Here you go: https://docs.pagure.org/pungi/koji.html
The option is missing from the configuration page though, that needs to be fixed.

What value should a user set for this option? (The unit tests just use /tmp, is that expected for real-world usage?)

It should be a path to a directory that is persistent from one compose run to another. That way each successive compose will only download new packages are reuse anything that has been downloaded before.

Thanks, I think that gives me enough information to write a PR. I understand that koji.rst page uses the example of /mnt/compose/cache, so I'll reuse that for the configuration.rst snippet.

There's a sentence in koji.rst that I don't understand:

There is also a risk with symlinks that the package in Koji can change (due to being resigned for example)

Is this referring to situations where we may have to re-sign existing files in order to fix broken IMA signatures or something like that? I don't usually see files resigned, but that's one example I can think of.

Is this referring to situations where we may have to re-sign existing files in order to fix broken IMA signatures or something like that? I don't usually see files resigned, but that's one example I can think of.

Yes, that's pretty much it. If you create a compose using symlinks, and the file on Koji storage changes, the compose is broken (e.g. repodata containing wrong checksum). Resigning the package is an example of when that can happen. Adding IMA signature where it was previously missing would certainly change the checksum.

This situation is not something that would regularly happen, but it is technically possible.

The local mirroring is still somewhat vulnerable to such situation though. Once the package is available locally in the cache, it will never be checked again. So if there is some change in the packages, someone has to manually delete the files from the cache to download them again.

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/pungi/pungi/issues/1772

Please continue any further discussion there.