Attestations for
  ghcr.io/kapsl-sh/php@sha256:2526e7d5509a7449fcfc1b8e8ef7206bc9cf672e5c7bd5c764afb54aea0309f3

Signed at seal time, arm64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/php@sha256:2526e7d5509a7449fcfc1b8e8ef7206bc9cf672e5c7bd5c764afb54aea0309f3

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:de7c983149ea515901b2ed1e55c1c4f032a4834ebc22f4e8df5b7902859eef25  (9370 bytes)
  signature  sha256:fe1dfcb680e1e59229df1d05827db3cba5d0d7a33a5928901c47a8dd21ce3b44  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:2e5dae4b1f427558916854b295ef6e536b35e75b7f8ecbadf84b558d32546616  (159711 bytes)
  signature  sha256:17dd077605f270dfa4e4015fbc4e0a97b25fc068b0a321161ce18cb26fb65c43  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:3d5b37c59607d02bcec8af88f6d4697c5d0b22ff5013af4878b00601bcd7d674  (3573 bytes)
  signature  sha256:0a58e083e2ab5ad14bffb8e995e7d9c572934ed95233e39d87bab21468e27768  (vex.json.sigstore)