Certificate revocation hits older GitHub Desktop and Atom releases

GitHub will revoke three code-signing certificates on February 2, 2023, after detecting unauthorized access to repositories used in the development of GitHub Desktop and Atom. The revocation will invalidate specific versions of both applications, and users running those versions will need to take action before the cutover date.

The incident began on December 7, 2022, when GitHub discovered that a compromised Personal Access Token (PAT) associated with a machine account had cloned repositories from the atom, desktop, and other deprecated GitHub-owned organizations. The affected repositories contained no customer data, and GitHub found no evidence of unauthorized changes to the projects or any impact to GitHub.com services.

However, several encrypted code-signing certificates stored in those repositories for use in release workflows were exfiltrated. While the certificates were password-protected and there is no evidence they were decrypted or used maliciously, GitHub is revoking them as a preventative measure. Three certificates were still valid at the time of the incident: two Digicert code-signing certificates for Windows and one Apple Developer ID certificate.

Which versions are affected

The following GitHub Desktop for Mac versions will stop working on February 2: 3.1.2, 3.1.1, 3.1.0, 3.0.8, 3.0.7, 3.0.6, 3.0.5, 3.0.4, 3.0.3, and 3.0.2. GitHub Desktop for Windows is unaffected. Users on these Mac versions should update to the latest release of GitHub Desktop.

Two versions of Atom—1.63.1 and 1.63.0—will also stop working on February 2. GitHub has removed these versions from the releases page, and users who want to continue using Atom will need to download the previous release (v1.60.0) per GitHub's sunsetting guidance.

Certificate timeline and risk assessment

Each of the three certificates has a different expiration profile:

  • One Digicert certificate expired on January 4, 2023, and the second expires on February 1, 2023. Once expired, these certificates can no longer be used to sign code, but GitHub will revoke them on February 2 anyway as a precaution.
  • The Apple Developer ID certificate remains valid until 2027. Until revocation, GitHub is working with Apple to monitor for any new executables signed with the exposed certificate.

Code-signing certificates verify that an application was created by the listed author, similar to commit signing on GitHub. The exposure does not put existing installations of Desktop or Atom at risk; the concern is that, if decrypted, the certificates could be used to sign unofficial applications that appear to be officially created by GitHub.

On January 4, 2023, GitHub published a new version of GitHub Desktop signed with fresh certificates that were not exposed during the incident.

GitHub recommends that affected users update GitHub Desktop to the latest version before February 2 to avoid workflow disruptions. Atom users who want to keep using the application should downgrade to v1.60.0 ahead of the revocation date. The certificates have not been shown to have been misused, and the revocation is a defensive measure rather than a response to confirmed malicious activity.