From 860127bbea63f75c76ffbbaa598e5dd57c40968a Mon Sep 17 00:00:00 2001
From: Dimitri John Ledkov <dimitri.ledkov@chainguard.dev>
Date: Sat, 6 Dec 2025 09:11:42 +0000
Subject: [PATCH 1/3] Examples: build multi-arch alpine-base

This will test key discovery with matching ETags.
---
 examples/alpine-base.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/examples/alpine-base.yaml b/examples/alpine-base.yaml
index 88ab16a26..3fa82b471 100644
--- a/examples/alpine-base.yaml
+++ b/examples/alpine-base.yaml
@@ -12,3 +12,4 @@ environment:
 
 archs:
   - amd64
+  - arm64

From 2eceb0137b445b294d470ef42fb9aa0d7a50fa95 Mon Sep 17 00:00:00 2001
From: Dimitri John Ledkov <dimitri.ledkov@chainguard.dev>
Date: Sat, 6 Dec 2025 09:12:49 +0000
Subject: [PATCH 2/3] Cache keyrings by full name

Cache keyrings by full name, as keys that are in the same location may
have the same ETag.
---
 pkg/apk/apk/cache.go | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkg/apk/apk/cache.go b/pkg/apk/apk/cache.go
index 78ce1097a..74e26e559 100644
--- a/pkg/apk/apk/cache.go
+++ b/pkg/apk/apk/cache.go
@@ -368,6 +368,10 @@ func cacheDirFromFile(cacheFile string) string {
 		return filepath.Join(filepath.Dir(cacheFile), "APKINDEX")
 	}
 
+	if strings.HasSuffix(cacheFile, ".rsa.pub") {
+		return filepath.Join(filepath.Dir(cacheFile), filepath.Base(cacheFile))
+	}
+
 	return filepath.Dir(cacheFile)
 }
 
@@ -381,6 +385,11 @@ func cacheFileFromEtag(cacheFile, etag string) (string, error) {
 		ext = ".tar.gz"
 	}
 
+	// Keep all the rsa.pub files under subdirectory named by full filename.
+	if strings.HasSuffix(cacheFile, ".rsa.pub") {
+		cacheDir = filepath.Join(cacheDir, filepath.Base(cacheFile))
+	}
+
 	absPath, err := filepath.Abs(filepath.Join(cacheDir, etag+ext))
 	if err != nil {
 		return "", err

From 405a9d77691b028b32d2d142ab289537f35c154d Mon Sep 17 00:00:00 2001
From: Dimitri John Ledkov <dimitri.ledkov@chainguard.dev>
Date: Sat, 6 Dec 2025 09:21:50 +0000
Subject: [PATCH 3/3] Build samples for all the declared architectures

---
 .github/workflows/build-samples.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-samples.yml b/.github/workflows/build-samples.yml
index 080126530..d6ddc2627 100644
--- a/.github/workflows/build-samples.yml
+++ b/.github/workflows/build-samples.yml
@@ -89,8 +89,8 @@ jobs:
             if [ -f ${build_script} ]; then
               ${build_script} ./apko
             else
-              ./apko build ${cfg} ${name}:build /tmp/${name}.tar --arch amd64
-              ./apko build --offline ${cfg} ${name}:build /tmp/${name}.tar --arch amd64
+              ./apko build ${cfg} ${name}:build /tmp/${name}.tar
+              ./apko build --offline ${cfg} ${name}:build /tmp/${name}.tar
             fi
           done