From 86460ee2bac421eced6dae3c2e54c9708dd07b9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Joachim=20Schl=C3=B6ffel?= <me@joachim-schloeffel.com>
Date: Mon, 24 Aug 2026 19:45:51 +0200
Subject: [PATCH] Fix LavinMQ CI toolchain

---
 .gitea/workflows/build.yml     |  1 +
 scripts/apk/ci-smoke.sh        | 10 +++++-----
 scripts/apk/security-report.sh | 13 ++++++++++++-
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 772ad4f..058d49e 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -41,6 +41,7 @@ jobs:
     steps:
       - name: Prepare Environment
         run: |
+          printf '%s\n' 'https://dl-cdn.alpinelinux.org/alpine/edge/community' >> /etc/apk/repositories
           apk add --no-cache --update abuild-rootbld alpine-sdk atools-apkbuild-lint bash ca-certificates curl doas git jq nodejs rsync shellcheck sudo tar
           trivy_archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
           curl -fsSL -o "/tmp/${trivy_archive}" "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${trivy_archive}"
diff --git a/scripts/apk/ci-smoke.sh b/scripts/apk/ci-smoke.sh
index 8f5e834..1c95c4c 100755
--- a/scripts/apk/ci-smoke.sh
+++ b/scripts/apk/ci-smoke.sh
@@ -30,11 +30,11 @@ done
 if [[ -d "${repo_dir}" ]]; then
   cp "${repo_dir}"/*.rsa.pub /etc/apk/keys/
   echo "${repo_root}/packages/${repo_name}" >> /etc/apk/repositories
-elif [[ -z "${registry_url}" ]]; then
-  printf 'missing local repository and no registry fallback: packages/%s/%s\n' "${repo_name}" "${arch}" >&2
-  exit 1
-fi
-if [[ -n "${registry_url}" ]]; then
+else
+  if [[ -z "${registry_url}" ]]; then
+    printf 'missing local repository and no registry fallback: packages/%s/%s\n' "${repo_name}" "${arch}" >&2
+    exit 1
+  fi
   if [[ ! -f "${registry_key}" ]]; then
     printf 'missing Alpine registry signing key: %s\n' "${registry_key:-<unset>}" >&2
     exit 1
diff --git a/scripts/apk/security-report.sh b/scripts/apk/security-report.sh
index 8580739..9a14442 100755
--- a/scripts/apk/security-report.sh
+++ b/scripts/apk/security-report.sh
@@ -32,7 +32,7 @@ install_rootfs() {
   shift 2
   local -a specs=("$@")
   local -a apk_args=(--root "${rootfs}/installed" --initdb --no-scripts --arch "${arch}")
-  local key_dir repo_file
+  local key_dir repo_file native_arch
 
   key_dir="${rootfs}/keys"
   repo_file="${rootfs}/repositories"
@@ -48,6 +48,17 @@ install_rootfs() {
   if [[ "$(id -u)" != 0 ]]; then
     apk_args+=(--usermode)
   fi
+
+  native_arch="$(apk --print-arch)"
+  if [[ "${arch}" != "${native_arch}" ]]; then
+    # A native Alpine image does not necessarily carry the current signing keys
+    # for another architecture. Bootstrap that architecture's alpine-keys over
+    # HTTPS, then use the refreshed key set for the actual dependency install.
+    apk "${apk_args[@]}" --keys-dir "${key_dir}" --repositories-file "${repo_file}" \
+      --allow-untrusted add --no-cache alpine-keys
+    cp "${rootfs}/installed/etc/apk/keys/"*.pub "${key_dir}/"
+  fi
+
   apk "${apk_args[@]}" --keys-dir "${key_dir}" --repositories-file "${repo_file}" \
     add --no-cache "${specs[@]}"
 }