Attestations for
  ghcr.io/kapsl-sh/openssh-scp@sha256:52d33daca35f4aef3f643e41b59e9be644764a406f6d6ded206aad7248046ad5

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/openssh-scp@sha256:52d33daca35f4aef3f643e41b59e9be644764a406f6d6ded206aad7248046ad5

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/openssh-scp
  digest    sha256:52d33daca35f4aef3f643e41b59e9be644764a406f6d6ded206aad7248046ad5
  states    1 component(s) are inside this image
      openssh                1:10.2p1-2ubuntu3.5      pkg:deb/ubuntu/openssh@1%3A10.2p1-2ubuntu3.5?distro=

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/openssh-scp
  digest    sha256:52d33daca35f4aef3f643e41b59e9be644764a406f6d6ded206aad7248046ad5
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/openssh-client@1:10.2p1-2ubuntu3.5?arch=amd64
  sbom      sbom.json sha256:b09e368e070cd58be2fab7de1ce01011...