Start using libpkgmanifest for lockfiles

[praiskup]

With modern dnf5/dnf4, we can do:

$ dnf --installroot /var/lib/mock/fedora-44-x86_64/root/ manifest
...
$ ls *yaml
packages.manifest.yaml

$ head -15 *yaml
document: rpm-package-manifest
version: 0.2.2
data:
  repositories:
    - id: fedora
      metalink: "https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=$arch"
    - id: updates
      metalink: "https://mirrors.fedoraproject.org/metalink?repo=updates-released-f44&arch=$arch"
  packages:
    noarch:
      - name: R-srpm-macros
        repo_id: updates
        checksum: sha1:4cbf0f3d1ec9249d4c931da9d20303523973c970
        size: 0
        evr: 1.3.7-2.fc44

$ dnf --installroot /var/lib/mock/fedora-44-x86_64/root/ manifest download

$ sudo find packages.manifest/ | head
packages.manifest/
packages.manifest/add-determinism-0.7.3-2.fc44.x86_64.rpm
packages.manifest/alternatives-1.33-5.fc44.x86_64.rpm
packages.manifest/audit-libs-4.1.4-1.fc44.x86_64.rpm
packages.manifest/bash-5.3.9-3.fc44.x86_64.rpm
packages.manifest/binutils-2.46.1-1.fc44.x86_64.rpm
packages.manifest/bzip2-1.0.8-23.fc44.x86_64.rpm
packages.manifest/bzip2-libs-1.0.8-23.fc44.x86_64.rpm
packages.manifest/coreutils-9.10-4.fc44.x86_64.rpm
packages.manifest/coreutils-common-9.10-4.fc44.x86_64.rpm

See rpm-software-management/libpkgmanifest#5

[praiskup]

@tkopecek CC

[praiskup]

One issue is that dnf manifest isn't available in OCI images by default—it needs to be explicitly installed into the bootstrap, which breaks reproducibility for hermetic builds (we rely on bootstrap_image_ready = True).

Another problem is that it relies on metalink/baseurl + checksums. Over time, while RPMs are preserved in Koji, the referenced baseurls eventually disappear. Because of this, recreating corresponding Koji buildroots without a direct list of RPM URLs can be a real pain.

@pkratoch CC

[praiskup]

We probably need to keep the current Mock lockfile support for a while (years), to keep the lockfile support for old targets.