In adition to the NEVRA, include the location and hash over the rpm file. This allows us to separately fetch and verify that refernces to RPMs are correct, as the NEVRA alone is not sufficient for fetching nor verifying. This is a prerequisite for using the rpm rather than the dnf stage in our osbuild pipelines. Signed-off-by: Tom Gundersen <teg@jklm.no> |
||
|---|---|---|
| .. | ||
| repository.go | ||