Attestations for
  ghcr.io/kapsl-sh/php@sha256:c70e79c85c6b95010bfc4357f47d631691a08af0d7f7833dccf2624af2a7d305

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/php@sha256:c70e79c85c6b95010bfc4357f47d631691a08af0d7f7833dccf2624af2a7d305

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/php
  digest    sha256:c70e79c85c6b95010bfc4357f47d631691a08af0d7f7833dccf2624af2a7d305
  states    37 component(s) are inside this image
      Archive_Tar            1.6.0                    pkg:pear/pear.php.net/Archive_Tar@1.6.0
      Console_Getopt         1.4.3                    pkg:pear/pear.php.net/Console_Getopt@1.4.3
      PEAR                   1.10.18                  pkg:pear/pear.php.net/PEAR@1.10.18
      Structures_Graph       1.2.0                    pkg:pear/pear.php.net/Structures_Graph@1.2.0
      XML_Util               1.4.5                    pkg:pear/pear.php.net/XML_Util@1.4.5
      brotli                 1.2.0-3build1            pkg:deb/ubuntu/brotli@1.2.0-3build1?distro=ubuntu-26
      bzip2                  1.0.8-6build2            pkg:deb/ubuntu/bzip2@1.0.8-6build2?distro=ubuntu-26.
      curl                   8.18.0-1ubuntu2.4        pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.4?distro=ubuntu-
      cyrus-sasl2            2.1.28+dfsg1-9ubuntu3    pkg:deb/ubuntu/cyrus-sasl2@2.1.28%2Bdfsg1-9ubuntu3?d
      e2fsprogs              1.47.2-3ubuntu4          pkg:deb/ubuntu/e2fsprogs@1.47.2-3ubuntu4?distro=ubun
      gmp                    2:6.3.0+dfsg-5ubuntu2    pkg:deb/ubuntu/gmp@2%3A6.3.0%2Bdfsg-5ubuntu2?distro=
      gnutls28               3.8.12-2ubuntu1.1        pkg:deb/ubuntu/gnutls28@3.8.12-2ubuntu1.1?distro=ubu
      ... and 25 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/php
  digest    sha256:c70e79c85c6b95010bfc4357f47d631691a08af0d7f7833dccf2624af2a7d305
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      60 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/binutils@2.46-3ubuntu2?arch=amd64
      apt-package        pkg:deb/ubuntu/ca-certificates@20260601~26.04.1?arch=amd64
      apt-package        pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.4?arch=amd64
      apt-package        pkg:deb/ubuntu/file@1:5.46-5build2?arch=amd64
      apt-package        pkg:deb/ubuntu/findutils@4.10.0-3build2?arch=amd64
      apt-package        pkg:deb/ubuntu/gcc@4:15.2.0-5ubuntu1?arch=amd64
      apt-package        pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64
      apt-package        pkg:deb/ubuntu/libbz2-1.0@1.0.8-6build2?arch=amd64
      apt-package        pkg:deb/ubuntu/libcom-err2@1.47.2-3ubuntu4?arch=amd64
      apt-package        pkg:deb/ubuntu/libcrypt-dev@1:4.5.1-1?arch=amd64
      apt-package        pkg:deb/ubuntu/libcrypt1@1:4.5.1-1?arch=amd64
      ... and 48 more
  sbom      sbom.json sha256:57caf3a403bf5c87d98e165eb9fcc2f1...