Repository: goreleaser/nfpm (go)

Issue:
[apk] Misleading documentation for apk.signature.key_name
### What happened?

The [documentation](https://nfpm.goreleaser.com/configuration/) says the following about this attribute:

```md
# The name of the signing key. When verifying a package, the signature 
# is matched to the public key store in /etc/apk/keys/<key_name>.rsa.pub.
# If unset, it defaults to the maintainer email address.
```
However, this is incorrect. As evident from the [code](https://github.com/goreleaser/nfpm/blob/a5376659a97b3c9b99cd45e5f5e84913ce3fa498/apk/apk.go#L292), nfpm will add the `.rsa.pub` extension in case of unset key_name only. `apk`, on its side, also doesn't add this extension when looking for the key. So this results in key lookup error in apk.

I believe we should add the `.rsa.pub` extension in the mentioned piece of code unconditionally, matching both the documentation and the already existing behavior in case of unset `key_name`.

### How can we reproduce this?

prepare the signed apk package with config like
```yaml
# ...
apk:
  signature:
    key_file: xxxx.rsa
    key_name: xxxx
```
omitting the `.rsa.pub` extension in `key_name`. Try installing this package with `apk add`.

### nfpm version

```bash
the one from https://github.com/goreleaser/nfpm/pull/804 (so git main, essentially)
```


### Search

- [X] I did search for other open and closed issues before opening this.

### Code of Conduct

- [X] I agree to follow this project's Code of Conduct

### Additional context

_No response_

Pull request:
fix(apk): always append .rsa.pub to key name
closes #806

Patch:
diff --git a/apk/apk.go b/apk/apk.go
index d2c987b..b715b8c 100644
--- a/apk/apk.go
+++ b/apk/apk.go
@@ -281,7 +281,10 @@ func createSignatureBuilder(digest []byte, info *nfpm.Info) func(*tar.Writer) er
 				return errNoKeyAddress
 			}
 
-			keyname = addr.Address + ".rsa.pub"
+			keyname = addr.Address
+		}
+		if !strings.HasSuffix(keyname, ".rsa.pub") {
+			keyname += ".rsa.pub"
 		}
 
 		// In principle apk supports RSA signatures over SHA256/512 keys, but in


Test patch:
diff --git a/apk/apk_test.go b/apk/apk_test.go
index b3b6900..a0ce0a2 100644
--- a/apk/apk_test.go
+++ b/apk/apk_test.go
@@ -315,6 +315,28 @@ func TestControl(t *testing.T) {
 	require.Equal(t, string(bts), w.String())
 }
 
+func TestSignatureName(t *testing.T) {
+	info := exampleInfo()
+	info.APK.Signature.KeyFile = "../internal/sign/testdata/rsa.priv"
+	info.APK.Signature.KeyName = "testkey"
+	info.APK.Signature.KeyPassphrase = "hunter2"
+	err := nfpm.PrepareForPackager(info, "apk")
+	require.NoError(t, err)
+
+	digest := sha1.New().Sum(nil) // nolint:gosec
+
+	var signatureTarGz bytes.Buffer
+	tw := tar.NewWriter(&signatureTarGz)
+	require.NoError(t, createSignatureBuilder(digest, info)(tw))
+
+	signature := extractFromTar(t, signatureTarGz.Bytes(), ".SIGN.RSA.testkey.rsa.pub")
+	err = sign.RSAVerifySHA1Digest(digest, signature, "../internal/sign/testdata/rsa.pub")
+	require.NoError(t, err)
+
+	err = Default.Package(info, io.Discard)
+	require.NoError(t, err)
+}
+
 func TestSignature(t *testing.T) {
 	info := exampleInfo()
 	info.APK.Signature.KeyFile = "../internal/sign/testdata/rsa.priv"