sources:
  cosign-2.4.1.tar.gz: 84e259decc748f6d88876ab86b33e66ab49666ce