sources:
  cosign-2.4.2.tar.gz: d0bd6133179b037817c191c5bc990a9d31d9305a