Dockerfile %%cosign_version%% cosign patch