Attestations for
  ghcr.io/kapsl-sh/perl@sha256:b8de564e7521d3ddf934c693465b173891519ff0c8ce4266c2871a6dd6c34236

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/perl@sha256:b8de564e7521d3ddf934c693465b173891519ff0c8ce4266c2871a6dd6c34236

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/perl
  digest    sha256:b8de564e7521d3ddf934c693465b173891519ff0c8ce4266c2871a6dd6c34236
  states    3 component(s) are inside this image
      perl                   5.40.5                   cpe:2.3:a:perl:perl:5.40.5:*:*:*:*:*:*:*
      zlib                   1.3.2                    cpe:2.3:a:zlib:zlib:1.3.2:*:*:*:*:*:*:*
      bzip2                  1.0.8                    cpe:2.3:a:bzip:bzip2:1.0.8:*:*:*:*:*:*:*

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/perl
  digest    sha256:b8de564e7521d3ddf934c693465b173891519ff0c8ce4266c2871a6dd6c34236
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      14 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/binutils@2.46-3ubuntu2?arch=arm64
      apt-package        pkg:deb/ubuntu/ca-certificates@20260601~26.04.1?arch=arm64
      apt-package        pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.4?arch=arm64
      apt-package        pkg:deb/ubuntu/file@1:5.46-5build2?arch=arm64
      apt-package        pkg:deb/ubuntu/findutils@4.10.0-3build2?arch=arm64
      apt-package        pkg:deb/ubuntu/gcc@4:15.2.0-5ubuntu1?arch=arm64
      apt-package        pkg:deb/ubuntu/libc6-dev@2.43-2ubuntu2.3?arch=arm64
      apt-package        pkg:deb/ubuntu/libcrypt-dev@1:4.5.1-1?arch=arm64
      apt-package        pkg:deb/ubuntu/make@4.4.1-3?arch=arm64
      apt-package        pkg:deb/ubuntu/patch@2.8-2build1?arch=arm64
      apt-package        pkg:deb/ubuntu/patchelf@0.18.0-1.4build1?arch=arm64
      ... and 2 more
  sbom      sbom.json sha256:440bd1489ee7d2722301a89f5ff5a821...