$ git clone -n https://gitee.com/src-anolis-os/ca-certificates.git /var/lib/mock/dist-an23.5-build-588958-98732/root/chroot_tmpdir/scmroot/ca-certificates
Cloning into '/var/lib/mock/dist-an23.5-build-588958-98732/root/chroot_tmpdir/scmroot/ca-certificates'...
$ git fetch origin fc6f0f3b3b24c29be49209495cf3c33134178a7a:KOJI_FETCH_HEAD
From https://gitee.com/src-anolis-os/ca-certificates
 * [new ref]         fc6f0f3b3b24c29be49209495cf3c33134178a7a -> KOJI_FETCH_HEAD
$ git reset --hard KOJI_FETCH_HEAD
HEAD is now at fc6f0f3 invalidate two certs 'emSign Root TLS CA - G3' and 'Comodo AAA Services root'