Mozilla revokes the GPG key signing Firefox and Thunderbird Linux builds after private-repo leak
Mozilla revoked and rotated the GPG subkey that signs Firefox and Thunderbird Linux tarballs, RPM packages, and checksum files after an unencrypted copy was committed to a private GitHub repo. Audit records show no unauthorized access. Most users need no action, but manual verifiers and some RPM users must import the new key (fingerprint 827E 6586..., expires 2028-08-05).