tests/journal-compat: work around ubi8 image being untrusted

There's a messy situation right now with the default `policy.json`
shipped by `containers-common` and the RHEL keys missing from the c9s
compose.

This is tracked at openshift#1505. But this
test is totally unrelated to all this. So let's work around it for now
to unblock CI by just downloading the missing keys.

tests/kola/systemd/journal-compat

@@ -12,8 +12,21 @@ set -euo pipefail
 
 cd $(mktemp -d)
 
+if is_scos; then
+    # work around https://github.com/openshift/os/issues/1505
+    curl -Lo /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release \
+        https://access.redhat.com/security/data/fd431d51.txt
+    curl -Lo /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta \
+        https://access.redhat.com/security/data/f21541eb.txt
+fi
+
 # The string Linux should match the kernel boot
-podman run --privileged --net=none -v /var/log:/var/log:ro --rm registry.access.redhat.com/ubi8/ubi:latest journalctl -D /var/log/journal --grep="Linux" > journal.txt 2>err.txt
+rc=0
+podman run --privileged --net=none -v /var/log:/var/log:ro --rm registry.access.redhat.com/ubi8/ubi:latest journalctl -D /var/log/journal --grep="Linux" > journal.txt 2>err.txt || rc=$?
+if [ "$rc" != 0 ]; then
+    cat err.txt
+    fatal "podman run exited with rc=$rc"
+fi
 if grep -qF 'uses an unsupported feature' err.txt; then
     fatal "Got unsupported feature trying to read journal"
 fi