Generate and maintain repository metadata in tree

[legoktm]

Let's match the securedrop-apt-prod process by generating metadata at
commit-time instead of doing it on the server.

The publish script takes care to generate reproducible output by
fixing the mtime of all the RPMs and telling createrepo_c what the
time should be.

CI verifies the generated metadata is up to date and fully reproducible
using the --reproduce flag.

Refs https://github.com/freedomofpress/infrastructure/issues/4241.

Test plan

• Visual review
• CI passes
• Add any RPM to the f37 folder, run ./tools/publish locally, see metadata files change. Stage these changes
• Run ./tools/publish --reproduce, you should see no changes to the files compared to the previous step

[legoktm]

Missing:

• CI verification that metadata is up to date
• infra-side changes to serve out of the public/ folder

[legoktm]

For some reason I can reproduce the metadata locally in a plain debian:bookworm container using the tools/publish script, but whatever is running in GHA is generating something different.

[legoktm]

https://gist.github.com/legoktm/ed61fa944bddd81cf5f8b9e4bbf9ed01 is what the current diff looks like. Going to take a break because I'm a bit at a loss of what to do, in theory we're setting proper mtimes on the files and are even running createrepo_c under faketime.

[eloquence]

@legoktm Gentle nudge on this - is that on the radar for the near-term? If so, do you need any help to get unblocked?

[legoktm]

I still would like to do this but it's not on my list right now since I'm not doing RPMy things. Hopefully in the sprint towards 4.2 I'll get to revisit this.

[legoktm]

Yessssss. It's reproducible now. I need to clean up the Git history and then send a PR in for the infra changes and then we can coordinate rollout.

[rocodes]

Test plan

• Visual review
• CI passes
• Add any RPM to the f37 folder, run ./tools/publish locally, see metadata files change. Stage these changes
• Run ./tools/publish --reproduce, you should see no changes to the files compared to the previous step

[legoktm]

Thanks for the approval, I'm going to move this back into draft mode just because it also needs coordinated changes in the infrastructure repo.