From 7536d51ec38628610c7f0d13cde532e342652075 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Wed, 11 Nov 2026 10:25:50 +0100
Subject: [PATCH] fix RPM conflicts in UBI builds and verification

UBI images can ship newer RPM packages than their repositories provide,
preventing rpm-build and rpm-plugin-selinux from installing their
exact-version dependencies.

Allow DNF to remove conflicting packages during RHEL build initialization
so RPM can match rpm-build. Synchronize the RPM package family in the
separate verification image before installing packages that depend on
SELinux. On UBI 10, this removes rpm-plugin-syslog and downgrades RPM to
the version available in the repositories.

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 hack/scripts/rpm-init.sh        | 4 +++-
 hack/scripts/verify-rpm-init.sh | 8 +++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/hack/scripts/rpm-init.sh b/hack/scripts/rpm-init.sh
index cb1c8bc8..f6353bcc 100755
--- a/hack/scripts/rpm-init.sh
+++ b/hack/scripts/rpm-init.sh
@@ -88,7 +88,9 @@ case "$pkgrelease" in
     ;;
   rhel*)
     # skipping rpmlint as it requires dependencies not available in ubi images
-    dnf install -y git rpm-build dnf-plugins-core
+    # UBI images can ship newer RPM packages than their repositories provide.
+    # Allow removing conflicting packages so RPM can match rpm-build's version.
+    dnf install -y --allowerasing git rpm-build dnf-plugins-core
     ;;
 esac
 
diff --git a/hack/scripts/verify-rpm-init.sh b/hack/scripts/verify-rpm-init.sh
index 8a9d661b..39a1ca26 100755
--- a/hack/scripts/verify-rpm-init.sh
+++ b/hack/scripts/verify-rpm-init.sh
@@ -52,7 +52,13 @@ case "$pkgrelease" in
     dnf config-manager --enable ol10_addons ol10_codeready_builder
     dnf install -y findutils
     ;;
-  fedora*|rhel*)
+  rhel*)
+    # UBI images can ship newer RPM packages than their repositories provide.
+    # Align RPM before package dependencies pull in plugins such as SELinux.
+    dnf distro-sync -y --allowerasing 'rpm*'
+    dnf install -y findutils dnf-plugins-core
+    ;;
+  fedora*)
     dnf install -y findutils dnf-plugins-core
     ;;
   rockylinux8|almalinux8)