Source: kivy Version: 1.9.1-1 Severity: normal Dear Maintainer,
Your package appears to contain commands which use a short gpg-key ID. These have recently been identified as potential security concerns, due to a chance that the wrong key can be imported in the case of a forced key-ID collision [1]. The affected file is: /doc/sources/installation/installation-linux.rst [2] It is not clear to me that this is actually executed anywhere by the package, but may be an upstream issue. If this is the case, perhaps this should be forwarded on. Otherwise, please consider upgrading to a full key ID, for example, replace the command: gpg --keyserver <keyserver> --recv-keys <key_short_fingerprint> with gpg --keyserver <keyserver> --recv-keys <key_full_id> eg (not specific to your package): gpg --keyserver keyring.debian.org --recv-keys 05C3E651 becomes: gpg --keyserver keyring.debian.org --recv-keys 0x0D59D2B15144766A14D241C66BAF400B05C3E651 (Note the tail bytes are the same) This has previously been forwarded to the security team, who advised to report individual public bugs against each package - hence this bug. [1] http://lwn.net/Articles/697417 [2] https://anonscm.debian.org/cgit/python-modules/packages/kivy.git/tree/doc/sources/installation/installation-linux.rst
