Ensure RPM versions match across arches during lockfile bumps

[jlebon]

14:08:37 < jlebon> dustymabe: was casually looking at this
                   https://github.com/coreos/fedora-coreos-config/commit/6740a0d07e4ac7ee4f2455a05d5b059b635391ef
14:08:55 < jlebon> i wish there was a stronger binding to ensure they hit the same
                   rpm-md snapshot
14:09:16 < jlebon> you could imagine a race where the repo is updated halfway between
                   the x86 and aarch64 runs of `cosa fetch`
14:10:02 < jlebon> not sure there's an easy way to fix this. we could probably detect
                   it at least and error out by comparing shared SRPMs
14:10:56 < jlebon> let me write this down in a pipeline issue

Rough pseudocode how this could work:

srpms = {}
for arch in arches:
  for locked_pkg in lockfile[arch]:
    srpm = get_srpm_for_pkg(locked_pkg)
    (name, evr) = split_srpm(srpm)
    if name not in srpms:
      srpms[name] = evr
    elif srpms[name] != evr:
      raise Exception("mismatch found")

[jlebon]

Anyone who wants to tackle this in Python, see https://github.com/coreos/fedora-coreos-config/blob/testing-devel/ci/remove-graduated-overrides.py for examples of reading lockfiles and using the dnf Python API.