make COSIGN_REPOSITORY
use explicit again
#860
Merged
COSIGN_REPOSITORY
use explicit again
#860