AnswersPublished14 sources
Mozilla Revokes Firefox and Thunderbird GPG Signing Key After Accidental GitHub Exposure
On August 10, 2026, Mozilla disclosed that an unencrypted copy of a GPG private signing subkey for Firefox and Thunderbird Linux artifacts was accidentally committed to a private GitHub repository. The incident occurred less than a week after the massive keyv npm package hijacking (ChainDrop) disclosed on August 4,...
Published byEdited with DeepSeek-V4-FlashImages generated with GPT Image 1.5
Research answer
Key takeaways
- On August 10, 2026, Mozilla disclosed that an unencrypted copy of a GPG private signing subkey for Firefox and Thunderbird Linux artifacts was accidentally committed to a private GitHub repository.
- The incident occurred less than a week after the massive keyv npm package hijacking (ChainDrop) disclosed on August 4, 2026, which compromised over 2,251 versions of 452 unique packages.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What was the Mozilla Firefox and Thunderbird GPG signing key incident reported on August 10, 2026, including how the private key subkey was. Article summary: Now I have the primary Mozilla source. Let me also verify the keyv supply chain attack detailsOn **August 10, 2026**, Mozilla disclosed that it had accidentally committed an **unencrypted copy of a GPG private signing su. Topic tags: general, general web, user generated, documentation. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks,
On August 10, 2026, Mozilla disclosed that it had accidentally committed an unencrypted copy of a GPG private signing subkey to a private GitHub repository, forcing an immediate key rotation for Firefox and Thunderbird Linux artifacts. Here is a full breakdown of the incident and its context.
How the key was exposed
The GPG private subkey — used to sign Linux tarballs, RPM packages, and checksum files — was inadvertently committed in plaintext (unencrypted) to a private GitHub repository by a Mozilla employee . The repository was accessible only to a small group within Mozilla, but the key material was stored without passphrase protection .
Mozilla's investigation findings
Mozilla reviewed available audit records and found no evidence that the key was accessed by any unauthorized party while it was present in the repository . Access was limited to individuals who already had authorized access to the key through other means . Mozilla assessed the risk of an actual supply chain attack (e.g., attackers distributing malicious signed installers) as low .
Actions taken
-
Revocation: Mozilla revoked the compromised key with reason code 2, which in the GPG/OpenPGP specification means "key material has been compromised" (equivalent to
KEY_COMPROMISE) . -
Replacement key: A new GPG signing subkey was issued with fingerprint:
827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3This subkey is valid until August 5, 2028 . The parent key fingerprint is
14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353. -
Safeguards: Mozilla added internal safeguards to prevent similar accidental commits in the future .
-
Impact of revocation: Because GPG revocations are permanent, files signed with the old key stop verifying once a user imports the revocation — this applies to older downloads, not just future ones .
Who needs to take action
Most users — no action required. Mozilla's official guidance states: "For most users, no action is required" . Automatic update mechanisms handle the key transition transparently.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Mozilla Revokes Firefox and Thunderbird GPG Signing Key After Accidental GitHub Exposure"?
On August 10, 2026, Mozilla disclosed that an unencrypted copy of a GPG private signing subkey for Firefox and Thunderbird Linux artifacts was accidentally committed to a private GitHub repository.
What are the key points to validate first?
On August 10, 2026, Mozilla disclosed that an unencrypted copy of a GPG private signing subkey for Firefox and Thunderbird Linux artifacts was accidentally committed to a private GitHub repository. The incident occurred less than a week after the massive keyv npm package hijacking (ChainDrop) disclosed on August 4, 2026, which compromised over 2,251 versions of 452 unique packages.