Mozilla has moved to a new GNU Privacy Guard signing subkey for certain Firefox and Thunderbird release artifacts after an unencrypted copy of the previous subkey was accidentally committed to a private GitHub repository, the company said in a security blog post. The affected signing material was used for artifacts including Linux tarballs, RPM packages and checksum files, according to Mozilla. Mozilla said its review of available audit records found no evidence that an unauthorized party accessed the key while it was present in the repository. The company also said repository access was limited to a small group inside Mozilla, all of whom already had authorized access to the key through other means. BleepingComputer, which also reported the incident, characterized the supply-chain risk as low on the basis of Mozilla’s access findings. The company revoked the previous signing key and said it added safeguards to prevent similar issues in the future. The new signing subkey’s fingerprint is 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3, and Mozilla says it expires on August 5, 2028. Mozilla also listed the previous key fingerprint as 14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353. For most users, the rotation should not require special action, BleepingComputer reports. The narrower operational burden falls on users who manually verify GPG signatures, who must import the new signing key and the revocation for the old key. Mozilla also warned that, because of how GPG signing works, releases signed with the previous key will no longer be verifiable after importing the revocation. Linux users who install Firefox through RPM packages may need to take action depending on their package manager and distribution version. Mozilla said dnf on Fedora 43 and later should download the updated key during the next update, with users asked to confirm the import and verify that the displayed fingerprint matches the new subkey. For Fedora 42 and older, RHEL, Rocky Linux, AlmaLinux and openSUSE/SUSE-based distributions, BleepingComputer reports that Mozilla provided manual-update instructions because some tools will not replace the key on their own. Thunderbird users have one important carve-out: Mozilla says Thunderbird does not provide official RPM packages, so there is no RPM-specific action required for Thunderbird. The broader Thunderbird and Firefox signature-verification path still depends on the new key for the affected artifacts Mozilla identified. The incident is a contained but material release-engineering issue. Signing keys are a trust anchor for software distribution: if a signing key is misused, malicious artifacts can appear valid to systems that trust that key. Mozilla’s current position is that it has no evidence of unauthorized access, but the company still treated the exposure as serious enough to revoke the old key and rotate signing material. Who benefits: Users and administrators benefit from Mozilla’s key revocation and rotation because it limits the window in which the exposed subkey could remain trusted. Fedora 43 and later users should have the least manual work if dnf imports the new key as Mozilla describes. Who's exposed: The main exposed groups are users who manually verify Firefox or Thunderbird release signatures and Linux users installing Firefox through RPM package flows that do not automatically replace the key. Older Fedora, RHEL-family and openSUSE/SUSE-based environments may require more hands-on remediation, according to the reports.