rpm: reclaim orphaned files by SHA-256 digest matching

[jlebon]

In rpm-ostree-composed bootable containers (e.g. Fedora CoreOS), some
files are moved from their RPM-declared paths to different locations
(e.g. SELinux policy from /var/lib/selinux to /etc/selinux). Since
the RPM database still records the original paths, these files end up
unclaimed (~1,700 files / ~18 MB on FCOS).

For the SELinux policy specifically, I think it would make sense to
add a /var/lib/selinux symlink; this is both helpful to humans and
to chunkah which already knows to canonicalize RPM paths. But there are
some other paths which wouldn't be caught by this either, e.g. the EFI
bootupd blob migrations to /usr/lib/efi/.

Anyway, one way we can detect these moves for now is to hash them. After
loading the rpmdb, we build an index mapping SHA-256 digests of orphaned
entries (paths in rpmdb but not on rootfs at their expected paths) to
their ComponentIds. And then during the weak claiming phase, we hash
the files and match against the index to reclaim them into their correct
SRPM component.

Assisted-by: Claude Opus 4.6

[gemini-code-assist]

Code Review

This pull request introduces a robust mechanism to reclaim orphaned files in RPM-based container images by matching their SHA-256 digests. This is a significant improvement, particularly for environments like Fedora CoreOS where files are moved post-installation. The architectural shift to a two-pass system with 'strong' and 'weak' claims is well-conceived and enhances extensibility. The implementation is solid, featuring smart optimizations like size-based filtering to avoid unnecessary hashing and careful handling of ambiguous digests. The addition of a component manifest output and comprehensive end-to-end tests further strengthens the quality of this change.

[jlebon]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a robust mechanism to reclaim orphaned files in RPM-based systems by matching their SHA-256 digests. This is a significant improvement for handling composed file systems where files are moved from their original RPM-declared paths. The core of the change is a new two-pass claiming system that distinguishes between "strong" path-based claims and "weak" heuristic-based claims, like digest matching. The implementation is well-structured, includes performance optimizations such as pre-filtering files by size before hashing, and is accompanied by thorough unit and end-to-end tests that validate the new functionality. My review includes a couple of suggestions to further enhance maintainability and performance.

_{Note: Security Review did not run due to the size of the PR.}