Fix LavinMQ CI toolchain

scripts/apk/security-report.sh

@@ -32,7 +32,7 @@ install_rootfs() {
   shift 2
   local -a specs=("$@")
   local -a apk_args=(--root "${rootfs}/installed" --initdb --no-scripts --arch "${arch}")
-  local key_dir repo_file
+  local key_dir repo_file native_arch
 
   key_dir="${rootfs}/keys"
   repo_file="${rootfs}/repositories"
@@ -48,6 +48,17 @@ install_rootfs() {
   if [[ "$(id -u)" != 0 ]]; then
     apk_args+=(--usermode)
   fi
+
+  native_arch="$(apk --print-arch)"
+  if [[ "${arch}" != "${native_arch}" ]]; then
+    # A native Alpine image does not necessarily carry the current signing keys
+    # for another architecture. Bootstrap that architecture's alpine-keys over
+    # HTTPS, then use the refreshed key set for the actual dependency install.
+    apk "${apk_args[@]}" --keys-dir "${key_dir}" --repositories-file "${repo_file}" \
+      --allow-untrusted add --no-cache alpine-keys
+    cp "${rootfs}/installed/etc/apk/keys/"*.pub "${key_dir}/"
+  fi
+
   apk "${apk_args[@]}" --keys-dir "${key_dir}" --repositories-file "${repo_file}" \
     add --no-cache "${specs[@]}"
 }