Attestations for
  ghcr.io/kapsl-sh/go-toolchain@sha256:dec1489b51fa1bcb0608826ead3050dc94889e6a667c9f0856ef4703b7394bfc

Signed at seal time, arm64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/go-toolchain@sha256:dec1489b51fa1bcb0608826ead3050dc94889e6a667c9f0856ef4703b7394bfc

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:4d14d298386cc8996552854434c0f61e1aa07b676856e115a5a77cd66e64e134  (2566 bytes)
  signature  sha256:ed07650b692095b273c422cc52c90833bb144c103cb3763301d86060727361b2  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:70617fbcb5a8093475e5f8408c8f0453d998701ee323d0507e637e8c570d351d  (1924307 bytes)
  signature  sha256:79d7a9f03684fef05ff046969db727b8356423ca94cbfee2fe621f4c9adcd855  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:fdeea5299b287eea91e3c4c77f29c337ec2f7fde973179ec3e4b51c165a76c4d  (235 bytes)
  signature  sha256:7ec1fe8c80a1b2b6313d90c363c0bbcb8e1cd6e4df7dea193d07555b608b7bb8  (vex.json.sigstore)