Mozilla announced a replacement for the GPG key used to digitally sign Firefox and Thunderbird release artifacts, such as tarballs, RPM packages, and checksum files. The replacement was made following an incident in which an unencrypted copy of the key was inadvertently added to the company's private GitHub repository, accessible to a limited number of project contributors who had access to the key through internal services.
An analysis of the audit logs revealed no evidence of third-party access to the key while it was in the GitHub repository. For most users, replacing the key will not require any action. The only exceptions are those who manually verify digital signatures or install RPM packages with official Mozilla Firefox builds. In these cases, they will need to explicitly import the new public key and revoke the old one.
For Fedora users up to and including release 42 (in Fedora 43 the key will be replaced automatically) and RHEL/Rocky/Almalinux You need to run: sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353 sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg sudo dnf clean all
In openSUSE and SUSE: sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353 sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg sudo zypper refresh
Source: opennet.ru
