If I understand well, adding -build option here https://pagure.io/fedora-infra/ansible/blob/main/f/roles/koji_hub/templates/hub.conf.j2#_188
would allow the unblocking on -epel-build tags to happen.
It is correct?

Whats the case here? When a epel package is moved into rhel, so we want to retire the epel package, but still allow the rhel package in the buildroot?

If so, yeah, we would need to adjust the policy to allow unblock in the -build tags (Is there any case where we would need block? I would think not, because blocking should be done in the parent tag).

Whats the case here? When a epel package is moved into rhel, so we want to retire the epel package, but still allow the rhel package in the buildroot?

I'm not sure this is a case we ever want to allow. At least, I'm not aware of a set of conditions that would make such a setup to be necessary, or any examples of it being needed previously.

The old script has this explanation:

#If a package moves from EPEL to RHEL it can only be built if it is unblocked
#in the epel build tag. Therefore unblock all retired EPEL packages in the
#built tag since it does not hurt if the package does not move to RHEL.

https://pagure.io/releng/blob/main/f/scripts/block_retired.py#_220

Do we want to keep it or should I remove it?

Yes. So, perhaps I am explaining poorly, let me try with an example:

foobar is a epel9 package. It has a foobar-devel and some other packages BuildRequire it and all is great.

foobar is added to rhel9 in a point release.

foobar is retired in epel. We block it in epel9.

Now all the packages that BuildRequire it cannot build. The package is blocked, koji sees the package is in the external rhel repo, but it's blocked in the base tag, so it doesn't include it in the buildroot.

So, in order to keep those epel9 packages that BuildRequire: foobar-devel still working (as you might expect they would), we have to unblock the package in the epel9-build tag. This way koji allows the rhel9 one into the buildroot, but it's not unblocked in epel9, so it doesn't get accidentally built or have old builds show up in epel9 repos.

So, yeah, I think we still need this case handled. We could drop it from the toddler processing and make it a manual process? The toddler doesn't have a way to know if this is this corner case or just a normal retirement. I guess in the past we just always unblocked it in case this was this case, but thinking about it thats less than ideal because if there's any tagged builds of the old retired package, they would then show up in the buildroot post retirement.

I agree, I'll drop it from the toddler.

Now, how do we handle the manual unblocking so it does not end up forgotten and cause problems in the future?
We probably need to add the mention to some SOP or documentation?

Here pull request for dropping unblocking epel-build tags from the toddler => https://pagure.io/fedora-infra/toddlers/pull-request/294

Closing issue, toddler koji_block_retired toddler dropped the unblocking feature for epel-build tags.