Attestations for
  ghcr.io/kapsl-sh/pytest@sha256:9476bf278ae381b69c0ab1ba4151f7021a3b4b8afa49af257363a214b7bbc496

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/pytest@sha256:9476bf278ae381b69c0ab1ba4151f7021a3b4b8afa49af257363a214b7bbc496

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/pytest
  digest    sha256:9476bf278ae381b69c0ab1ba4151f7021a3b4b8afa49af257363a214b7bbc496
  states    5 component(s) are inside this image
      iniconfig              2.3.0                    pkg:pypi/iniconfig@2.3.0
      packaging              26.3                     pkg:pypi/packaging@26.3
      pluggy                 1.6.0                    pkg:pypi/pluggy@1.6.0
      pygments               2.21.0                   pkg:pypi/pygments@2.21.0
      pytest                 9.1.1                    pkg:pypi/pytest@9.1.1

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/pytest
  digest    sha256:9476bf278ae381b69c0ab1ba4151f7021a3b4b8afa49af257363a214b7bbc496
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.14
  sbom      sbom.json sha256:72648d91d7116ea195c22bfcf0d72aa6...