Attestations for
  ghcr.io/kapsl-sh/composer@sha256:88c3cc1da404a1713d992cc1c6b1807109ac254195287d82201ec5dd116f0f25

Signed at seal time, amd64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/composer@sha256:88c3cc1da404a1713d992cc1c6b1807109ac254195287d82201ec5dd116f0f25

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:a07957da53c0590c3f5d9fd283996862f047e27ae790be5a4fbf40c7f7bfaca4  (2659 bytes)
  signature  sha256:cebfb8a01f9d550f5fbcff6ef3f4ce97d5bb0ac136f26c6f37c60860c5282f92  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:60ec508fc6c1a0508ff2e31ce78715c11d0b7e309eb5f6dd1be4acbac3296d5a  (55180 bytes)
  signature  sha256:e939200a17cc8241c33a9e7af7e409f01c97aaf54237f44e862d5911334c94e4  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:3cfef5cf3341f7701f70a28b2cbe92544c62c398d6223c13fb3532c62bc035fe  (231 bytes)
  signature  sha256:c69d60af97839312eb82e120ec3c142c12d6cc12121e8d9df72fc9949f5da0bb  (vex.json.sigstore)