Pin repo-setup to commit SHA on stable with checksum verification

Pin the repo-setup build-time dependency to a specific commit on the
stable branch and verify the SHA-256 checksum of the downloaded archive
before extraction. Previously repo-setup was fetched from the floating
main branch with no integrity check.

This applies to both the diskimage-builder element
(dib/repo-setup/pre-install.d/00-03-repo-setup) and the bootc build
path (bootc/install-repo-setup.sh).

Jira: OSPRH-32780

Author: steveb

bootc/install-repo-setup.sh

@@ -2,9 +2,17 @@
 
 set -eux
 
+# Pin repo-setup to a specific commit on the stable branch
+# To update: change REPO_SETUP_COMMIT, download the new archive, and update REPO_SETUP_SHA256
+REPO_SETUP_COMMIT=85321f7e0af502d7f06f845886058daf09da34f6
+REPO_SETUP_SHA256=1050e4ed0472098165c4bde84a9991a6a13171426d16862f6651e28635d1727f
+
 pushd output
-curl -sL https://github.com/openstack-k8s-operators/repo-setup/archive/refs/heads/main.tar.gz | tar xvz
-pushd repo-setup-main
+curl -sL -o repo-setup.tar.gz \
+    "https://github.com/openstack-k8s-operators/repo-setup/archive/${REPO_SETUP_COMMIT}.tar.gz"
+echo "${REPO_SETUP_SHA256}  repo-setup.tar.gz" | sha256sum -c -
+tar xzf repo-setup.tar.gz
+pushd "repo-setup-${REPO_SETUP_COMMIT}"
 python3 -m venv ./venv
 source ./venv/bin/activate
 PBR_VERSION=0.0.0 python3 -m pip install ./

dib/repo-setup/pre-install.d/00-03-repo-setup

@@ -9,10 +9,16 @@ if [ -n "${DIB_YUM_REPO_CONF:-}" ] ; then
     exit 0
 fi
 
-# Install latest version of repo-setup without installing pip or git
+# Install repo-setup pinned to a specific commit on the stable branch
+# To update: change REPO_SETUP_COMMIT, download the new archive, and update REPO_SETUP_SHA256
+REPO_SETUP_COMMIT=85321f7e0af502d7f06f845886058daf09da34f6
+REPO_SETUP_SHA256=1050e4ed0472098165c4bde84a9991a6a13171426d16862f6651e28635d1727f
 cd /tmp
-curl -sL https://github.com/openstack-k8s-operators/repo-setup/archive/refs/heads/main.tar.gz | tar xvz
-cd repo-setup-main
+curl -sL -o repo-setup.tar.gz \
+    "https://github.com/openstack-k8s-operators/repo-setup/archive/${REPO_SETUP_COMMIT}.tar.gz"
+echo "${REPO_SETUP_SHA256}  repo-setup.tar.gz" | sha256sum -c -
+tar xzf repo-setup.tar.gz
+cd "repo-setup-${REPO_SETUP_COMMIT}"
 python3 -m venv ./venv
 source ./venv/bin/activate
 PBR_VERSION=0.0.0 python3 -m pip install ./