Issue 3194 - Allow multiple sources for a dependency

ensure_dependencies.py

 #!/usr/bin/env python
 # coding: utf-8
 
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 import sys
 import os
 import posixpath
@@ skipping 145 matching lines @@
       type, value = item.split(":", 1)
     else:
       type, value = ("*", item)
     if type in result:
       logging.warning("Ignoring duplicate value for type %s (key %s in file %s)" % (type, key, path))
     else:
       result[type] = value
   return key, result
 
 def read_deps(repodir):
+  parenttype = get_repo_type(repodir)
   result = {}
   deps_path = os.path.join(repodir, "dependencies")
   try:
     with io.open(deps_path, "rt", encoding="utf-8") as handle:
       for line in handle:
         # Remove comments and whitespace
         line = re.sub(r"#.*", "", line).strip()
         if not line:
           continue
 
         key, spec = parse_spec(deps_path, line)
-        if spec:
+        if spec and (key not in result or parenttype in spec.keys()):
           result[key] = spec
     return result
   except IOError, e:
     if e.errno != errno.ENOENT:
       raise
     return None
 
 def safe_join(path, subpath):
   # This has been inspired by Flask's safe_join() function
   forbidden = {os.sep, os.altsep} - {posixpath.sep, None}
@@ skipping 144 matching lines @@
   args = parser.parse_args()
 
   if args.quiet:
     logging.disable(logging.INFO)
 
   repos = args.repos
   if not len(repos):
     repos = [os.path.dirname(__file__)]
   for repo in repos:
     resolve_deps(repo)