$ git clone -n https://gitee.com/ali-inspur/cosign.git /var/lib/mock/dist-an23-build-514855-75118/root/chroot_tmpdir/scmroot/cosign
Cloning into '/var/lib/mock/dist-an23-build-514855-75118/root/chroot_tmpdir/scmroot/cosign'...
$ git fetch origin e8ec3c476f641b1b3da3922ec58d6f14fc63dd45:KOJI_FETCH_HEAD
From https://gitee.com/ali-inspur/cosign
 * [new ref]         e8ec3c476f641b1b3da3922ec58d6f14fc63dd45 -> KOJI_FETCH_HEAD
$ git reset --hard KOJI_FETCH_HEAD
HEAD is now at e8ec3c4 [CVE][UpstreamModified] CVE-2026-24122