Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo

Mozilla has revoked the cryptographic key used to sign Firefox and Thunderbird downloads for Linux. The key was compromised when an unencrypted copy was accidentally committed to a private code repository. This key is crucial for verifying the authenticity of downloaded Firefox tarballs, ensuring they come from Mozilla and have not been tampered with. As a result of the revocation, there will be consequences, although the specifics of these costs are not detailed. The revocation is a direct response to the security incident. Mozilla's decision aims to maintain the security and trust of its Linux users.