mirror of
https://github.com/flatpak/flatpak.git
synced 2026-06-27 01:36:44 -04:00
116a8b8487
We're using the metadata from the summary, ostree-metadata or available commit when making security sensitive decisions, so lets verify this matches what we get in the actual commit we pulled. We already did check that this then actually also matches what gets deployed, so the new check shares code with that. Note, we don't do this for OCI installs, because it seems the current fedora flatpaks don't have this set, and we don't want to break existing remotes.