ngompa added a new comment to an issue you are following:
``
But because we don't sign our repodata, I can't validate the input before using
it, which is a prerequisite with OBS. It's either validated through checksums with an
SSL-enabled master mirror, or through GPG checking of the `repomd.xml`.
``
To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7840