Attestations for
  ghcr.io/kapsl-sh/pip@sha256:c028bfadf0e99830386c4f7489b4015fe02ec9b493fbd35baf0a28f0448e9b77

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/pip@sha256:c028bfadf0e99830386c4f7489b4015fe02ec9b493fbd35baf0a28f0448e9b77

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/pip
  digest    sha256:c028bfadf0e99830386c4f7489b4015fe02ec9b493fbd35baf0a28f0448e9b77
  states    20 component(s) are inside this image
      Simple Launcher        1.1.0.14                 cpe:2.3:a:Simple_Launcher:Simple_Launcher:1.1.0.14:*
      pip                    26.2.1                   pkg:pypi/pip@26.2.1
      CacheControl           0.14.4                   pkg:pypi/cachecontrol@0.14.4
      certifi                2026.6.17                pkg:pypi/certifi@2026.6.17
      distlib                0.4.2                    pkg:pypi/distlib@0.4.2
      distro                 1.9.0                    pkg:pypi/distro@1.9.0
      idna                   3.18                     pkg:pypi/idna@3.18
      msgpack                1.1.2                    pkg:pypi/msgpack@1.1.2
      packaging              26.2                     pkg:pypi/packaging@26.2
      platformdirs           4.10.0                   pkg:pypi/platformdirs@4.10.0
      pygments               2.20.0                   pkg:pypi/pygments@2.20.0
      pyproject-hooks        1.2.0                    pkg:pypi/pyproject-hooks@1.2.0
      ... and 8 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/pip
  digest    sha256:c028bfadf0e99830386c4f7489b4015fe02ec9b493fbd35baf0a28f0448e9b77
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      6 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:binutils
      composed-image     compose:gcc
      composed-image     compose:pip
      composed-image     compose:python
      composed-image     compose:python@3.14
  sbom      sbom.json sha256:eacd958fdcadfe500f86c6f13fdb8c73...