pull: honor gpg-verify-summary=false when a summary signature is present

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

tests/test-pull-mirror-summary.sh

@@ -94,6 +94,20 @@ assert_has_file repo/summary
 assert_has_file repo/summary.sig
 echo "ok pull mirror with signed summary"
 
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig{,.good}
+truncate --size=1 ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig
+
+cd ${test_tmpdir}
+rm -rf repo
+mkdir repo
+${OSTREE} --repo=repo init --mode=archive-z2
+${OSTREE} --repo=repo remote add origin $(cat httpd-address)/ostree/gnomerepo
+${OSTREE} --repo=repo pull --mirror origin
+assert_has_file repo/summary
+assert_has_file repo/summary.sig
+mv ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig{.good,}
+echo "ok pull mirror with invalid summary sig and no verification"
+
 # Uncomment when we support mirroring deltas
 #
 # ${OSTREE} --repo=${test_tmpdir}/ostree-srv/gnomerepo static-delta generate main