It looks like this is implemented by:

https://github.com/Tojaj/librepo/blob/master/librepo/lrmirrorlist.h

A few options:

1) Steal this code  (except...librepo is GPLv2+ =/)
2) Reimplement
3) Push this problem set to rpm-ostree; for example, have the yum repo metadata contain the ostree repository links.
  Then we fetch the yum data via librepo, and extract the ostree repo links.  Only works if every yum repo also carries ostree repos.

See: https://fedorahosted.org/mirrormanager/

A basic plan:

* Add a metalink= argument in the ostree repo config
* Add a metalink parser (based on GMarkup) to ostree
 - Only support a file named "repomd.xml" 
 - Iterate over the lists of available mirrors, fetch it, verify its checksum (only accept sha256)
* Parse the repomd.xml - it can contain whatever we want.  Theoretically doesn't actually have to be XML either.  The important thing is this if we fetch the metalink over SSL, the data in the metalink should be sufficient to verify the repomd.xml, which in turn should be sufficient to verify the commit.

See also https://bugzilla.gnome.org/show_bug.cgi?id=729585

This is implemented now (using the summary file) so it can be closed?

Yeah,  this is implemented today.