code: func CheckV2MetadataHMAC(meta *V2Metadata, key []byte) bool {
  	if len(meta.HMAC) == 0 || len(key) == 0 {
  		return len(meta.HMAC) == 0 && len(key) == 0
  	}
  	mac := hmac.New(sha256.New, key)
  	mac.Write([]byte(meta.Digest))
  	mac.Write([]byte(meta.SourceRepository))
  	expectedMac := mac.Sum(nil)
  
  	storedMac, err := hex.DecodeString(meta.HMAC)
  	if err != nil {
  		return false
  	}
  
  	return hmac.Equal(storedMac, expectedMac)
  }
docs: // CheckV2MetadataHMAC returns true if the given "meta" is tagged with a hmac hashed by the given "key".