Attestations for
  ghcr.io/kapsl-sh/cosign@sha256:aa5051063b60afdbc43294b31ccf58c26ce8808a0771ea59251beadffa2d391b

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/cosign@sha256:aa5051063b60afdbc43294b31ccf58c26ce8808a0771ea59251beadffa2d391b

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/cosign
  digest    sha256:aa5051063b60afdbc43294b31ccf58c26ce8808a0771ea59251beadffa2d391b
  states    253 component(s) are inside this image
      buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 pkg:golang/buf.build/gen/go/bufbuild/protovalidate/p
      cloud.google.com/go/auth v0.20.0                  pkg:golang/cloud.google.com/go/auth@v0.20.0
      cloud.google.com/go/auth/oauth2adapt v0.2.8                   pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2
      cloud.google.com/go/compute/metadata v0.9.0                   pkg:golang/cloud.google.com/go/compute/metadata@v0.9
      cloud.google.com/go/iam v1.11.0                  pkg:golang/cloud.google.com/go/iam@v1.11.0
      cloud.google.com/go/kms v1.31.0                  pkg:golang/cloud.google.com/go/kms@v1.31.0
      cloud.google.com/go/longrunning v1.0.0                   pkg:golang/cloud.google.com/go/longrunning@v1.0.0
      connectrpc.com/connect v1.20.0                  pkg:golang/connectrpc.com/connect@v1.20.0
      cuelabs.dev/go/oci/ociregistry v0.0.0-20251212221603-3adeb8663819 pkg:golang/cuelabs.dev/go/oci/ociregistry@v0.0.0-202
      cuelang.org/go         v0.16.1                  pkg:golang/cuelang.org/go@v0.16.1
      github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider v0.14.0                  pkg:golang/github.com/AliyunContainerService/ack-ram
      github.com/Azure/azure-sdk-for-go v68.0.0+incompatible     pkg:golang/github.com/Azure/azure-sdk-for-go@v68.0.0
      ... and 241 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/cosign
  digest    sha256:aa5051063b60afdbc43294b31ccf58c26ce8808a0771ea59251beadffa2d391b
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:go
  sbom      sbom.json sha256:76086ed8cab9dfcfd0f334912accdecd...