diff --git a/vars/ansibleDeploy.groovy b/vars/ansibleDeploy.groovy
index c0b08cf..0b9a266 100644
--- a/vars/ansibleDeploy.groovy
+++ b/vars/ansibleDeploy.groovy
@@ -14,7 +14,7 @@ def call(String target) {
                 export REG_PASS=$(python3 -c "import json;print(json.load(open('/tmp/reg.$$.json'))['data']['data']['password'])")
                 rm -f /tmp/reg.$$.json
                 export ANSIBLE_HOST_KEY_CHECKING=False
-                ansible-galaxy collection install community.docker --force -q || true
+                ansible-galaxy collection install community.docker --force >/dev/null 2>&1 || true
                 ansible-playbook -i "$INVENTORY" "$PLAYBOOK" \
                   -u "$DEPLOY_USER" --private-key "$DEPLOY_KEY" -e target="$TARGET"
             '''
diff --git a/vars/devopsPipeline.groovy b/vars/devopsPipeline.groovy
index 467dba1..d627bc9 100644
--- a/vars/devopsPipeline.groovy
+++ b/vars/devopsPipeline.groovy
@@ -52,7 +52,7 @@ def call(Map cfg = [:]) {
     def rollbackTag = (env.ROLLBACK_TAG ?: '').trim()
     def isRollback  = rollbackTag != ''
 
-    def imageTag, fullImage, commonEnv
+    def imageTag, fullImage, commonEnv, gitSha
 
     timestamps {
       timeout(time: 60, unit: 'MINUTES') {
@@ -63,6 +63,10 @@ def call(Map cfg = [:]) {
             stage('Checkout') {
                 checkout scm
                 def sha = sh(script: 'git rev-parse --short=7 HEAD', returnStdout: true).trim()
+                // Poora SHA provenance ke liye. env.GIT_COMMIT sirf usi node par
+                // milta hai jahan checkout hua; sign controller par hota hai,
+                // isliye yahin pakad ke variable me le jaate hain.
+                gitSha = sh(script: 'git rev-parse HEAD', returnStdout: true).trim()
                 // Tag me commit SHA isliye: multibranch me har branch ka build
                 // number 1 se shuru hota hai, to sirf build number rakhne par
                 // tag dobara use ho jaata hai aur purani image overwrite hoti hai.
@@ -209,8 +213,8 @@ assert r['version'] == '${IMAGE_TAG}', 'version mismatch'
                 stage('Sign image') { cosignSign() }
                 stage('Provenance attest') {
                     cosignAttest([
-                        repo   : scm.userRemoteConfigs ? scm.userRemoteConfigs[0].url : 'unknown',
-                        commit : env.GIT_COMMIT ?: 'unknown',
+                        repo   : "${P.gitea}/devops/${cfg.module}.git",
+                        commit : gitSha ?: 'unknown',
                         build  : env.BUILD_NUMBER,
                         job    : env.JOB_NAME,
                         builder: "https://ns31240276.ip-51-195-4.eu:8443/${env.JOB_NAME}"