Attestations for
  ghcr.io/kapsl-sh/go-gofmt@sha256:d3dbc466232a1d32977d23df827aa183064c1d91e738b1cd888ff15647c6082b

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/go-gofmt@sha256:d3dbc466232a1d32977d23df827aa183064c1d91e738b1cd888ff15647c6082b

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/go-gofmt
  digest    sha256:d3dbc466232a1d32977d23df827aa183064c1d91e738b1cd888ff15647c6082b
  states    2 component(s) are inside this image
      stdlib                 go1.27.0                 pkg:golang/stdlib@1.27.0
      go                     1.27.0                   cpe:2.3:a:golang:go:1.27.0:*:*:*:*:*:*:*

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/go-gofmt
  digest    sha256:d3dbc466232a1d32977d23df827aa183064c1d91e738b1cd888ff15647c6082b
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      3 resolved input(s)
      release-asset-x86_64 https://go.dev/dl/go1.27.0.linux-{goarch}.tar.gz
      release-asset-x86_64 https://go.dev/dl/go1.27.0.linux-{goarch}.tar.gz
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
  sbom      sbom.json sha256:cfaba5dd3237d3bc0c46bbb27aa2a4a1...