Information |
|---|---|
| Key type | GPG private signing key |
| Affected software | Firefox and Thunderbird (Linux tarballs, RPM packages, checksum files) |
| Repository visibility | Private, restricted to a small developer group |
| Evidence of misuse | None found in audit logs |
| Action taken | Key revoked, new key issued |
What should ordinary Firefox users do?
For most people: nothing. Firefox updates through the normal browser update mechanism are unaffected.
If you're a Linux user who manually verifies GPG signatures on downloaded packages, you need to import Mozilla's new public key and the revocation notice for the old one. Mozilla has published step-by-step instructions for users of RPM packages, the format common on Red Hat-based Linux systems.
If you downloaded Firefox or Thunderbird recently and it behaves normally, there's no reason for concern. The real story here isn't a breach; it's a process gap caught before anyone exploited it, which is exactly what good operational security hygiene is supposed to produce.
