2062327 - linux installation page needs an update timed with an upcoming gpg key rotation

Status: RESOLVED FIXED

(support.mozilla.org :: Knowledge Base Content, task)

Description

[[e-mail] (:bhearsum)]

We are in the middle of an incident that is causing us to rotate our GPG signing key. This is the first time we're doing this since shipping our own RPMs, and have discovered that rotating the GPG key causes issues for a small minority of users on certain RPM-based distributions. Because of this we need to add some additional information to those instructions to help users that might otherwise be stranded.

Specifically:
For Fedora 42 and older, RHEL/Rocky/Almalinux:

If you encounter a “Import of the key didn't help, wrong key?” or “The GPG keys listed for the mozilla repository are already installed but they are not correct for this package” error when installing or updating Firefox, you must manually remove the old GPG key with the following commands:

sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353
sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg
sudo dnf clean all

For openSUSE/SUSE based distributions:
If you encounter a “Signature verification failed” or “NOKEY” error when installing or updating Firefox you must manually remove the old GPG key with the following commands:

sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353
sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg
sudo zypper refresh

Comment 1

[[e-mail] (:bhearsum)]

Oh, and on the timing: we plan to finish the rotation/revocation later today (exact time is still TBD).

Comment 2

[Paul]

Please can I pick this one up?

Comment 3

[[e-mail] (:bhearsum)]

(In reply to [e-mail] (:bhearsum) from comment #1)

Oh, and on the timing: we plan to finish the rotation/revocation later today (exact time is still TBD).

This is now done; we're ready to publish this update when it's ready.

Comment 4

[Kelimutu [:kiki]]

Assigning to Paul to help with the update.

Comment 5

[Kelimutu [:kiki]]

Just for clarity, this request was originated from an internal Slack conversation. Here's an article that we need to update: https://support.mozilla.org/en-US/kb/install-firefox-linux

@Ben can you clarify when do you need this by?

Also, for internal CX reference, here's the Asana ticket: https://app.asana.com/1/90589597529/project/1203460865189761/task/1217365674044280?focus=true

Comment 6

[[e-mail] (:bhearsum)]

The sooner the better; we rotated the keys and RPM users are theoretically impacted now.

Comment 7

[Paul]

A draft for your approval - https://docs.google.com/document/d/16LLUOYgwCF2eo_A6vq4JFGY3am3ubKXIWVpNcuBRwqA/edit?usp=sharing

(I am currently waiting on a second opinion from staff on an earlier edit that has not been reviewed before I can drop this new edit in.)

Comment 8

[[e-mail] (:bhearsum)]

(In reply to Paul from comment #7)

A draft for your approval - https://docs.google.com/document/d/16LLUOYgwCF2eo_A6vq4JFGY3am3ubKXIWVpNcuBRwqA/edit?usp=sharing

(I am currently waiting on a second opinion from staff on an earlier edit that has not been reviewed before I can drop this new edit in.)

Thanks for drafting this. I left one comment on the doc, but it looks good to me otherwise.

Comment 9

[Alice Wyman]

<deleted> Sorry, I see that Paul is aware of the earlier edits still pending review.

Comment 10

[Paul]

Ready for review - https://support.mozilla.org/en-US/kb/install-firefox-linux/history#preview

Comment 11

[Kelimutu [:kiki]]

Looks like Flavius has taken care of the review. Thanks for everyone involved in this request (Paul, Alice, Mark H).

I'm closing the ticket now.