Attestations for
  ghcr.io/kapsl-sh/huggingface-cli@sha256:695b7bb88cede7fdd35a0adcd3807725dbe7f193d5c61f9dfb3db75e547dfbd9

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/huggingface-cli@sha256:695b7bb88cede7fdd35a0adcd3807725dbe7f193d5c61f9dfb3db75e547dfbd9

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/huggingface-cli
  digest    sha256:695b7bb88cede7fdd35a0adcd3807725dbe7f193d5c61f9dfb3db75e547dfbd9
  states    15 component(s) are inside this image
      anyio                  4.14.2                   pkg:pypi/anyio@4.14.2
      certifi                2026.7.22                pkg:pypi/certifi@2026.7.22
      click                  8.5.0                    pkg:pypi/click@8.5.0
      filelock               3.32.4                   pkg:pypi/filelock@3.32.4
      fsspec                 2026.7.0                 pkg:pypi/fsspec@2026.7.0
      h11                    0.16.0                   pkg:pypi/h11@0.16.0
      hf-xet                 1.6.0                    pkg:pypi/hf-xet@1.6.0
      httpcore               1.0.9                    pkg:pypi/httpcore@1.0.9
      httpx                  0.28.1                   pkg:pypi/httpx@0.28.1
      huggingface-hub        1.28.0                   pkg:pypi/huggingface-hub@1.28.0
      idna                   3.19                     pkg:pypi/idna@3.19
      packaging              26.3                     pkg:pypi/packaging@26.3
      ... and 3 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/huggingface-cli
  digest    sha256:695b7bb88cede7fdd35a0adcd3807725dbe7f193d5c61f9dfb3db75e547dfbd9
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.14
  sbom      sbom.json sha256:9d37e81cd22c9e22da3c918354b1eb55...