Attestations for
  ghcr.io/kapsl-sh/python@sha256:57e5a74e5ab3d74c67510c19500daf5fcc26358cc92bdafda96d9f4e919e8b92

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/python@sha256:57e5a74e5ab3d74c67510c19500daf5fcc26358cc92bdafda96d9f4e919e8b92

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/python
  digest    sha256:57e5a74e5ab3d74c67510c19500daf5fcc26358cc92bdafda96d9f4e919e8b92
  states    15 component(s) are inside this image
      bzip2                  1.0.8-6build2            pkg:deb/ubuntu/bzip2@1.0.8-6build2?distro=ubuntu-26.
      gdbm                   1.26-1build1             pkg:deb/ubuntu/gdbm@1.26-1build1?distro=ubuntu-26.04
      libffi                 3.5.2-4                  pkg:deb/ubuntu/libffi@3.5.2-4?distro=ubuntu-26.04
      libzstd                1.5.7+dfsg-3             pkg:deb/ubuntu/libzstd@1.5.7%2Bdfsg-3?distro=ubuntu-
      mpdecimal              4.0.1-6                  pkg:deb/ubuntu/mpdecimal@4.0.1-6?distro=ubuntu-26.04
      ncurses                6.6+20251231-1           pkg:deb/ubuntu/ncurses@6.6%2B20251231-1?distro=ubunt
      openssl                3.5.5-1ubuntu3.4         pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.4?distro=ubunt
      python                 3.11.16                  pkg:generic/python@3.11.16
      readline               8.3-4                    pkg:deb/ubuntu/readline@8.3-4?distro=ubuntu-26.04
      sqlite3                3.46.1-9ubuntu0.2        pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.2?distro=ubun
      util-linux             2.41.3-3ubuntu2          pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2?distro=ubu
      xz-utils               5.8.3-1                  pkg:deb/ubuntu/xz-utils@5.8.3-1?distro=ubuntu-26.04
      ... and 3 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/python
  digest    sha256:57e5a74e5ab3d74c67510c19500daf5fcc26358cc92bdafda96d9f4e919e8b92
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      45 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/binutils
      apt-package        pkg:deb/ubuntu/ca-certificates
      apt-package        pkg:deb/ubuntu/curl
      apt-package        pkg:deb/ubuntu/file
      apt-package        pkg:deb/ubuntu/findutils
      apt-package        pkg:deb/ubuntu/g++
      apt-package        pkg:deb/ubuntu/gcc
      apt-package        pkg:deb/ubuntu/libbluetooth-dev
      apt-package        pkg:deb/ubuntu/libbz2-1.0
      apt-package        pkg:deb/ubuntu/libbz2-dev
      apt-package        pkg:deb/ubuntu/libdb-dev
      ... and 33 more
  sbom      sbom.json sha256:5fea19b975b63d5ec39254c649cb9978...