For non-zero exit codes of the %%post scriplets to be treated as fatal
errors (in install checks in Girar), %%_rpmscript_werror flag was recently
added to rpm, and an attempt was made to turn this behavior on in
Girar in commit 6c5d2738e0ad04d00c31c980a6e8f71ff5bb24ab:

Author: Dmitry V. Levin <ldv@altlinux.org>
Date:   Thu Dec 19 00:44:59 2019 +0000

    gb-remote-plant: add %_rpmscript_werror to .rpmmacros

    Enable traditional rpm behaviour of treating all scriptlet failures
    as fatal.

However, adding it to ~/.rpmmacros didn't have the desired effect,
because, in hasher, firstly, rpmmacros from the host system are
primarily used to fill in builder's rpmmacros (and affect only
building packages), and secondly, even there they are not copied
verbatim, but rather some needed values are evaluated and
inserted. (See "# Create RPM build directory tree." in hsh-initroot.)
Also, aptbox sees ~/.rpmmacros from the host system (or re-creates its
own $aptbox_home/.rpmmacros), but they don't seem to affect the
behavior of rpm w.r.t. the exit status of the scriptlets of the
packages being installed.

This is demonstrated by the trivial test packages from
http://git.altlinux.org/people/imz/packages/rpmscript_warn_only-checkinstall.git

The test for %pre "passes": https://lists.altlinux.org/pipermail/sisyphus-incominger/2021-July/624894.html
The test for %post doesn't: https://lists.altlinux.org/pipermail/sisyphus-incominger/2021-July/624896.html

Reported-by: Alexey Appolonov <alexey@altlinux.org>

As a workaround we can simply hardcode the %_rpmscript_werror in hasher (branch rpmscript_werror in my Git repo):

commit 8c3acab99cdd866f9fc978bc6cf685d198d4d6cd
Author: Ivan Zakharyaschev <imz@altlinux.org>
Date:   Mon Jul 26 17:00:27 2021 +0300

    create_chroot(): pin %%_rpmscript_werror (as expected in Girar install checks)
    
    (I don't like hardcoding this; a more flexible solution allowing to
    choose the behavior for each invocation of hsh --ini or hsh-install
    would be better: it could be an option to pass the corresponding
    option along with rpmi.)
    
    (For this change to take effect, one should rm -rf ~/hasher/cache/chroot/ )
    
    For non-zero exit codes of the %%post scriplets to be treated as fatal
    errors (in install checks in Girar), %%_rpmscript_werror flag was recently
    added to rpm, and an attempt was made to turn this behavior on in
    Girar in commit 6c5d2738e0ad04d00c31c980a6e8f71ff5bb24ab:

    ...