Firefox revoked the repo gpgkey for Firefox and Thunderbird on Mozilla Repos (Third Party). This may break the updates for these packages. The gpgkeys do not update properly via a normal import as the old keys confuse the update.
Mozilla updated to Firefox 153.0.4 today.
I found that the method described by Mozilla is not removing the gpgkeys on RHEL 10. This is the method I used.
List all gpgkeys:
rpm -qa gpg-pubkey* --qf ‘%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n’
Remove example gpgkey:
rpm -e --allmatches gpg-pubkey-d98f0353-55a94004
Sorry, I’m afraid I don’t understand. Is this referring to Rocky’s repositories or a third-party repository?
These are the Mozilla keys, not Rocky’s and affect Mozilla repos. I put this out here mainly because of the use of Firefox and Thunderbird in the Linux community and the potential impact. I am not sure what happens in the Rocky Repo for Firefox ESR, e.g. who signed it as this goes forward. I assume that Rocky signs the packages in the Repo including Firefox/Thunderbird.
Rocky signs it’s own repositories. Since Firefox is in AppStream, then those will be signed by Rocky.
If they are in third party repositories, then it’s whoever maintains them. You mentioned Firefox ESR, so assuming that is the version in AppStream, then that is signed by Rocky.
So probably similar situation like when Gitlab rotates it’s package signing keys, that they have to be re-imported.
I looked at a template Rocky and also saw that Rocky is signing the ESR keys after jdieter’s comment. This only applies to those who use the Mozilla Repos (Third Party). Unfortunately, the re-import does not work and a removal process is necessary.