Post #1822024
2026-04-30 21:41 UTC
#LibreWolf v150.0.1-1 is now available!
https://codeberg.org/librewolf/bsys6/releases/tag/150.0.1-1
https://librewolf.net/installation/
No major changes from LibreWolf's end.
Unfortunately, we had to rotate one of our signing subkeys, as it was, for a very short period of time, exposed in a CI log. The CI log was swiftly removed with the help of Codeberg, but however unlikely it is, we cannot guarantee that another party hadn't viewed the key within that timeframe.
1/5
Replies (2)
-
@librewolf@chaos.social 2026-04-30 21:41
For that reason, it will be revoked, and our 150.0.1-1 releases have all been signed with a newly generated subkey. As only the subkey (0x43A83048DF19C075A55266A78A74EAAF89C17944) had been exposed (only it is available to the CI), our main key itself (0x662E3CDD6FE329002D0CA5BB40339DD82B12EF16) could not have been compromised by this. The new signing subkey's fingerprint is 0x230FE8E090E0ECBF2D925560915585A1C36690B1. 2/5
-
@loadhigh@bitbang.social 2026-04-30 21:49
@librewolf Thanks for being transparent about this. What caused the private (I guess) part of the key to be exposed? Is there something everyone can learn from this for the future? (edit: spelling error)