$ git clone -n https://gitee.com/geliwei/cosign.git /var/lib/mock/dist-an23-build-554209-89038/root/chroot_tmpdir/scmroot/cosign
Cloning into '/var/lib/mock/dist-an23-build-554209-89038/root/chroot_tmpdir/scmroot/cosign'...
$ git fetch origin 5322d26c9709168d4ae82a116c60eb022ab61765:KOJI_FETCH_HEAD
From https://gitee.com/geliwei/cosign
 * [new ref]         5322d26c9709168d4ae82a116c60eb022ab61765 -> KOJI_FETCH_HEAD
$ git reset --hard KOJI_FETCH_HEAD
HEAD is now at 5322d26 [CVE] [Upstream] Fix CVE-2026-22703: CVE-2026-22703: Cosign provides code signing and transparenc