$ git clone -n https://gitee.com/geliwei/cosign.git /var/lib/mock/dist-an23.5-build-583055-96239/root/chroot_tmpdir/scmroot/cosign
Cloning into '/var/lib/mock/dist-an23.5-build-583055-96239/root/chroot_tmpdir/scmroot/cosign'...
$ git fetch origin 461b20f1c2e9a1a5f7361c066f3165bf28b54f43:KOJI_FETCH_HEAD
From https://gitee.com/geliwei/cosign
 * [new ref]         461b20f1c2e9a1a5f7361c066f3165bf28b54f43 -> KOJI_FETCH_HEAD
$ git reset --hard KOJI_FETCH_HEAD
HEAD is now at 461b20f [CVE] [Upstream] add patch to fix CVE-2026-39395