Updated GPG key for signing Firefox and Thunderbird Releases - Mozilla Security Blog

Today, we moved to a new GPG signing subkey used to sign certain Firefox and Thunderbird artifacts (namely Linux tarballs, RPM packages, checksums files) after an unencrypted copy of the previous subkey was inadvertently committed to a private GitHub repository.

Our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository. Access to the repository was limited to a small group within Mozilla, all of whom already had authorized access to the key through other means.

We have revoked the previous signing key and added safeguards to prevent similar issues in the future.

For most users, no action is required.

There are two cases where you may need to take action:

If you manually verify our GPG signatures, you will need to import the new signing key and the revocation for the old key.

If you use Firefox RPM packages, some manual intervention may be required. See the instructions below for details.

Thunderbird does not provide official RPM packages, so there is no RPM-specific action required.

RPM Users

Different RPM package management tools deal with GPG key rotations and revocations differently. See the sections below for what action (if any) you need to take to ensure you continue to receive the latest Firefox updates.

Fedora 43 and later

No special action needed. During the next update, dnf will download the updated key and you just need to confirm the import. Make sure the shown fingerprint matches 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3 before accepting.

Fedora 42 and older, RHEL/Rocky/Almalinux

Dnf on these releases cannot replace the key on its own. Updates will fail with “Import of the key didn’t help, wrong key?” or “The GPG keys listed for the mozilla repository are already installed but they are not correct for this package”. The old keys must be removed manually:

sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353

sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg

sudo dnf clean all

Important: Remove the previous signing key before importing the new one. If you run rpm --import while the previous key is still installed, the command may report success even though the key is not updated.

openSUSE/SUSE based distributions

Same as the previous section, zypper won’t replace the key on its own and it must be removed manually. Updates will fail with “Signature verification failed” or “NOKEY”. Use the following commands:

sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353

sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg

sudo zypper refresh

New GPG Key Details

The GPG fingerprint is 14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353. The new signing subkey’s fingerprint is 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3, and it expires 2028-08-05.

The new public key and revocation of the previous one can be fetched from:

KEY files of the latest Firefox Nightly (https://archive.mozilla.org/pub/firefox/nightly/latest-mozilla-central/)

keys.openpgp.org, or

inline below

This can be used to validate releases signed with the new key. Due to the nature of GPG signing, releases signed with the previous key will no longer be verifiable after importing the revocation.

-----BEGIN PGP PUBLIC KEY...