From 40eaf081adcda93a6832949ca5ac550104506835 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Joachim=20Schl=C3=B6ffel?= <me@joachim-schloeffel.com>
Date: Tue, 29 Sep 2026 00:34:41 +0200
Subject: [PATCH] fix CI key collision

---
 scripts/apk/ci-build.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/apk/ci-build.sh b/scripts/apk/ci-build.sh
index 0f01c23..04bed4e 100755
--- a/scripts/apk/ci-build.sh
+++ b/scripts/apk/ci-build.sh
@@ -50,7 +50,13 @@ if [[ ! -e "${HOME}/.abuild/abuild.conf" && -d "${repo_root}/.cache/abuild" ]];
 fi
 
 if ! compgen -G "${HOME}/.abuild/*.rsa" > /dev/null; then
-  abuild-keygen -a -n
+  # APK signatures identify their public key by filename.  Matrix workers can
+  # otherwise generate different builder-<timestamp>.rsa keys with the same
+  # name when they start during the same second, making their artifacts
+  # impossible to merge.  Use the selected package only while generating the
+  # key so the package metadata retains the configured PACKAGER value.
+  key_identity="${ALPINE_PACKAGE:-ci}"
+  PACKAGER="CI key <ci-${key_identity}@local.invalid>" abuild-keygen -a -n
 fi
 
 doas cp "${HOME}"/.abuild/*.rsa.pub /etc/apk/keys/