Attestations for
  ghcr.io/kapsl-sh/cabal@sha256:bca36551b84d028278d786b4a06f3b240f52ca825527484715764e919d47a090

Signed at seal time, arm64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/cabal@sha256:bca36551b84d028278d786b4a06f3b240f52ca825527484715764e919d47a090

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:cf0b496e5d27787512db28877c792b5e408c2f8b8bae5122c358bbd74d776972  (2494 bytes)
  signature  sha256:8159eb372a8473b49e9eb1059cd9e29876a71e7137fc2245a77fd742d50be7f5  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:b4d5b0cd6b434908abb83cbb78e272ebbb7b59daee2c3ab92653925a194ea96f  (3254 bytes)
  signature  sha256:8351c4046a9d7f9e7a66d62de125fe111d9457883c2abed801047a6309bf9419  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:96a20cd689ec44525f693a4959361e12cd5d65611b8a791c5dcbec10300a16db  (228 bytes)
  signature  sha256:b8879c124210da5cf000762e44e9f4d3832c50b7661319de8b996f98ae7faf6c  (vex.json.sigstore)