$ git clone -n https://gitee.com/wenyuzifang/cosign.git /var/lib/mock/dist-an23-build-570419-92560/root/chroot_tmpdir/scmroot/cosign
Cloning into '/var/lib/mock/dist-an23-build-570419-92560/root/chroot_tmpdir/scmroot/cosign'...
$ git reset --hard f309f54c8f1c35f3bedcac7c3d29d6bceaba2feb
HEAD is now at f309f54 [CVE] [Upstream] add patch to fix CVE-2026-39395