Attestations for
  ghcr.io/kapsl-sh/nodejs@sha256:62504f3b67dbdd670212eaaa805b4a3404adbc4bf904f6db196774593e3866d4

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/nodejs@sha256:62504f3b67dbdd670212eaaa805b4a3404adbc4bf904f6db196774593e3866d4

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/nodejs
  digest    sha256:62504f3b67dbdd670212eaaa805b4a3404adbc4bf904f6db196774593e3866d4
  states    11 component(s) are inside this image
      brotli                 1.2.0-3build1            pkg:deb/ubuntu/brotli@1.2.0-3build1?distro=ubuntu-26
      c-ares                 1.34.6-1                 pkg:deb/ubuntu/c-ares@1.34.6-1?distro=ubuntu-26.04
      corepack               0.34.6                   pkg:npm/corepack@0.34.6
      libzstd                1.5.7+dfsg-3             pkg:deb/ubuntu/libzstd@1.5.7%2Bdfsg-3?distro=ubuntu-
      nghttp2                1.68.0-2ubuntu0.2        pkg:deb/ubuntu/nghttp2@1.68.0-2ubuntu0.2?distro=ubun
      node                   22.23.2                  pkg:generic/node@22.23.2
      openssl                3.5.5-1ubuntu3.4         pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.4?distro=ubunt
      sqlite3                3.46.1-9ubuntu0.2        pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.2?distro=ubun
      zlib                   1:1.3.dfsg+really1.3.1-1ubuntu3 pkg:deb/ubuntu/zlib@1%3A1.3.dfsg%2Breally1.3.1-1ubun
      nodejs                 22.23.2                  cpe:2.3:a:nodejs:node.js:22.23.2:*:*:*:*:*:*:*
      icu                    78.2                     cpe:2.3:a:unicode:international_components_for_unico

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/nodejs
  digest    sha256:62504f3b67dbdd670212eaaa805b4a3404adbc4bf904f6db196774593e3866d4
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      29 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/binutils
      apt-package        pkg:deb/ubuntu/ca-certificates
      apt-package        pkg:deb/ubuntu/curl
      apt-package        pkg:deb/ubuntu/file
      apt-package        pkg:deb/ubuntu/findutils
      apt-package        pkg:deb/ubuntu/g++
      apt-package        pkg:deb/ubuntu/libbrotli-dev
      apt-package        pkg:deb/ubuntu/libbrotli1
      apt-package        pkg:deb/ubuntu/libc-ares-dev
      apt-package        pkg:deb/ubuntu/libcares2
      apt-package        pkg:deb/ubuntu/libnghttp2-14
      ... and 17 more
  sbom      sbom.json sha256:e7eb518a88c7d87a574e71d16c5e690d...