Attestations for
  ghcr.io/kapsl-sh/lua@sha256:30a13e572e46444c7d8fb7783835dc92d6b2c043cbb57a640befea32d6e62ad8

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/lua@sha256:30a13e572e46444c7d8fb7783835dc92d6b2c043cbb57a640befea32d6e62ad8

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/lua
  digest    sha256:30a13e572e46444c7d8fb7783835dc92d6b2c043cbb57a640befea32d6e62ad8
  states    3 component(s) are inside this image
      ncurses                6.6+20251231-1           pkg:deb/ubuntu/ncurses@6.6%2B20251231-1?distro=ubunt
      readline               8.3-4                    pkg:deb/ubuntu/readline@8.3-4?distro=ubuntu-26.04
      lua                    5.5.1                    cpe:2.3:a:lua:lua:5.5.1:*:*:*:*:*:*:*

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/lua
  digest    sha256:30a13e572e46444c7d8fb7783835dc92d6b2c043cbb57a640befea32d6e62ad8
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      15 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/binutils@2.46-3ubuntu2?arch=amd64
      apt-package        pkg:deb/ubuntu/ca-certificates@20260601~26.04.1?arch=amd64
      apt-package        pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.4?arch=amd64
      apt-package        pkg:deb/ubuntu/file@1:5.46-5build2?arch=amd64
      apt-package        pkg:deb/ubuntu/findutils@4.10.0-3build2?arch=amd64
      apt-package        pkg:deb/ubuntu/gcc@4:15.2.0-5ubuntu1?arch=amd64
      apt-package        pkg:deb/ubuntu/gzip@1.14-1~exp2ubuntu1.1?arch=amd64
      apt-package        pkg:deb/ubuntu/libc6-dev@2.43-2ubuntu2.3?arch=amd64
      apt-package        pkg:deb/ubuntu/libreadline-dev@8.3-4?arch=amd64
      apt-package        pkg:deb/ubuntu/libreadline8t64@8.3-4?arch=amd64
      apt-package        pkg:deb/ubuntu/libtinfo6@6.6+20251231-1?arch=amd64
      ... and 3 more
  sbom      sbom.json sha256:baef5345ccb89670662e4bd2a7107b3a...