Attestations for
  ghcr.io/kapsl-sh/huggingface-cli@sha256:db140c597099d621b80f0f93e3f4c552b5b27402f1e704cc1b62648e737d5903

Signed at seal time, arm64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/huggingface-cli@sha256:db140c597099d621b80f0f93e3f4c552b5b27402f1e704cc1b62648e737d5903

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:ee6ec336113bfdc24cbf58593544104b66d2a1b115d258b4097a5e465314ef05  (2093 bytes)
  signature  sha256:24ef025d6ecd6f32bcf7e52693c14de8312d2a3dde51ecb6a84a12b9fe8ac5ec  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:7de39fe1e9c9ab5e560baf6f31877a8d8749e9d630fd9c49609d6dafb83a6e4b  (225386 bytes)
  signature  sha256:ac9ed2eca62aa14dc574ddf4e938d881f0846a33ccf39d190d2e3f1aeca0e78f  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:a81085a404fbad00691b7caf497201955f876856994f2dff4a928eb801aa846e  (238 bytes)
  signature  sha256:67bc7884e148f0fa00a943077ff7317862a8d35f90a364a0a6b193b2a8f6c1cc  (vex.json.sigstore)