---
- block:
    - name: Download cosign executable
      get_url:
        url: "{{ cosign_dl_url }}"
        dest: "/tmp/cosign-{{ cosign_version }}-linux-{{ cosign_arch }}"
      register: _download_archive
      until: _download_archive is succeeded
      retries: 5
      delay: 2

# TODO find a way to verify cosign on first install!!

    - name: Copy cosign to
      copy:
        remote_src: yes
        src: "/tmp/cosign-{{ cosign_version }}-linux-{{ cosign_arch }}"
        dest: "/usr/local/bin/cosign"
        mode: 0755
        owner: root
        group: root
  when: (not cosign_version_check|bool) or (cosign_active_version != cosign_version)