Split the internal logic into two parts: 1) fetching the commit into the internal cache repo and then 2) exporting that commit, i.e. a local pull from the cache repo to the output directory. If no `output` directory was specified, only fetch the commit, do not attempt to export it. NB: this commit changes at what point the gpg verification is done. Previously the check was on export. Now, we are checking the signature on import only. The export step will be replaced by an ostree `Input` that will have the ability to verify commits a second time. |
||
|---|---|---|
| .. | ||
| org.osbuild.files | ||
| org.osbuild.ostree | ||