fix: preserve literal RPM repository URL arguments

[soulteary]

- What I did

A custom DOWNLOAD_URL or REPO_FILE containing spaces or shell metacharacters can split the RPM repository URL into multiple arguments or be interpreted by the inner sh -c. The existing dnf5 single quotes also break when the URL contains an apostrophe.

This change quotes the assembled URL as one literal POSIX shell argument for the current dnf5, dnf and yum-config-manager repository-add commands. Apostrophes, double quotes, dollar expressions, backticks and newlines remain part of that argument.

- How I did it

• Add a small POSIX shell quoting helper and apply it to all three RPM repository-add commands.
• Preserve repository filename defaults, staging defaults, mirror precedence, channel handling and package-manager selection.
• Add an independent offline CI job and document the regression suite.

The candidate is based on upstream master at 2b324800.

- How to verify it

The suite executes the installer's generated commands through the selected shell, including the actual inner sh -c, into inert package-manager mocks. It then compares exact argument arrays. The harness controls host detection; repository command generation comes from the installer.

All 48 cases pass under each of sh, dash and bash (144 successful cases). Coverage includes dnf5/dnf/yum, stable/test channels, default and staging URLs, custom URL/repository filename combinations, mirror precedence, whitespace, single/double quotes, literal $HOME, $(), backticks and newlines. Marker files confirm that embedded command substitutions are not executed.

The regression also fails before the fix: an apostrophe in the dnf5 custom URL produces an inner-shell syntax error. The same case passes after quoting is applied.

python3 scripts/test-repository-url-quoting.py
TEST_SHELL=dash python3 scripts/test-repository-url-quoting.py
TEST_SHELL=bash python3 scripts/test-repository-url-quoting.py
sh -n install.sh
bash -n install.sh
make shellcheck STABLE_LATEST=29.4.2 TEST_LATEST=29.4.2 'SHELLCHECK=shellcheck -e SC1091,SC1117,SC2317,SC2329'
git diff --check 2b324800...HEAD

ShellCheck 0.11.0 passed with the repository's existing exclusions. The fixed version values in the command above are offline build fixtures.

The candidate branch's GitHub Actions run passed in soulteary/docker-install. This is validation of candidate commit e22e1a6 in the fork.

The offline regression checks make no network requests, install no packages and change no host repository files. They establish exact argument transport and literal shell handling. The custom URL fixtures use mocks and do not validate live RPM repositories or behavior of real package-manager versions with those inputs.

Source and contribution

Inspired by docker/docker-install#449, by thaJeztah. This implementation applies the URL-quoting fix to the current repository-add commands.

The candidate was cherry-picked from 451b2228. Its commit retains the DCO sign-off:

Signed-off-by: Su Yang <soulteary@users.noreply.github.com>

- Description for the changelog

Preserve literal RPM repository URL arguments when executing repository setup commands.