from: mfg
to: sec
evidence:
 - file: "mfg/verify.go"
   contains "    "github.com/apache/mynewt-artifact/sec""