Arch Linux

twcr

Member

Registered: 2017-05-14

Posts: 3

Where does mozilla list its firefox release keys?

I'm trying to install firefox-nightly by running

yaourt -S firefox-nightly

but get this error:

==> Verifying source file signatures with gpg...
    firefox-55.0a1.en-US.linux-x86_64.tar.bz2 ... FAILED (unknown public key 1C69C4E55E9905DB)

I know that I can run

gpg --recv-keys --keyserver hkp://pgp.mit.edu 1C69C4E55E9905DB

to import the key but where can I find an official gpg key list from mozilla to verify that key is from them?

twcr

Member

Registered: 2017-05-14

Posts: 3

Re: Where does mozilla list its firefox release keys?

I found a post on the mozilla support forum that points to a blog post by Ben Hearsum but is there an official announcement? He seems incompetent when it comes to GPG.

http://hearsum.ca/blog/mozilla-software … ition.html

glandium • 2 years ago
GPG is not SSL. You can change expiry of an existing GPG key.

bhearsum Mod glandium • 2 years ago
Yeah, fair point. This wasn't forefront in our minds at the time (we were scrambling).

https://support.mozilla.org/en-US/questions/1072927

twcr

Member

Registered: 2017-05-14

Posts: 3

Re: Where does mozilla list its firefox release keys?

Mozilla has a bug report about changing the GPG key. There's a link to that blog post in a comment but it was by the author of the post.

https://bugzilla.mozilla.org/show_bug.c … 139929#c28

Ben Hearsum (:bhearsum)
(Assignee)
Comment 28 • 2 years ago

Blog post is out: http://hearsum.ca/blog/mozilla-software … ition.html

I get the feeling that GPG is not the best method to verify the firefox download since there isn't an official Mozilla endorsement of the keys. Is there a better method to verify the package? This is the software that I use to enter my banking credentials and sign in to my medical accounts and I have to download it in a country known for modifying web content and packages.

Last edited by twcr (2017-05-14 20:07:23)

loqs

Member

Registered: 2014-03-06

Posts: 19,114

Re: Where does mozilla list its firefox release keys?

https://hg.mozilla.org/build/tools/file … elease/KEY https://ftp.mozilla.org/pub/firefox/releases/53.0/KEY admittedly both of those sources are not independent of where you obtained the source code from.
You could also inspect who has signed the key https://pgp.mit.edu/pks/lookup?op=vinde … 26D98F0353
Edit:
You could verify the source is being downloaded of https with a certificate with the following properties

serial number 08:B4:D5:B9:0A:94:90:1D:B8:3D:5F:82:95:B8:9C:F9
issued by Common Name DigiCert SHA2 Extended Validation Server CA
sha256 hash 8A:43:60:2D:C6:7D:8C:59:34:FA:63:8C:2B:06:6D:38:59:18:A1:C3:F5:FD:53:07:D1:3A:7B:36:3C:D5:26:D3
sha1 hash 7F:B2:DC:8E:1D:B7:07:C4:C2:FF:5F:2D:8A:F9:12:B0:3C:BB:E3:2E

Edit2:
If you used the package from the arch repo that would be signed by the package maintainer.

Last edited by loqs (2017-05-14 20:19:34)