Attestations for
  ghcr.io/kapsl-sh/php@sha256:75bbc7d67bce3c2c944ef796fde00629567bfc972a36050b0f1ff2e898d8857f

Signed at seal time, amd64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/php@sha256:75bbc7d67bce3c2c944ef796fde00629567bfc972a36050b0f1ff2e898d8857f

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:16b8c0f94e0314a48e73acc2ab01a2094ad29c3dc726881bec32377937b3e383  (9370 bytes)
  signature  sha256:7b7ac3afe28d70f18afd2d5e63ac698cf2a22f677605d51f20aad0f1fd344e7f  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:771a5da113837c42855520cd0952ae49af5df191195639f627254ac3f13b97e2  (161608 bytes)
  signature  sha256:07f4afa138b9fc9e850fc3703acef2d6b5a8897f8aa7b9d42b64e63778e3d51c  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:cbf746d7202e2f900efe0f350c360c70fcfc312dc347f34a155d5ffc732920ab  (3573 bytes)
  signature  sha256:4729bcbff6d26f28875255148f128de922390b517051d5583499aedb3da70898  (vex.json.sigstore)