[PATCH pgpkeys] korg-refresh-keys: Fix a race condition

The script called git fetch and git pull. Two assumptions break if the
remote repository changed in between. So only merge @{u} instead of
pulling.
---
 scripts/korg-refresh-keys | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/korg-refresh-keys b/scripts/korg-refresh-keys
index 1c6014ab10c8..d66b489341b0 100644
--- a/scripts/korg-refresh-keys
+++ b/scripts/korg-refresh-keys
@@ -45,7 +45,10 @@ fi
 
 CHANGED=$(git diff --name-only HEAD @{u} | grep '.asc$')
 
-git pull $Q
+# Don't use pull here in case upstream moved on since the fetch above. If this
+# happens CHANGED would likely be incomplete and you wouldn't have verified
+# HEAD but continue to import keymaterial from it.
+git merge $Q @{u}
 
 IMPORTFILES=''
 for ASCFILE in $CHANGED; do
-- 
2.39.2