CI: build Qubes OS RPMs

[SergiiDmytruk]

Initially made Qubes OS package which builds fine, then tried to feed it to new version of Qubes OS builder and turned out that two versions aren't fully compatible. In particular v1 is happy with commits and v2 needs archive name to follow a particular scheme and doesn't accept SHA1 for a version. Committed qubesos/ directory works with v1 builder and v2 would need some tag.

Example CI job: https://github.com/TrenchBoot/secure-kernel-loader/actions/runs/7020704817

Top commit will need s/@support-in-repo-pkgs/@master/ after TrenchBoot/.github#6 is merged.

[krystian-hebel]

There is some garbage at the end of produced file:

$ diff --side-by-side -W140 <(xxd expected.bin) <(xxd skl.bin) | tail
0000dff0: 0000 0000 0000 0000 0000 0000 0000 0000  ................	0000dff0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000e000: 78f1 268e 0492 11e9 832a c85b 76c4 cc02  x.&......*.[v...	0000e000: 78f1 268e 0492 11e9 832a c85b 76c4 cc02  x.&......*.[v...
0000e010: 0000 0000 1400 0000 0000 0000 0000 0000  ................	0000e010: 0000 0000 1400 0000 0000 0000 0000 0000  ................
0000e020: 0000 0000 0000 0000 0000 0000 0000 0000  ................	0000e020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000e030: 0000 0000 0000 0000 0000 0000 0000 0000  ................	0000e030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000e040: 0000 0000 0000 0000 0000 0000 0000 0000  ................	0000e040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000e050: 0000 0000 0000 0000 0000                 ..........	     |	0000e050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
								     >	0000e060: 0400 0000 2000 0000 0500 0000 474e 5500  .... .......GNU.
								     >	0000e070: 0100 01c0 0400 0000 0100 0000 0000 0000  ................
								     >	0000e080: 0200 01c0 0400 0000 0500 0000 0000 0000  ................

According to https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/f31/f/buildflags.md#annotated-buildswatermarking %undefine _annotated_build in RPM spec file should get rid of this.

This isn't that bad, when we tried to build packages with Nix those annotations somehow made it to the beginning of file, moving headers expected at offset 0 somewhere else. Still, better to not have it at all, it can impact size checks.

Also, TrenchBoot/.github#6 is merged, reminder to do s/@support-in-repo-pkgs/@master/

[SergiiDmytruk]

According to https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/f31/f/buildflags.md#annotated-buildswatermarking %undefine _annotated_build in RPM spec file should get rid of this.

I get this .note.gnu.property locally as well, so instead decided to update Makefile to not include it into skl.bin. Alternatively, it could be discarded in link.lds so that skl won't have the section either.

Also, TrenchBoot/.github#6 is merged, reminder to do s/@support-in-repo-pkgs/@master/

Done.

Changes: https://github.com/TrenchBoot/secure-kernel-loader/compare/cce60b62a84eb1d8c3d0730e07171d13dad97fd9..597a840b95cf411d06c2f48cb97c8b679a3ce643

[macpijan]

Since this is only CI and package metadata, not a single code change, I think this is fine if I approve this as well, so we do not need to bother the others.