stages/rpm: allow check_gpg to be omitted

This brings it in line with the JSON schema. Also fix a bug where the
wrong root was used for checking the signatures.

Signed-off-by: Tom Gundersen <teg@jklm.no>

stages/org.osbuild.rpm

@@ -101,12 +101,13 @@ def main(tree, sources, options):
     osbuild.sources.get("org.osbuild.files", checksums)
 
     for pkg in packages:
-        if pkg["check_gpg"]:
-            subprocess.run(
-                ["rpmkeys", "--checksig", pkg["checksum"]],
-                cwd=f"{sources}/org.osbuild.files",
-                stdout=subprocess.DEVNULL,
-                check=True)
+        if pkg.get("check_gpg"):
+            subprocess.run([
+                "rpmkeys",
+                "--root", tree,
+                "--checksig",
+                pkg["checksum"]
+            ], cwd=f"{sources}/org.osbuild.files", stdout=subprocess.DEVNULL, check=True)
 
     script = f"""
         set -e