Dear Maintainer,

Someone wrote in a forum that I can't quote here something along the
lines of it should be a bug for any Debian package to accept a
short-form GPG keyid.  I agree.


Dgit still accepts short-form keyids (and it doesn't look like this
has been fixed in the repo) even though tools it calls does not.

Sam Hartman writes ("Bug#926477: dgit accepts short keyid even though debsign does not"):
...

That might even have been me.

I don't think dgit does anything with the keyid other than pass it to
other tools.  It doesn't validate the format at all, just treating it
as an opaque string.

I don't think it's dgit's job to do that ?  Is there a practical
problem that results from dgit not investigating the keyid syntax and
length ?

Ian.

retitle -1 check signing key availability (add short keyid test case)
severity -1 minor

Sam writes that the consequences of this bug are that dgit does a lot
of work and then fails with a less than helpful error message.  (Ie,
as I thought, it does not carry on and use a possibly-wrong key, so
this is a useability issue rather than a security problem.)

I think here is the way to fix it:

One test case that should be added is that this new check properly
fails early when a short keyid is provided.

Thanks,
Ian.