Attestations for
  ghcr.io/kapsl-sh/go-toolchain@sha256:f5c6d2721dc15e8e007252c99af02bb7dd36fd048fd083672d9a3ac3b0c5ed24

Signed at seal time, amd64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/go-toolchain@sha256:f5c6d2721dc15e8e007252c99af02bb7dd36fd048fd083672d9a3ac3b0c5ed24

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:e54eafdbfffec16b46e691badc197283e4186b8e291f995966171ad500122379  (2564 bytes)
  signature  sha256:35209b64fb026c3d709a043f7d6c4196d17adde5f401d78e7f2d1393bd717d16  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:eb6097859235ad5d4c27a91360646f1e8b7e14f9063406fc6675c0aa97ee9086  (1924307 bytes)
  signature  sha256:fa0a3ea252ed6e6fc65c842df8e55e6d3befef9f3e667b1e4026a74273ca5220  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:daab2e41414eca1578a20ab4de93b08c107484df98d3f9b743d965dc4962409d  (235 bytes)
  signature  sha256:d55137c2377ec9ad158e53577ac7f59effa7f00d7ab8106fd585f3df91149752  (vex.json.sigstore)