[PATCH] sec-keys.eclass: detect conflicting key name/remote mappings

Detect conflicting SEC_KEYS_VALIDPGPKEYS entries where the same
name/remote pair maps to different OpenPGP fingerprints.

For keyserver-based remotes (gentoo, openpgp and Ubuntu), the
fingerprint is part of the download URL while the target filename
is derived only from the key name and remote. So multiple
fingerprints for the same name/remote pair would overwrite each
other. Github downloads are keyed by user name only and
can include multiple fingerprints, so the overwrite is harmless.

Reject such configurations early with a descriptive error message.

Closes: https://bugs.gentoo.org/979441
Signed-off-by: Z. Liu <[email protected]>
---
 eclass/sec-keys.eclass | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/eclass/sec-keys.eclass b/eclass/sec-keys.eclass
index b53b7143bea65..0f93183e560b2 100644
--- a/eclass/sec-keys.eclass
+++ b/eclass/sec-keys.eclass
@@ -63,7 +63,8 @@ inherit eapi9-pipestatus edo
 #  - manual -- do not add to SRC_URI, the ebuild will provide a custom
 #    download location
 _sec_keys_set_globals() {
-       local key fingerprint name loc locations=() remote
+       local -A name_loc_fpr=()
+       local key key_id fingerprint name loc locations=() remote

        for key in "${SEC_KEYS_VALIDPGPKEYS[@]}"; do
                fingerprint=${key%%:*}
@@ -80,6 +81,23 @@ _sec_keys_set_globals() {
                                manual) continue;;
                                *) die "${ECLASS}: unknown PGP key
remote: ${loc}";;
                        esac
+
+                       # github remote depends only on the user name.
Other remotes include the
+                       # fingerprint in the URL, so prevent multiple
fingerprints from mapping
+                       # to the same output file.
+                       key_id="${name}:${loc}"
+                       case ${loc} in
+                               gentoo|openpgp|ubuntu)
+                                       if [[ -v "name_loc_fpr[${key_id}]" ]] &&
+                                               [[
${name_loc_fpr["${key_id}"]} != "${fingerprint}" ]]
+                                       then
+                                               die "${ECLASS}:
${key_id} maps to multiple fingerprints: " \
+
"${name_loc_fpr["${key_id}"]} and ${fingerprint}"
+                                       fi
+                                       name_loc_fpr["${key_id}"]=${fingerprint}
+                                       ;;
+                       esac
+
                        SRC_URI+="
                                ${remote} ->
openpgp-keys-${name}-${loc}-${PV}.asc
                        "
--
2.49.1