[cipd] Include local path in package lock key

jiri should allow the same package to be included by a manifest multiple
times at different paths. However, this was previously not always
possible because jiri only used the name and version of each package to
compute it unique key when checking for duplicate entries in a lockfile.
So it was only possible to have the same package at two different paths
as long as the two were pinned to different versions.

That bug caused failures like this when a package was pinned to the same
version at two different paths:
https://ci.chromium.org/b/8841199368556918912

By including the package's local path in the key, we'll no longer
consider that to be a collision.

Change-Id: I3dde72473f43d6dbcd5cc3565f79e98c88694b64
Reviewed-on: https://fuchsia-review.googlesource.com/c/jiri/+/560285
Fuchsia-Auto-Submit: Oliver Newman <olivernewman@google.com>
Commit-Queue: Auto-Submit <auto-submit@fuchsia-infra.iam.gserviceaccount.com>
Reviewed-by: Nathan Mulcahey <nmulcahey@google.com>
diff --git a/project/manifest.go b/project/manifest.go
index d2000cf..2016633 100644
--- a/project/manifest.go
+++ b/project/manifest.go
@@ -24,13 +24,14 @@
 	"text/template"
 	"time"
 
+	"golang.org/x/net/publicsuffix"
+
 	"go.fuchsia.dev/jiri"
 	"go.fuchsia.dev/jiri/cipd"
 	"go.fuchsia.dev/jiri/envvar"
 	"go.fuchsia.dev/jiri/gerrit"
 	"go.fuchsia.dev/jiri/gitutil"
 	"go.fuchsia.dev/jiri/retry"
-	"golang.org/x/net/publicsuffix"
 )
 
 // Manifest represents a setting used for updating the universe.
@@ -736,7 +737,7 @@
 				return err
 			}
 			for _, pkg := range pkgs {
-				if pkgLock, ok := ld.PackageLocks[MakePackageLockKey(pkg, v.Version)]; ok {
+				if pkgLock, ok := ld.PackageLocks[MakePackageLockKey(pkg, v.Version, v.Path)]; ok {
 					if pkgLock.VersionTag != v.Version && !jirix.IgnoreLockConflicts {
 						// Package version conflicts detected. Treated it as an error.
 						s := fmt.Sprintf("package %q has conflicting version in manifest and jiri.lock: %s:%s", v.Name, v.Version, pkgLock.VersionTag)
diff --git a/project/project.go b/project/project.go
index d667913..238defe 100644
--- a/project/project.go
+++ b/project/project.go
@@ -437,17 +437,18 @@
 type PackageLockKey struct {
 	packageName string
 	versionTag  string
+	localPath   string
 }
 
-func MakePackageLockKey(packageName string, versionTag string) PackageLockKey {
-	return PackageLockKey{packageName: packageName, versionTag: versionTag}
+func MakePackageLockKey(packageName, versionTag, localPath string) PackageLockKey {
+	return PackageLockKey{packageName: packageName, versionTag: versionTag, localPath: localPath}
 }
 
 // PackageLocks type is map wrapper over PackageLock for faster look up
 type PackageLocks map[PackageLockKey]PackageLock
 
 func (p PackageLock) Key() PackageLockKey {
-	return MakePackageLockKey(p.PackageName, p.VersionTag)
+	return MakePackageLockKey(p.PackageName, p.VersionTag, p.LocalPath)
 }
 
 // LockEqual determines whether current PackageLock has same version and
@@ -1366,7 +1367,7 @@
 						return nil, nil, err
 					}
 					for _, expandedName := range expandedNames {
-						lockKey := MakePackageLockKey(expandedName, v.Version)
+						lockKey := MakePackageLockKey(expandedName, v.Version, v.Path)
 						lockEntry, ok := pkgLocks[lockKey]
 						if !ok {
 							jirix.Logger.Errorf("lock key not found in pkgLocks: %v, package: %+v", lockKey, v)