Attestations for
  ghcr.io/kapsl-sh/openssh-sftp@sha256:19104be9ac031f2a13a63df014b263222826c65f90330a23ad251436cf01276b

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/openssh-sftp@sha256:19104be9ac031f2a13a63df014b263222826c65f90330a23ad251436cf01276b

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/openssh-sftp
  digest    sha256:19104be9ac031f2a13a63df014b263222826c65f90330a23ad251436cf01276b
  states    5 component(s) are inside this image
      libbsd                 0.12.2-2build2           pkg:deb/ubuntu/libbsd@0.12.2-2build2?distro=ubuntu-2
      libedit                3.1-20251016-1           pkg:deb/ubuntu/libedit@3.1-20251016-1?distro=ubuntu-
      libmd                  1.1.0-2build4            pkg:deb/ubuntu/libmd@1.1.0-2build4?distro=ubuntu-26.
      ncurses                6.6+20251231-1           pkg:deb/ubuntu/ncurses@6.6%2B20251231-1?distro=ubunt
      openssh                1:10.2p1-2ubuntu3.5      pkg:deb/ubuntu/openssh@1%3A10.2p1-2ubuntu3.5?distro=

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/openssh-sftp
  digest    sha256:19104be9ac031f2a13a63df014b263222826c65f90330a23ad251436cf01276b
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/openssh-client@1:10.2p1-2ubuntu3.5?arch=amd64
  sbom      sbom.json sha256:06b74df700ca930ffbb11e0dc652ca1c...