dnf-json: expose each RPM location and content hash

In adition to the NEVRA, include the location and hash over the rpm
file. This allows us to separately fetch and verify that refernces
to RPMs are correct, as the NEVRA alone is not sufficient for fetching
nor verifying.

This is a prerequisite for using the rpm rather than the dnf stage
in our osbuild pipelines.

Signed-off-by: Tom Gundersen <teg@jklm.no>

dnf-json

@@ -3,6 +3,7 @@
 import datetime
 import dnf
 import hashlib
+import hawkey
 import json
 import shutil
 import sys
@@ -124,7 +125,9 @@ elif command == "depsolve":
             "epoch": package.epoch,
             "version": package.version,
             "release": package.release,
-            "arch": package.arch
+            "arch": package.arch,
+            "remote_location": package.remote_location(),
+            "checksum": f"{hawkey.chksum_name(package.chksum[0])}:{package.chksum[1].hex()}",
         })
     json.dump({
         "checksums": repo_checksums(base),

internal/rpmmd/repository.go

@@ -62,11 +62,13 @@ func (pkg Package) ToPackageInfo() PackageInfo {
 }
 
 type PackageSpec struct {
-	Name    string `json:"name"`
-	Epoch   uint   `json:"epoch"`
-	Version string `json:"version,omitempty"`
-	Release string `json:"release,omitempty"`
-	Arch    string `json:"arch,omitempty"`
+	Name           string `json:"name"`
+	Epoch          uint   `json:"epoch"`
+	Version        string `json:"version,omitempty"`
+	Release        string `json:"release,omitempty"`
+	Arch           string `json:"arch,omitempty"`
+	RemoteLocation string `json:"remote_location,omitempty"`
+	Checksum       string `json:"checksum,omitempty"`
 }
 
 type PackageSource struct {