https://github.com/projectatomic/rpm-ostree/pull/1469

0001-core-Use-new-rpmtsSetVfyLevel-API-for-writing-rpmdb.patch

@@ -0,0 +1,54 @@
+From 681b194c4bd5d1f677ad8e165d5f31b9d7cbfcd7 Mon Sep 17 00:00:00 2001
+From: Colin Walters <walters@verbum.org>
+Date: Mon, 23 Jul 2018 16:37:43 +0000
+Subject: [PATCH] core: Use new `rpmtsSetVfyLevel()` API for writing rpmdb
+
+Newer librpm defaults to doing a full payload checksum, which we can't
+do at this point (writing the db) because we imported the RPMs into
+ostree commits, saving just the header in metadata - we don't have the
+exact original content to provide again.
+
+Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1607223
+---
+ configure.ac                 | 4 ++++
+ src/libpriv/rpmostree-core.c | 9 +++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index 20a941b4..00b3e38c 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -110,6 +110,10 @@ AS_IF([pkg-config --atleast-version=4.13.0.1 rpm], [
+   AC_DEFINE([BUILDOPT_HAVE_RPM_FILETRIGGERS], 1, [Set to 1 if we have file triggers])
+   AC_DEFINE([BUILDOPT_HAVE_RPMFILES], 1, [Set to 1 if we have rpmfiles API])
+ ], [have_modern_rpm=false])
++dnl See usage
++AS_IF([pkg-config --atleast-version=4.14.2-rc1 rpm], [
++  AC_DEFINE([BUILDOPT_HAVE_NEW_RPM_VERIFY], 1, [Set to 1 if we have rpmtsSetVfyLevel ])
++])
+ 
+ AC_PATH_PROG([XSLTPROC], [xsltproc])
+ 
+diff --git a/src/libpriv/rpmostree-core.c b/src/libpriv/rpmostree-core.c
+index 68ac8871..6271d370 100644
+--- a/src/libpriv/rpmostree-core.c
++++ b/src/libpriv/rpmostree-core.c
+@@ -4010,6 +4010,15 @@ rpmostree_context_assemble (RpmOstreeContext      *self,
+ 
+   g_auto(rpmts) rpmdb_ts = rpmtsCreate ();
+   rpmtsSetVSFlags (rpmdb_ts, _RPMVSF_NOSIGNATURES | _RPMVSF_NODIGESTS);
++  /* https://bugzilla.redhat.com/show_bug.cgi?id=1607223 i
++   * Newer librpm defaults to doing a full payload checksum, which we can't
++   * do at this point because we imported the RPMs into ostree commits, saving
++   * just the header in metadata - we don't have the exact original content to
++   * provide again.
++   */
++#ifdef BUILDOPT_HAVE_NEW_RPM_VERIFY
++  rpmtsSetVfyLevel (rpmdb_ts, 0);
++#endif
+   rpmtsSetFlags (rpmdb_ts, RPMTRANS_FLAG_JUSTDB);
+ 
+   tdata.ctx = self;
+-- 
+2.17.1
+

rpm-ostree.spec

@@ -9,12 +9,13 @@
 Summary: Hybrid image/package system
 Name: rpm-ostree
 Version: 2018.6
-Release: 3%{?dist}
+Release: 4%{?dist}
 #VCS: https://github.com/cgwalters/rpm-ostree
 # This tarball is generated via "cd packaging && make -f Makefile.dist-packaging dist-snapshot"
 # in the upstream git.  If rust is enabled, it contains vendored sources.
 Source0: rpm-ostree-%{version}.tar.xz
 Patch1: 0001-build-sys-Use-python3-for-libdnf-by-default-if-avail.patch
+Patch2: 0001-core-Use-new-rpmtsSetVfyLevel-API-for-writing-rpmdb.patch
 License: LGPLv2+
 URL: https://github.com/projectatomic/rpm-ostree
 
@@ -179,6 +180,10 @@ $PYTHON autofiles.py > files.devel \
 %files devel -f files.devel
 
 %changelog
+* Mon Jul 30 2018 Colin Walters <walters@verbum.org> - 2018.6-4
+- Backport patch for https://bugzilla.redhat.com/show_bug.cgi?id=1607223
+  from https://github.com/projectatomic/rpm-ostree/pull/1469
+
 * Mon Jul 16 2018 Colin Walters <walters@verbum.org> - 2018.6-3
 - Make build python3-only compatible for distributions that want that