osbuild-compose: Building RHEL 8.x from RHEL 9.5 system - SHA1 issues

[justin-davisibm]

Hey all-

I'm starting this as a discussion vs. a issue as I'm hoping this is more of a version issue that may be resolved with updated packages or a config to be documented vs. an actual issue/bug.

I'm running a RHEL 9.5 ppc64le osbuild system (118-2.el9_5) for building images. This is the most recent version available via the appstream repo- but if this is a version issue I can build from source if needed.

RHEL 9.x images build without issue, but all RHEL 8.X images fail with the following errors:

Pipeline: build
Stage: org.osbuild.rpm
Output:
Failed to open file "/sys/fs/selinux/checkreqprot": Read-only file system
warning: Signature not supported. Hash algorithm SHA1 not available.
error: /tmp/gpgkey.kdhfn215: key 2 import failed.
Traceback (most recent call last):
  File "/run/osbuild/bin/org.osbuild.rpm", line 251, in <module>
    r = main(args["tree"], args["inputs"], args["options"])
  File "/run/osbuild/bin/org.osbuild.rpm", line 150, in main
    subprocess.run([
  File "/usr/lib64/python3.9/subprocess.py", line 528, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['rpmkeys', '--root', '/run/osbuild/tree', '--import', '/tmp/gpgkey.kdhfn215']' returned non-zero exit status 1.

I've done some poking, enabled SHA1 (against my better judgement) as a test with no change in behavior. I was under the impression that RHEL8 repos were no longer using SHA1 and had all moved to SHA256 for support on RH9.x versions.

So- any help appreciated on this, and happy to open up an issue if needed.