Attestations for
  ghcr.io/kapsl-sh/black@sha256:82da24dd6e381ac9fd5308b81958f5034198c9c01ef5ce00e2e2b412b6bfac82

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/black@sha256:82da24dd6e381ac9fd5308b81958f5034198c9c01ef5ce00e2e2b412b6bfac82

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/black
  digest    sha256:82da24dd6e381ac9fd5308b81958f5034198c9c01ef5ce00e2e2b412b6bfac82
  states    7 component(s) are inside this image
      black                  26.5.1                   pkg:pypi/black@26.5.1
      click                  8.5.0                    pkg:pypi/click@8.5.0
      mypy-extensions        1.1.0                    pkg:pypi/mypy-extensions@1.1.0
      packaging              26.3                     pkg:pypi/packaging@26.3
      pathspec               1.1.1                    pkg:pypi/pathspec@1.1.1
      platformdirs           4.11.4                   pkg:pypi/platformdirs@4.11.4
      pytokens               0.4.1                    pkg:pypi/pytokens@0.4.1

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/black
  digest    sha256:82da24dd6e381ac9fd5308b81958f5034198c9c01ef5ce00e2e2b412b6bfac82
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.14
  sbom      sbom.json sha256:370946888f0f76cd6ee8e7a4c4a84780...