Attestations for
  ghcr.io/kapsl-sh/bc@sha256:09e6951507d18712625f9b3616af71b6cb1c3e0dcd320532b1655ee7fa9469f8

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/bc@sha256:09e6951507d18712625f9b3616af71b6cb1c3e0dcd320532b1655ee7fa9469f8

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/bc
  digest    sha256:09e6951507d18712625f9b3616af71b6cb1c3e0dcd320532b1655ee7fa9469f8
  states    3 component(s) are inside this image
      bc                     1.07.1-4build1           pkg:deb/ubuntu/bc@1.07.1-4build1?distro=ubuntu-26.04
      ncurses                6.6+20251231-1           pkg:deb/ubuntu/ncurses@6.6%2B20251231-1?distro=ubunt
      readline               8.3-4                    pkg:deb/ubuntu/readline@8.3-4?distro=ubuntu-26.04

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/bc
  digest    sha256:09e6951507d18712625f9b3616af71b6cb1c3e0dcd320532b1655ee7fa9469f8
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/bc@1.07.1-4build1?arch=arm64
  sbom      sbom.json sha256:da1cdda5f1bae676a007202fe8445925...