GPG: stop using 32-bit key ID

[qgib]

Author Name: Patryk Sciborek (Patryk Sciborek)
Original Redmine Issue: 11772
Affected QGIS version: 2.6.0
Redmine category:build/install

---

Hi!

I'd like to add QGIS Archive Automatic Signing Key (2014) to my keystore. Unfortunately there is no way to tell if key received from keyserver is correct because you use only 32-bit key ID (eg. http://www.qgis.org/en/site/forusers/alldownloads.html#debian).

Since you can generate collision in few seconds (see: https://evil32.com/) it would be much better if you use full key fingerprint or at least provide it somewhere so user can verify it manually.

Kind regards,
Patryk

[qgib]

Author Name: Jürgen Fischer (@jef-n)

---

Fixed in "a3fe6b1":qgis/QGIS-Website@a3fe6b1

---

• resolution was changed from to fixed/implemented
• status_id was changed from Open to Closed