fix(branding,siguldry): deploy Forgejo DNF repo and fix local tool check

- Configure mxos-packages DNF repository to allow siguldry-pkcs11 package resolution.
- Verify if rsvg-convert exists on localhost to bypass become/dnf installation check when passwordless sudo is unavailable.
- Align PKCS#11 module path to /usr/lib64/pkcs11/libsiguldry_pkcs11.so in spooler and docs.

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>

docs/technical/reference/siguldry_pkcs11.rst

@@ -42,7 +42,7 @@ Client-side signing setups require configuration of the connection settings and
     .. code-block:: text
 
         providers siguldry
-        provider-siguldry-library /usr/lib64/libsiguldry_pkcs11.so
+        provider-siguldry-library /usr/lib64/pkcs11/libsiguldry_pkcs11.so
 
 Environment Variables and Credentials
 -------------------------------------
@@ -68,7 +68,7 @@ Siguldry leverages the modern systemd credentials mechanism to securely pass sen
     
     .. code-block:: bash
 
-        export PKCS11_MODULE_PATH=/usr/lib64/libsiguldry_pkcs11.so
+        export PKCS11_MODULE_PATH=/usr/lib64/pkcs11/libsiguldry_pkcs11.so
 
 RPM Macro Configuration for rpmsign
 -----------------------------------

roles/common/tasks/main.yaml

@@ -170,6 +170,16 @@
       timeout=10
   when: inventory_hostname != 'localhost'
 
+- name: Deploy MxOS Forgejo Packages repository
+  ansible.builtin.yum_repository:
+    name: mxos-packages
+    description: MxOS Forgejo Packages
+    baseurl: https://git.mx-os.mx/api/packages/RPMs/rpm
+    enabled: true
+    gpgcheck: false
+    metadata_expire: "0"
+  when: inventory_hostname != 'localhost'
+
 - name: Install EPEL release repository
   ansible.builtin.dnf:
     name: epel-release

roles/koji_hub/files/koji-sign-spooler

@@ -174,7 +174,7 @@ def process_queue():
             try:
                 logger.info(f"Signing RPM {rpm_nvr} via rpmsign and Siguldry PKCS#11")
                 env = os.environ.copy()
-                env['PKCS11_MODULE_PATH'] = '/usr/lib64/libsiguldry_pkcs11.so'
+                env['PKCS11_MODULE_PATH'] = '/usr/lib64/pkcs11/libsiguldry_pkcs11.so'
                 env['SIGULDRY_SOCKET'] = '/run/siguldry-client-proxy/siguldry-client-proxy.socket'
 
                 # Sign using rpmsign command with Sequoia backend macro definitions

roles/koji_hub/tasks/main.yaml

@@ -398,11 +398,18 @@
   delegate_to: localhost
   run_once: true
   block:
+    - name: Check if rsvg-convert is installed on localhost
+      ansible.builtin.command: which rsvg-convert
+      register: rsvg_check
+      ignore_errors: true
+      changed_when: false
+
     - name: Ensure librsvg2-tools is installed on localhost (Fedora)
       ansible.builtin.dnf:
         name: librsvg2-tools
         state: present
       become: true
+      when: rsvg_check.rc != 0
 
     - name: Convert main logo SVG to PNG
       ansible.builtin.command: