fix(automation): sign_trust deduplicates certificates with a set (#5965)

crates/automation/src/signing.rs

@@ -310,6 +310,9 @@ impl Automation {
     pub(crate) fn sign_trust(&mut self, a: &Args) -> Result<Value> {
         let mut certs: Vec<Certificate> =
             if a.opt_bool("clear")?.unwrap_or(false) { Vec::new() } else { self.session.trusted_certificates().to_vec() };
+        // Which certificates are already in, by their bytes: a set, so a bundle of many distinct
+        // certificates isn't compared against every one before it.
+        let mut known: std::collections::HashSet<Vec<u8>> = certs.iter().map(|c| c.raw.clone()).collect();
         let paths: Vec<String> = match a.get("paths") {
             None => Vec::new(),
             Some(v) => v
@@ -330,7 +333,7 @@ impl Automation {
                 sign::x509::load_certificates(&bytes).map_err(failed)?
             };
             for c in found {
-                if !certs.iter().any(|t| t.raw == c.raw) {
+                if known.insert(c.raw.clone()) {
                     certs.push(c);
                 }
             }