Attestations for
  ghcr.io/kapsl-sh/uv@sha256:0fa3c29e0ec71d8b3ed3b90a44cc3e0c3000e59851e2b045d4492f10d2c35421

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/uv@sha256:0fa3c29e0ec71d8b3ed3b90a44cc3e0c3000e59851e2b045d4492f10d2c35421

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/uv
  digest    sha256:0fa3c29e0ec71d8b3ed3b90a44cc3e0c3000e59851e2b045d4492f10d2c35421
  states    672 component(s) are inside this image
      adler2                 2.0.1                    pkg:cargo/adler2@2.0.1
      aes                    0.8.4                    pkg:cargo/aes@0.8.4
      aho-corasick           1.1.4                    pkg:cargo/aho-corasick@1.1.4
      allocator-api2         0.2.21                   pkg:cargo/allocator-api2@0.2.21
      ambient-authority      0.0.2                    pkg:cargo/ambient-authority@0.0.2
      ambient-id             0.0.11                   pkg:cargo/ambient-id@0.0.11
      anstream               1.0.0                    pkg:cargo/anstream@1.0.0
      anstyle                1.0.14                   pkg:cargo/anstyle@1.0.14
      anstyle-parse          1.0.0                    pkg:cargo/anstyle-parse@1.0.0
      anstyle-query          1.1.5                    pkg:cargo/anstyle-query@1.1.5
      anyhow                 1.0.104                  pkg:cargo/anyhow@1.0.104
      archive-trait          0.0.13                   pkg:cargo/archive-trait@0.0.13
      ... and 660 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/uv
  digest    sha256:0fa3c29e0ec71d8b3ed3b90a44cc3e0c3000e59851e2b045d4492f10d2c35421
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      7 resolved input(s)
      release-asset-x86_64 https://github.com/astral-sh/uv/releases/download/0.12.6/uv-{rus
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:binutils
      composed-image     compose:cc
      composed-image     compose:gcc
      composed-image     compose:git
      composed-image     compose:python
  sbom      sbom.json sha256:c43e90c048e95c418f552a8d9b84a1b8...