Attestations for
  ghcr.io/kapsl-sh/opencode@sha256:083fa855eb2c08ec07138ba27a104663102a635f1a5cf9cec4d5e59911903f88

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/opencode@sha256:083fa855eb2c08ec07138ba27a104663102a635f1a5cf9cec4d5e59911903f88

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/opencode
  digest    sha256:083fa855eb2c08ec07138ba27a104663102a635f1a5cf9cec4d5e59911903f88
  states    847 component(s) are inside this image
      opencode               1.18.23                  pkg:npm/opencode-ai@1.18.23
      @actions/core          1.11.1                   pkg:npm/@actions/core@1.11.1
      @actions/exec          1.1.1                    pkg:npm/@actions/exec@1.1.1
      @actions/github        6.0.1                    pkg:npm/@actions/github@6.0.1
      @actions/http-client   2.2.3                    pkg:npm/@actions/http-client@2.2.3
      @actions/io            1.1.3                    pkg:npm/@actions/io@1.1.3
      @agentclientprotocol/sdk 0.21.0                   pkg:npm/@agentclientprotocol/sdk@0.21.0
      @ai-sdk/alibaba        1.0.17                   pkg:npm/@ai-sdk/alibaba@1.0.17
      @ai-sdk/amazon-bedrock 4.0.153                  pkg:npm/@ai-sdk/amazon-bedrock@4.0.153
      @ai-sdk/amazon-bedrock 4.0.158                  pkg:npm/@ai-sdk/amazon-bedrock@4.0.158
      @ai-sdk/anthropic      3.0.110                  pkg:npm/@ai-sdk/anthropic@3.0.110
      @ai-sdk/anthropic      3.0.111                  pkg:npm/@ai-sdk/anthropic@3.0.111
      ... and 835 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/opencode
  digest    sha256:083fa855eb2c08ec07138ba27a104663102a635f1a5cf9cec4d5e59911903f88
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      12 resolved input(s)
      release-asset-aarch64 https://github.com/anomalyco/opencode/releases/download/v1.18.23
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:bash
      composed-image     compose:coreutils
      composed-image     compose:diffutils
      composed-image     compose:env
      composed-image     compose:findutils
      composed-image     compose:gawk
      composed-image     compose:git
      composed-image     compose:grep
      composed-image     compose:rg
      composed-image     compose:sed
  sbom      sbom.json sha256:a11f45e04252892dbcffc7e245ddfe92...