Tag: Private Repo

The cryptographic key used to download Firefox and Thunderbird for Linux has been discarded by Mozilla after an unencrypted copy was inadvertently added to one of the company's proprietary source repositories. A user or a Linux distribution packaging the browser uses that key to verify that a downloaded Firefox tarball originated from Mozilla and was not altered. Anyone who verifies what they download will pay a price for that choice: once a user imports the revocation, files signed with the previous key cease to validate. That includes downloads of Thunderbird and Firefox from earlier versions as well as those from later versions. Thus far, there is no evidence that the key has been obtained by anyone outside the company. The browser manufacturer claims that everyone who could v...