Drop support for installing rpm v3 packages

[pmatilai]

RPM v3 packages were on life-support in 2007 already, time to start getting rid of it for real.

1. Issue deprecation warnings from all current and the next release
2. Swing the axe:

• require packages and signature headers to have an immutable section
• require v4 feature set:
  • payload files have prefixes
  • compressed filenames
  • self-provides
• stop added rpmlib() requires for these ancient features?
• some other details I must be forgetting

[dralley]

Is there a more reference describing what practical attributes constitute "v3", "v4" and so forth?

And when looking at old-but-still-supported OS' like RHEL7, how common are these packages in that ecosystem (including 3rd party packages made by noncanonical tooling)?

[pmatilai]

There are multiple differences between v3 and v4 packages on the "metadata" level, but perhaps the single most important thing is v4 having immutable header regions. Related to that, v4 has header-only digests and signatures whereas v3 digests and signatures are always on header+payload.

The last rpm version that could produce v3 packages was released in 2000. The last significant v3 packaging out there was Sun Java runtime/SDK which only got updated to v4 something like ... ten years ago maybe, and that was five years after everybody else had. In practise, you need to go to a museum to find a v3 package these days.