Attestations for
  ghcr.io/kapsl-sh/yarn@sha256:100251ca798e5efa583c0c2332c04b1045cee9bdc4eef0e446a279beb3035362

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/yarn@sha256:100251ca798e5efa583c0c2332c04b1045cee9bdc4eef0e446a279beb3035362

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/yarn
  digest    sha256:100251ca798e5efa583c0c2332c04b1045cee9bdc4eef0e446a279beb3035362
  states    250 component(s) are inside this image
      yarn                   1.22.22                  pkg:npm/yarn@1.22.22
      @zkochan/cmd-shim      3.1.0                    pkg:npm/@zkochan/cmd-shim@3.1.0
      ajv                    5.5.2                    pkg:npm/ajv@5.5.2
      ansi-escapes           3.1.0                    pkg:npm/ansi-escapes@3.1.0
      ansi-regex             2.1.1                    pkg:npm/ansi-regex@2.1.1
      ansi-regex             3.0.0                    pkg:npm/ansi-regex@3.0.0
      ansi-styles            3.2.1                    pkg:npm/ansi-styles@3.2.1
      any-promise            1.3.0                    pkg:npm/any-promise@1.3.0
      argparse               1.0.10                   pkg:npm/argparse@1.0.10
      arr-diff               2.0.0                    pkg:npm/arr-diff@2.0.0
      arr-flatten            1.1.0                    pkg:npm/arr-flatten@1.1.0
      array-find-index       1.0.2                    pkg:npm/array-find-index@1.0.2
      ... and 238 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/yarn
  digest    sha256:100251ca798e5efa583c0c2332c04b1045cee9bdc4eef0e446a279beb3035362
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      6 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:bash
      composed-image     compose:env
      composed-image     compose:node
      composed-image     compose:node@26
      composed-image     compose:npm
  sbom      sbom.json sha256:419697fe2abf08ad0f70e8f5a316e3c5...