To improve app security, the rpm -qa call should be replaced with an equivalent rpmlib call in module_build_service/builder/KojiContentGenerator.py.
This issue has been migrated to Fedora Forge: https://forge.fedoraproject.org/koji/mbs/issues/1751
Please continue any further discussion there.