Attestations for
  ghcr.io/kapsl-sh/syft@sha256:61b3ba1f875c06f8e73caf80a64482104356056bdae53bc76555fd861d002835

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/syft@sha256:61b3ba1f875c06f8e73caf80a64482104356056bdae53bc76555fd861d002835

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/syft
  digest    sha256:61b3ba1f875c06f8e73caf80a64482104356056bdae53bc76555fd861d002835
  states    276 component(s) are inside this image
      cel.dev/expr           v0.25.1                  pkg:golang/cel.dev/expr@v0.25.1
      cloud.google.com/go    v0.123.0                 pkg:golang/cloud.google.com/go@v0.123.0
      cloud.google.com/go/auth v0.18.2                  pkg:golang/cloud.google.com/go/auth@v0.18.2
      cloud.google.com/go/auth/oauth2adapt v0.2.8                   pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2
      cloud.google.com/go/compute/metadata v0.9.0                   pkg:golang/cloud.google.com/go/compute/metadata@v0.9
      cloud.google.com/go/iam v1.5.3                   pkg:golang/cloud.google.com/go/iam@v1.5.3
      cloud.google.com/go/monitoring v1.24.3                  pkg:golang/cloud.google.com/go/monitoring@v1.24.3
      cloud.google.com/go/storage v1.61.3                  pkg:golang/cloud.google.com/go/storage@v1.61.3
      dario.cat/mergo        v1.0.2                   pkg:golang/dario.cat/mergo@v1.0.2
      github.com/BurntSushi/toml v1.6.0                   pkg:golang/github.com/BurntSushi/toml@v1.6.0
      github.com/CycloneDX/cyclonedx-go v0.11.0                  pkg:golang/github.com/CycloneDX/cyclonedx-go@v0.11.0
      github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0                  pkg:golang/github.com/GoogleCloudPlatform/openteleme
      ... and 264 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/syft
  digest    sha256:61b3ba1f875c06f8e73caf80a64482104356056bdae53bc76555fd861d002835
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:go
  sbom      sbom.json sha256:61029477ce8a19e7cf7bd1bc90f4daef...