From all that happened so far, it seems the consensus was that 'rpm' is at fault here (together with obs) - handing over to the RPM maintainer for coordination