manifests: workaround F37 GPG key issue for rawhide

We'll workaround the issue by removing the F37 key from the list of
gpgkeys to load. We'll also add a test that fails if the f37 entry
isn't put back in place and we'll snooze that test. This gives us
a reminder to followup on this issue if we don't get it resolved
in upstream libdnf/rpm in the immediate future.

coreos/fedora-coreos-tracker#925

kola-denylist.yaml

@@ -10,3 +10,6 @@
   snooze: 2021-09-01
   platforms:
     - openstack
+- pattern: ext.config.yum-repos
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/925
+  snooze: 2021-09-01

manifests/fedora-coreos-base.yaml

@@ -117,6 +117,17 @@ postprocess:
       echo 'DEFAULT_HOSTNAME=localhost' >> /usr/lib/os-release
     fi
 
+
+  # Workaround issue in rawhide parsing the F37 GPG key
+  # by removing it from the list of gpgkeys to load.
+  # https://github.com/coreos/fedora-coreos-tracker/issues/925
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    source /etc/os-release
+    [ ${VERSION_ID} -eq 36 ] || exit 0
+    sed -i 's|gpgkey=.*$|gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-rawhide-$basearch|' /etc/yum.repos.d/fedora-rawhide.repo
+
 # Packages listed here should be specific to Fedore CoreOS (as in not yet
 # available in RHCOS or not desired in RHCOS). All other packages should go
 # into one of the sub-manifests listed at the top.

tests/kola/yum-repos/test.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -xeuo pipefail
+
+# No need to run an other platforms than QEMU.
+# kola: { "platforms": "qemu-unpriv" }
+
+# We can delete this test when the following issue is resolved:
+# https://github.com/coreos/fedora-coreos-tracker/issues/925
+
+ok() {
+    echo "ok" "$@"
+}
+
+fatal() {
+    echo "$@" >&2
+    exit 1
+}
+
+source /etc/os-release
+if [ "$VERSION_ID" -eq "36" ]; then
+    if ! grep 'RPM-GPG-KEY-fedora-37' /etc/yum.repos.d/fedora-rawhide.repo; then
+        fatal "Fedora 37 gpg key should be in rawhide repo"
+    fi
+fi
+ok rawhiderepo