scripts/apk/ci-build.sh

@@ -50,7 +50,13 @@ if [[ ! -e "${HOME}/.abuild/abuild.conf" && -d "${repo_root}/.cache/abuild" ]];
 fi
 
 if ! compgen -G "${HOME}/.abuild/*.rsa" > /dev/null; then
-  abuild-keygen -a -n
+  # APK signatures identify their public key by filename.  Matrix workers can
+  # otherwise generate different builder-<timestamp>.rsa keys with the same
+  # name when they start during the same second, making their artifacts
+  # impossible to merge.  Use the selected package only while generating the
+  # key so the package metadata retains the configured PACKAGER value.
+  key_identity="${ALPINE_PACKAGE:-ci}"
+  PACKAGER="CI key <ci-${key_identity}@local.invalid>" abuild-keygen -a -n
 fi
 
 doas cp "${HOME}"/.abuild/*.rsa.pub /etc/apk/keys/