Attestations for
  ghcr.io/kapsl-sh/go-gofmt@sha256:58a40489fe230e37a369fd8aeacd98b3a963b1241f536fa3161a1d35a51a7ae1

Signed at seal time, amd64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/go-gofmt@sha256:58a40489fe230e37a369fd8aeacd98b3a963b1241f536fa3161a1d35a51a7ae1

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:7dfb5d8edc88caf21b261f8b152435d69342cb5c58e4595426cf9494dfe47b28  (2466 bytes)
  signature  sha256:6fd7bee83f7742048b7b5ad6a1b32e2028d911f57d84be6db1cf7240a7c31acb  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:99a7f6ec94b606d0d81cf4f6dff0e7557c3410ff3e7311b2a96e6f347a05ba68  (3470 bytes)
  signature  sha256:5993e728681827332af2e174c341b62482962a19bb6ee32fa20bc81f94c3d6d9  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:f16bd3ada5ebb1b776fcc40df4a5e5a747388fca1e3af3da994bc1e2f9ab6fe2  (231 bytes)
  signature  sha256:0d9419a68eb22d2fd9ec3ff362ef56d85ab8d21fec5042a2b5ef0ad3a293e92c  (vex.json.sigstore)