abuild: add sanitycheck for secfixes comment

The secfixes comment will be parsed and added to alpine-secdb. add
sanitycheck so we catch errors early.

abuild.in

@@ -219,6 +219,7 @@ default_sanitycheck() {
 	check_maintainer || die "Provide a valid RFC822 maintainer address"
 
 	check_depends_dev || warning "depends_dev found but no development subpackage found"
+	check_secfixes_comment || return 1
 
 	makedepends_has 'g++' && ! options_has toolchain && warning "g++ should not be in makedepends"
 	return 0
@@ -816,6 +817,26 @@ check_maintainer() {
 	fi
 }
 
+check_secfixes_comment() {
+	local c=$(sed -E -n -e '/^# secfixes:/,/(^[^#]|^$)/p' $APKBUILD | grep '^#')
+	local invalid=$(echo "$c" \
+		| grep -v -E '(^# secfixes:|^#  +- [A-Z0-9-]+|^#   [0-9]+.*:$|^#$)')
+	if [ -z "$invalid" ]; then
+		return 0
+	fi
+
+	# check if there are tabs
+	if echo "$invalid" | grep -q $'\t'; then
+		error "secfixes comment must not have tabs:"
+		echo "$c" | grep $'\t' >&2
+		return 1
+	fi
+
+	error "secfixes comment is not valid:"
+	echo "$invalid" >&2
+	return 1
+}
+
 check_depends_dev() {
 	if [ -z "$depends_dev" ]; then
 		return 0