build(xcat-dep): vendor build source tarballs to avoid upstream URL dependency

Commit the upstream source tarballs the mock builders consume so a build never
has to fetch them from the network -- offline/reproducible builds, and
resilience to upstream URL rot for these older releases:
  - ipmitool/ipmitool-1.8.18.tar.gz  (re-normalized to the release tarball)
  - syslinux/syslinux-6.03.tar.xz
  - perl-Crypt-SSLeay/Crypt-SSLeay-0.72.tar.gz

The per-package builders use the local tarball when present and only fall back
to the upstream URL if it is missing (ipmitool/syslinux mockbuild.pl; and
mockbuild-perl-packages.pl 'spec' mode for perl-Crypt-SSLeay).

Also folded in:
  - mockbuild-all.pl: switch createrepo -> createrepo_c (--database,
    --set-timestamp-to-revision) for deterministic, upstream-matching repo
    metadata.
  - perl-HTTP-Async / perl-Net-HTTPS-NB specs: reword the brp-compress comment.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

mockbuild-all.pl

@@ -128,7 +128,7 @@ die "Could not resolve ID from /etc/os-release\n" if $os_id eq '';
 die "Could not resolve major release from VERSION_ID='$version_id' in /etc/os-release\n"
     if !defined($rel) || $rel eq '';
 
-for my $bin (qw(perl uname createrepo tar find rpm)) {
+for my $bin (qw(perl uname createrepo_c tar find rpm)) {
     require_command($bin);
 }
 require_command('mock') if $scrub_all_chroots;
@@ -482,12 +482,12 @@ if (!$dry_run && $copied_srpms == 0) {
 if (!$skip_createrepo) {
     run_step(
         step => 'Run createrepo',
-        cmd  => 'createrepo --update --revision ' . sh_quote($SOURCE_DATE_EPOCH) . ' ' . sh_quote($repo_dir),
+        cmd  => createrepo_c_cmd($repo_dir),
         log  => "$log_root/createrepo.log",
     );
     run_step(
         step => 'Run createrepo for SRPM repo',
-        cmd  => 'createrepo --update --revision ' . sh_quote($SOURCE_DATE_EPOCH) . ' ' . sh_quote($srpm_repo_dir),
+        cmd  => createrepo_c_cmd($srpm_repo_dir),
         log  => "$log_root/createrepo-srpm.log",
     );
 }
@@ -579,6 +579,16 @@ sub deploy_target {
     print "Deployed rh$rel/$arch: $n rpms\n";
 }
 
+# createrepo_c command with upstream-matching, deterministic metadata. The tool's
+# defaults emit primary/filelists/other as *.xml.zst plus *.sqlite.bz2 (--database),
+# exactly the upstream shape; --set-timestamp-to-revision pins repomd to SOURCE_DATE_EPOCH.
+sub createrepo_c_cmd {
+    my ($dir) = @_;
+    return 'createrepo_c --update --database '
+        . '--revision ' . sh_quote($SOURCE_DATE_EPOCH) . ' --set-timestamp-to-revision '
+        . sh_quote($dir);
+}
+
 sub sign_and_index_repo {
     my ($dir) = @_;
     my @rpms = grep { !/\.src\.rpm$/ } glob("$dir/*.rpm");
@@ -587,7 +597,7 @@ sub sign_and_index_repo {
         run_simple(qq(rpmsign --define "%_gpg_name $gpg_key_name" --addsign )
             . join(' ', map { sh_quote($_) } @rpms));
     }
-    run_simple('createrepo --update ' . sh_quote($dir));
+    run_simple(createrepo_c_cmd($dir));
     if ($gpg_sign) {
         local $ENV{GNUPGHOME} = $gpg_home if $gpg_home;
         my $repomd = "$dir/repodata/repomd.xml";

perl-HTTP-Async/perl-HTTP-Async.spec

@@ -45,8 +45,8 @@ using 'select' lists.
 # "%patch without corresponding Patch: tag".
 %patch -P 0 -p1
 
-# openSUSE's brp-compress gzips the man pages after the %install file list is
-# generated, so %files then looks for *.3pm but finds *.3pm.gz. Disable the
+# openSUSE's brp-compress gzips man pages after the install file list is built,
+# so the packaged file list then looks for *.3pm but finds *.3pm.gz. Disable the
 # install-post hooks there (harmless for a noarch perl module) to keep names in
 # sync; EL's brp-compress handling already matches, so scope this to SUSE.
 %if 0%{?suse_version}

perl-Net-HTTPS-NB/perl-Net-HTTPS-NB.spec

@@ -43,8 +43,8 @@ addition allows non-blocking connect.
 # "%patch without corresponding Patch: tag".
 %patch -P 0 -p1
 
-# openSUSE's brp-compress gzips the man pages after the %install file list is
-# generated, so %files then looks for *.3pm but finds *.3pm.gz. Disable the
+# openSUSE's brp-compress gzips man pages after the install file list is built,
+# so the packaged file list then looks for *.3pm but finds *.3pm.gz. Disable the
 # install-post hooks there (harmless for a noarch perl module) to keep names in
 # sync; EL's brp-compress handling already matches, so scope this to SUSE.
 %if 0%{?suse_version}