build RPM for dom0 in nightly job

[redshiftzero]

(reopened from #123 but from the shared remote)

Closes freedomofpress/securedrop-workstation#357

Testing

1. Check out test build here based on commit ci: commit rpm to test branch for review.
2. Test rpm is here which you should verify has a bumped version, and has been signed with key with long ID 0x4A3BE4A92211B03C

Note: if you notice issues with the files in the rpm, and notice something is missing, please file those over in securedrop-workstation. The next step here will be actually using this rpm in freedomofpress/securedrop-workstation#406

Versioning

I had to deviate from our versioning strategy used for the debian package nightlies as - is an invalid character, so I went with LATEST_TAG.dev.YYMMDD.HHMMSS which is as close as possible for consistency. I verified via this script which you can run in a Fedora AppVM that this versioning is what we want:

import rpm


def compare_version(v1, v2):
    """
    Citation: https://github.com/rpm-software-management/yum/blob/1222f377b8dcecb77456ea378a28e1dc23ba4207/rpmUtils/miscutils.py#L36
    Returns:
    * 1 if v1 > v2
    * 0 if v1 == v2
    * -1 if v1 < v2
    """
    return rpm.labelCompare(('0', v1, ''), ('0', v2, ''))


if __name__=='__main__':
    assert compare_version('0.1.1.dev.200116.111111', '0.1.2') == -1
    assert compare_version('0.1.1', '0.1.1') == 0
    assert compare_version('0.1.2.dev.201001.212311', '0.1.2') == 1
    print('all assertions passed')

[emkll]

Reviewed this PR by first going through the test plan as described in the PR description, it all looks great to me.

1. Check out test build here : test build/output LGTM
2. Test rpm is here: Artifact looks good to me, and is correctly signed with the securedrop test key

Some minor comments inline, mostly for discussion. Other than adding a couple of comments for maintainability, this is good to merge from my perspective.

[redshiftzero]

thanks for the detailed comments! I've rebased on latest, this should be ready for re-review

[emkll]

Thanks @redshiftzero, changes look good to me, confirmed the latest changes are working in https://circleci.com/gh/freedomofpress/securedrop-debian-packaging/2420