distro: set the repository checksum dynamically

Instead of having a static repository checksum, set it dynamically from
the metadata that osbuild-composer last saw. This is implemented in
dnf-json, which returns the checksums for each repository on every call.

This enables the use of repositories that change over time, such as
fedora-updates. Note that the osbuild pipeline will break when such a
repository changes. This is intentional: pipelines have to be
reproducible.

cmd/osbuild-pipeline/main.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/osbuild/osbuild-composer/internal/blueprint"
 	"github.com/osbuild/osbuild-composer/internal/distro"
+	"github.com/osbuild/osbuild-composer/internal/rpmmd"
 )
 
 func main() {
@@ -36,7 +37,25 @@ func main() {
 		panic("unknown distro: " + distroArg)
 	}
 
-	pipeline, err := d.Pipeline(blueprint, format)
+	packages := make([]string, len(blueprint.Packages))
+	for i, pkg := range blueprint.Packages {
+		packages[i] = pkg.Name
+		// If a package has version "*" the package name suffix must be equal to "-*-*.*"
+		// Using just "-*" would find any other package containing the package name
+		if pkg.Version != "" && pkg.Version != "*" {
+			packages[i] += "-" + pkg.Version
+		} else if pkg.Version == "*" {
+			packages[i] += "-*-*.*"
+		}
+	}
+
+	rpmmd := rpmmd.NewRPMMD()
+	_, checksums, err := rpmmd.Depsolve(packages, d.Repositories())
+	if err != nil {
+		panic(err.Error())
+	}
+
+	pipeline, err := d.Pipeline(blueprint, checksums, format)
 	if err != nil {
 		panic(err.Error())
 	}