This should fix the issue we're seeing in the F40 image composes with unsigned packages.

CC: @kevin @adamwill

I tested this in our stg env and it seemed to do the right thing.

Does it make sense to make it configurable? I can imagine a case when buildroot repo is used and some additional content is being installed on top of it. But maybe there is no real case like this.

I suppose there could be a use case... I can't think of why off hand. ;)

I suppose if you wanted the buildroot repo and another one you could just pass both those in? Although thats less handy...

I guess in theory this might be the case in other Koji deployments, particularly ones where people use Koji to build appliances.

So, something like #4063?

That should work for our needs I think... sure.

Closing for #4063.