Is this not a viable solution, then? Mock only needs the groups from the (fairly stable) groups repo. We could set enablegroups=0 for all the other repos and make sure that the comps in the groups repo is safe.
safe in what regard? We still need to add a bunch of intelligence to mock, then. It needs to know how to fetch it and parse it and that's just one more file format to deal with.
I do agree with your point of having to build new packages if you change the packages in your buildgroups but one nice thing you get from this is sign-able buildgroup specification. b/c, right now, packages can be signed, but the groups file cannot.
-sv