Rebase on upstream

lib: disallow memsync and bail eagerly on reposync failure

- Disable reading remote repos directly, as it bypasses signature
  checking. This could probably be reworked to be safe down the line...
- If reposync fails, bail eagerly instead of proceeding.