Attestations for
  ghcr.io/kapsl-sh/hermes-agent@sha256:e9d83332ace796c848bc9c7e551de4847b6fa52a0295ebd8e09e2d859c989271

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/hermes-agent@sha256:e9d83332ace796c848bc9c7e551de4847b6fa52a0295ebd8e09e2d859c989271

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/hermes-agent
  digest    sha256:e9d83332ace796c848bc9c7e551de4847b6fa52a0295ebd8e09e2d859c989271
  states    61 component(s) are inside this image
      annotated-doc          0.0.5                    pkg:pypi/annotated-doc@0.0.5
      annotated-types        0.8.0                    pkg:pypi/annotated-types@0.8.0
      anyio                  4.14.2                   pkg:pypi/anyio@4.14.2
      certifi                2026.5.20                pkg:pypi/certifi@2026.5.20
      cffi                   2.1.1                    pkg:pypi/cffi@2.1.1
      charset-normalizer     3.5.1                    pkg:pypi/charset-normalizer@3.5.1
      click                  8.5.0                    pkg:pypi/click@8.5.0
      croniter               6.0.0                    pkg:pypi/croniter@6.0.0
      cryptography           50.0.0                   pkg:pypi/cryptography@50.0.0
      distro                 1.9.0                    pkg:pypi/distro@1.9.0
      fastapi                0.141.1                  pkg:pypi/fastapi@0.141.1
      fire                   0.7.1                    pkg:pypi/fire@0.7.1
      ... and 49 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/hermes-agent
  digest    sha256:e9d83332ace796c848bc9c7e551de4847b6fa52a0295ebd8e09e2d859c989271
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.13
  sbom      sbom.json sha256:7252e20151446b7473033d32731295f1...