Attestations for
  ghcr.io/kapsl-sh/go-gofmt@sha256:90e2c9a2fbfa413621614c0efd81048041b2146c8c24d1a057eddbdac9d1980b

Signed at seal time, arm64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/go-gofmt@sha256:90e2c9a2fbfa413621614c0efd81048041b2146c8c24d1a057eddbdac9d1980b

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:51d4fd522aa87ab9ef5448754ecb075a23a1454b540931642095061cfdce5b7e  (2468 bytes)
  signature  sha256:c69890ebf9d58d947bbe61b151b87501c65eecf801f8c71bec49278851b316eb  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:531e6b2e60ef37f2c7e30039c2fd5c63bd772653ab58ab44d863fb5f5720ca08  (3470 bytes)
  signature  sha256:e5b76771a75ded7da4add0efe64595afe6ddc1c14d7d7e4c2e9ad9f38d1e8f5b  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:dceb18d0cb1f5180ba406c03e4348d0b1b2d9d8e4a34d0ffc4126be717598822  (231 bytes)
  signature  sha256:6cf72d104f3d1fb59a4d582a2f319ec1f67f178f08231ed0c3ff3f00aee1c3f7  (vex.json.sigstore)