[Python-modules-team] Bug#836555: kivy: docs describe short gpg key usage

[D Haley]

Source: kivy
Version: 1.9.1-1
Severity: normal

Dear Maintainer,

Your package appears to contain commands which use a short gpg-key
ID. These have recently been identified as potential security concerns,
due to a chance that the wrong key can be imported in the case of a
forced key-ID collision [1].

The affected file is:
 /doc/sources/installation/installation-linux.rst [2]

It is not clear to me that this is actually executed anywhere by the
package, but may be an upstream issue. If this is the case, perhaps this
should be forwarded on.


Otherwise, please consider upgrading to a full key ID, for example, replace the command:

 gpg --keyserver <keyserver> --recv-keys <key_short_fingerprint> 

with

 gpg --keyserver  <keyserver> --recv-keys <key_full_id>

eg (not specific to your package):

 gpg --keyserver keyring.debian.org --recv-keys 05C3E651

becomes:

 gpg --keyserver keyring.debian.org --recv-keys 0x0D59D2B15144766A14D241C66BAF400B05C3E651


(Note the tail bytes are the same)

This has previously been forwarded to the security team, who advised to
report individual public bugs against each package - hence this bug.

[1] http://lwn.net/Articles/697417
[2] https://anonscm.debian.org/cgit/python-modules/packages/kivy.git/tree/doc/sources/installation/installation-linux.rst