Re-add --best to repoclosure

[ogajduse]

Summary

Without --best, dnf repoclosure can silently resolve a Requires against an older, still-present package instead of the newest one — masking real reverse-dependency breaks at PR time instead of failing loudly.

Real-world case: theforeman/foreman-packaging#13647 bumped rubygem-foreman-tasks to 13.0.0 while rubygem-foreman_ansible still had Requires: (rubygem(foreman-tasks) >= 10.0 with rubygem(foreman-tasks) < 13). Per-PR COPR repoclosure passed anyway. The break wasn't caught until staging repoclosure ran the next day, fixed in theforeman/foreman-packaging#13661 (and its DEB-side twin, theforeman/foreman-packaging#13688).

--best was originally dropped in #246 (2020) because it broke EL8 module repoclosure (module_hotfixes wasn't respected). module_hotfixes=1 has since been added to the modular repos in foreman-packaging's repoclosure/yum.conf, which already neutralizes that problem — so the original reason for dropping --best no longer applies.

Verification

Reproduced the actual incident with synthetic RPMs mirroring the foreman-tasks/foreman_ansible versions involved, run through the real dnf4 client (CentOS Stream 9, matching this project's own Dockerfile — not dnf5, whose repoclosure --best is a no-op alias for --newest and would give a false read here):

• Without --best: dnf repoclosure exits 0 — silently passes, reproducing the real miss.
• With --best: exits 1 and correctly reports the unresolved rubygem(foreman-tasks) < 13 dependency.

Also re-ran today's real el8-foreman-client-nightly-staging and el9-foreman-plugins-nightly-staging targets (with their full lookaside sets) with --best — clean, no new false positives.

tests/test_functional.py updated to expect --best in the generated dnf repoclosure command. Full suite: 126 passed.

Related

• Slack discussion (@adamruzicka, @evgeni, and myself) on making repoclosure catch cross-package breakage at PR time instead of relying on the releaser to think of it.
• The complementary fix (staging repos as lookaside for per-PR checks) is already implemented in foreman-packaging's package_manifest.yaml — no obal-side gap there.

[evgeni]

--best was originally dropped in #246 (2020) because it broke EL8 module repoclosure (module_hotfixes wasn't respected). module_hotfixes=1 has since been added to the modular repos in foreman-packaging's repoclosure/yum.conf, which already neutralizes that problem — so the original reason for dropping --best no longer applies.

That explanation is bullshit. Repoclosure "just doesn't work" with modules properly, as it has no way to know which module needs to be enabled and which not. Setting module_hotfixes (which is a hack in itself) will not help here much.

I am all for enabling --best, I just hate it when the parrot lies to us and we use that as an explanation.

[ogajduse]

--best was originally dropped in #246 (2020) because it broke EL8 module repoclosure (module_hotfixes wasn't respected). module_hotfixes=1 has since been added to the modular repos in foreman-packaging's repoclosure/yum.conf, which already neutralizes that problem — so the original reason for dropping --best no longer applies.

That explanation is bullshit. Repoclosure "just doesn't work" with modules properly, as it has no way to know which module needs to be enabled and which not. Setting module_hotfixes (which is a hack in itself) will not help here much.

I am all for enabling --best, I just hate it when the parrot lies to us and we use that as an explanation.

I'll write the one about parrot down. That's a great parallel!

I verify most of the LLM output, but I rushed with this one without actually verifying what it says. So, next time. Maybe in #437? 😉