Fedora still doesn't sign its repo data?

[Joonas Lehtonen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Kevin Fenzi:
>> So we could take advantage of the environment variable named
>>> 'CURL_CA_BUNDLE' to feed it with the issuing CA of 
>>> https://mirrors.fedoraproject.org 's certificate.
> I suppose, sure. Or it might be a slightly different env for 
> urlgrabber... not sure.

It is actually even easier:

sslcacert=/path/to/pem

works fine here.

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJT85UKAAoJEG58zmw5nc+v+SMQAMEtjq7LQAxIOIMp+J+H8R5O
3QGN9u0id1EUm7RHQWJydViIYouaXn0D6VuBhzvvASKqVJC43fVz9KMr3YGVtuEq
dHLur/x/BQHrc1Wtat4YnUkfH1GtnES8xEid9kUi79l+v6qIQaltlU9E3LWOgHtd
XmMOS7/WuWX77rth04GL2ib1VIPSmE95w09nyEnI8BgydcmPD4e4wylq+QPcLkWo
r6bElrO2PQzUEA7mIponODKdL0p9CnLuOdRapKDshzgFD9FccYV7x9KvHKc+JeY2
bXQj/VNTyJW2p1YmHZl+P+reHjQVhvH+5A/zcw59U2ka97KtUDENFFYS8Hfp5ip/
HVrOJQWUP9b4AswwOTiYOTGFuSYGEmE++mXME5Y6KApx4X5VGX0KI3nNOuLK5IFo
gifoFabhxXMoNPChyfj3wowThK7iUki7b4v3mRIoaZ+ixlry/7bhHS9nmQ/OU54D
EpSVmYrbf+Sul4ccsyDQ6gZEBEfW0qCOhlEV5h5+IQmltrVLt1QM9SHzZ0UCDGez
vbzUC2/2HnGbksYHbQoWNWGaiqdGcTEtx3RERs2NEMZ37rxOURYePJPkZPFxVqMs
/my7WHTUPxmejXC1PDaBlYrj+3CUojxmAsTr/IGg0zgk/A0Tu2vKRncLaifXbeMC
tAyDMGQFUBfDkgupvl2n
=vioj
-----END PGP SIGNATURE-----