Attestations for
  ghcr.io/kapsl-sh/php@sha256:5ec96d5153e7e63751b4d0ccf7cb9b7b8ca1e374f395cb476b9f43a20840fd7e

Signed at seal time, arm64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/php@sha256:5ec96d5153e7e63751b4d0ccf7cb9b7b8ca1e374f395cb476b9f43a20840fd7e

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:579ff3997079f0158f259744269f0ce63f2f1183ceecf49d929634c46f453504  (9370 bytes)
  signature  sha256:b93f2622bdc2383052d43350bc5528539027156fc925ec8852cbd7f229ff6186  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:174de52d8aba330cf0a9de470bd9f2efcf95cabe5f4929b9347a02de9a55fb5c  (160343 bytes)
  signature  sha256:3082b7324972b4ff6340c7a5421f8545b02edbadd231bd253c32ec7f6267434f  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:5f204c4bee1327abfabf45a09c3384c042b13db1f0005f9e27230783c05d39cc  (3573 bytes)
  signature  sha256:6d0e4ac60a362b2dedd2f0cecbaf46d96db7f287dcbeffb5daf3c3a9e057d198  (vex.json.sigstore)