Attestations for
  ghcr.io/kapsl-sh/hermes-agent@sha256:acfd5fedf3441e6dc32bc62d3b54f7fe09930b68223cc15be58c30ea027a9ea6

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/hermes-agent@sha256:acfd5fedf3441e6dc32bc62d3b54f7fe09930b68223cc15be58c30ea027a9ea6

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/hermes-agent
  digest    sha256:acfd5fedf3441e6dc32bc62d3b54f7fe09930b68223cc15be58c30ea027a9ea6
  states    61 component(s) are inside this image
      annotated-doc          0.0.5                    pkg:pypi/annotated-doc@0.0.5
      annotated-types        0.8.0                    pkg:pypi/annotated-types@0.8.0
      anyio                  4.14.2                   pkg:pypi/anyio@4.14.2
      certifi                2026.5.20                pkg:pypi/certifi@2026.5.20
      cffi                   2.1.1                    pkg:pypi/cffi@2.1.1
      charset-normalizer     3.5.1                    pkg:pypi/charset-normalizer@3.5.1
      click                  8.5.0                    pkg:pypi/click@8.5.0
      croniter               6.0.0                    pkg:pypi/croniter@6.0.0
      cryptography           50.0.0                   pkg:pypi/cryptography@50.0.0
      distro                 1.9.0                    pkg:pypi/distro@1.9.0
      fastapi                0.141.1                  pkg:pypi/fastapi@0.141.1
      fire                   0.7.1                    pkg:pypi/fire@0.7.1
      ... and 49 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/hermes-agent
  digest    sha256:acfd5fedf3441e6dc32bc62d3b54f7fe09930b68223cc15be58c30ea027a9ea6
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.13
  sbom      sbom.json sha256:8226f14e4b730378849dc3b98130a968...