Attestations for
  ghcr.io/kapsl-sh/bandit@sha256:c23d87b34bdf7248ee3a1a87e4d8f13ea3d93518753976ad1f38e25797d493c2

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/bandit@sha256:c23d87b34bdf7248ee3a1a87e4d8f13ea3d93518753976ad1f38e25797d493c2

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/bandit
  digest    sha256:c23d87b34bdf7248ee3a1a87e4d8f13ea3d93518753976ad1f38e25797d493c2
  states    10 component(s) are inside this image
      bandit                 1.9.4                    pkg:pypi/bandit@1.9.4
      gitdb                  4.0.12                   pkg:pypi/gitdb@4.0.12
      gitpython              3.1.60                   pkg:pypi/gitpython@3.1.60
      markdown-it-py         4.2.0                    pkg:pypi/markdown-it-py@4.2.0
      mdurl                  0.1.2                    pkg:pypi/mdurl@0.1.2
      pygments               2.21.0                   pkg:pypi/pygments@2.21.0
      pyyaml                 6.0.3                    pkg:pypi/pyyaml@6.0.3
      rich                   15.0.0                   pkg:pypi/rich@15.0.0
      smmap                  5.0.3                    pkg:pypi/smmap@5.0.3
      stevedore              5.9.1                    pkg:pypi/stevedore@5.9.1

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/bandit
  digest    sha256:c23d87b34bdf7248ee3a1a87e4d8f13ea3d93518753976ad1f38e25797d493c2
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.14
  sbom      sbom.json sha256:28c34d4728949f0c8f0ed52c0885d6d7...