Possible option is to import all rpm records in the end of newRepo/mergerepo.

If you have a large external repo (e.g. a reasonably common case), then there's probably a good bit of content that doesn't ever wind up in a buildroot. At present, we only error if it does, but if we check at newRepo time, we'll presumably check all of them and may fail in cases where we were forgiving before. That's not necessarily incorrect, but it could be more annoying to the folks that tend to run into such problems.

Also, importing all external rpms from these repos could be a lot more entries. These would also be mostly unlinked entries.

The "hash changed for external rpm" error is Koji trying to enforce some relative sanity on the external repos it uses. The external repos feature was born of necessity, but it is very un-koji-like. Koji itself doesn't allow duplicate NVRs for NVRAs for good reason, but Koji doesn't control the external repo content.

I can see loosening this (e.g. adding a configuration option to turn it off), but that would require refactoring the data model a little bit because of the uniqueness condition.

Frankly, this topic hints at a larger refactor of external repos. I've felt many times that including the external rpms in the normal rpms table was a bit of a misstep.

It might make sense to track external repos in a deeper way. Imagine having a historical table of external repo content. Ok, I'm probably getting ahead of myself here ;)