Christian Kellner b8b6619d39 sources/ostree: verify signature on local pull ... Instead of verifying the gpg signature when pull from the actual remote source into the local cache, verify the commit when it is being pulled from the local cache into the output directory. This ensures that the signatures are checked against the provided keys even when the commit was already in the cache and at that time the key might have been different. NB: ostree expects the signature to be present on the remote at the *target* repository, i.e. in our case the output repository. The keys are therefore attached to a temporary remote that is created at the output repository with the same name/id that is used for the actual remote.		2020-04-15 15:39:45 +02:00
..
org.osbuild.dnf	stages,sources/dnf: allow passing certificate data	2020-01-09 23:55:43 +01:00
org.osbuild.files	sources/files: time-out curl	2020-03-15 17:07:01 +01:00
org.osbuild.ostree	sources/ostree: verify signature on local pull	2020-04-15 15:39:45 +02:00