Mozilla has taken decisive action by revoking a GPG signing subkey following its accidental exposure in a private GitHub repository. This subkey played a crucial role in signing certain Firefox and Thunderbird release artifacts. Although the incident did not impact most users, Mozilla has implemented additional security measures to prevent future occurrences.
Details of the Exposure
The exposure involved an unencrypted copy of the subkey, utilized for signing Linux tarballs, RPM packages, and checksum files. Fortunately, Mozilla’s audit showed no unauthorized access or copying of the key. Access to the repository was limited to a select group within Mozilla, all of whom were already authorized to use the signing key through secure channels.
Despite the lack of evidence of misuse, Mozilla opted to revoke the previous subkey as a safety measure. The organization has also introduced new protocols to enhance key-handling security to further protect its software supply chain.
Impact on Users and Required Actions
For the majority of Firefox and Thunderbird users, no immediate action is needed, as standard installations and updates remain unaffected by this key rotation. However, users who manually verify Mozilla release signatures with GPG must import the new signing key along with the revocation certificate of the old key.
Mozilla advises that releases signed with the revoked key might not validate after importing the revocation. Firefox RPM users should note that systems such as Fedora 43 and later will automatically update to the new key, while older systems will require manual intervention.
Administrators managing affected distributions must remove the obsolete RPM signing key, import the updated key, and refresh the package metadata to ensure smooth updates.
Security Measures and Future Outlook
The incident underscores the ongoing challenge of maintaining secure software supply chains. Mozilla’s response, involving access audits, key revocation, and credential updates, aims to mitigate potential risks while maintaining user trust in its software releases.
Looking forward, Mozilla remains committed to safeguarding its cryptographic assets and enhancing its security measures, ensuring the integrity of its applications. The new primary GPG key, valid until August 5, 2028, is now available along with the necessary revocation materials through various Mozilla channels.
This proactive approach by Mozilla serves as a reminder of the importance of vigilance in managing cryptographic keys within software development environments.
