Attestations for
  ghcr.io/kapsl-sh/github-cli@sha256:bbfe5fab1c81f71a34ed65f9be19ddae8db9fa73df6a09951fa8a0105b6c6dbb

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/github-cli@sha256:bbfe5fab1c81f71a34ed65f9be19ddae8db9fa73df6a09951fa8a0105b6c6dbb

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/github-cli
  digest    sha256:bbfe5fab1c81f71a34ed65f9be19ddae8db9fa73df6a09951fa8a0105b6c6dbb
  states    167 component(s) are inside this image
      charm.land/bubbles/v2  v2.1.1                   pkg:golang/charm.land/bubbles/v2@v2.1.1
      charm.land/bubbletea/v2 v2.0.8                   pkg:golang/charm.land/bubbletea/v2@v2.0.8
      charm.land/huh/v2      v2.0.3                   pkg:golang/charm.land/huh/v2@v2.0.3
      charm.land/lipgloss/v2 v2.0.6                   pkg:golang/charm.land/lipgloss/v2@v2.0.6
      dario.cat/mergo        v1.0.2                   pkg:golang/dario.cat/mergo@v1.0.2
      github.com/AlecAivazis/survey/v2 v2.3.7                   pkg:golang/github.com/AlecAivazis/survey/v2@v2.3.7
      github.com/MakeNowJust/heredoc v1.0.0                   pkg:golang/github.com/MakeNowJust/heredoc@v1.0.0
      github.com/Masterminds/goutils v1.1.1                   pkg:golang/github.com/Masterminds/goutils@v1.1.1
      github.com/Masterminds/semver/v3 v3.4.0                   pkg:golang/github.com/Masterminds/semver/v3@v3.4.0
      github.com/Masterminds/sprig/v3 v3.3.0                   pkg:golang/github.com/Masterminds/sprig/v3@v3.3.0
      github.com/alecthomas/chroma/v2 v2.19.0                  pkg:golang/github.com/alecthomas/chroma/v2@v2.19.0
      github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 pkg:golang/github.com/asaskevich/govalidator@v0.0.0-
      ... and 155 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/github-cli
  digest    sha256:bbfe5fab1c81f71a34ed65f9be19ddae8db9fa73df6a09951fa8a0105b6c6dbb
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      3 resolved input(s)
      release-asset-aarch64 https://github.com/cli/cli/releases/download/v2.98.0/gh_2.98.0_l
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:git
  sbom      sbom.json sha256:baec6434fe45de0bb3fd4840d8d6dc45...