Right now if robosign is signing an ostree with --ref-update and it fails to update the ref, it just errors and returns.
However, it then gets the message it couldn't process right again, sees that there is a commitmeta already and says 'ok, processed fine'.
So, either it should remove the commitmeta in the event of a ref update failure (to rollback to before it started) or It could detect the commitmeta but see it's called with --ref-update and actually try and update the ref again.
Log in to comment on this ticket.