Fix LavinMQ CI toolchain

.gitea/workflows/build.yml

@@ -41,6 +41,7 @@ jobs:
     steps:
       - name: Prepare Environment
         run: |
+          printf '%s\n' 'https://dl-cdn.alpinelinux.org/alpine/edge/community' >> /etc/apk/repositories
           apk add --no-cache --update abuild-rootbld alpine-sdk atools-apkbuild-lint bash ca-certificates curl doas git jq nodejs rsync shellcheck sudo tar
           trivy_archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
           curl -fsSL -o "/tmp/${trivy_archive}" "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${trivy_archive}"

scripts/apk/ci-smoke.sh

@@ -30,11 +30,11 @@ done
 if [[ -d "${repo_dir}" ]]; then
   cp "${repo_dir}"/*.rsa.pub /etc/apk/keys/
   echo "${repo_root}/packages/${repo_name}" >> /etc/apk/repositories
-elif [[ -z "${registry_url}" ]]; then
+else
-  printf 'missing local repository and no registry fallback: packages/%s/%s\n' "${repo_name}" "${arch}" >&2
+  if [[ -z "${registry_url}" ]]; then
-  exit 1
+    printf 'missing local repository and no registry fallback: packages/%s/%s\n' "${repo_name}" "${arch}" >&2
-fi
+    exit 1
-if [[ -n "${registry_url}" ]]; then
+  fi
   if [[ ! -f "${registry_key}" ]]; then
     printf 'missing Alpine registry signing key: %s\n' "${registry_key:-<unset>}" >&2
     exit 1

scripts/apk/security-report.sh

@@ -32,7 +32,7 @@ install_rootfs() {
   shift 2
   local -a specs=("$@")
   local -a apk_args=(--root "${rootfs}/installed" --initdb --no-scripts --arch "${arch}")
-  local key_dir repo_file
+  local key_dir repo_file native_arch
 
   key_dir="${rootfs}/keys"
   repo_file="${rootfs}/repositories"
@@ -48,6 +48,17 @@ install_rootfs() {
   if [[ "$(id -u)" != 0 ]]; then
     apk_args+=(--usermode)
   fi
+
+  native_arch="$(apk --print-arch)"
+  if [[ "${arch}" != "${native_arch}" ]]; then
+    # A native Alpine image does not necessarily carry the current signing keys
+    # for another architecture. Bootstrap that architecture's alpine-keys over
+    # HTTPS, then use the refreshed key set for the actual dependency install.
+    apk "${apk_args[@]}" --keys-dir "${key_dir}" --repositories-file "${repo_file}" \
+      --allow-untrusted add --no-cache alpine-keys
+    cp "${rootfs}/installed/etc/apk/keys/"*.pub "${key_dir}/"
+  fi
+
   apk "${apk_args[@]}" --keys-dir "${key_dir}" --repositories-file "${repo_file}" \
     add --no-cache "${specs[@]}"
 }