Attestations for
  ghcr.io/kapsl-sh/bandit@sha256:5aea85fb214d9986ac3335a2dab1acc8e8b7e221726dc3f9c79748cb86187ec3

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/bandit@sha256:5aea85fb214d9986ac3335a2dab1acc8e8b7e221726dc3f9c79748cb86187ec3

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/bandit
  digest    sha256:5aea85fb214d9986ac3335a2dab1acc8e8b7e221726dc3f9c79748cb86187ec3
  states    10 component(s) are inside this image
      bandit                 1.9.4                    pkg:pypi/bandit@1.9.4
      gitdb                  4.0.12                   pkg:pypi/gitdb@4.0.12
      gitpython              3.1.60                   pkg:pypi/gitpython@3.1.60
      markdown-it-py         4.2.0                    pkg:pypi/markdown-it-py@4.2.0
      mdurl                  0.1.2                    pkg:pypi/mdurl@0.1.2
      pygments               2.21.0                   pkg:pypi/pygments@2.21.0
      pyyaml                 6.0.3                    pkg:pypi/pyyaml@6.0.3
      rich                   15.0.0                   pkg:pypi/rich@15.0.0
      smmap                  5.0.3                    pkg:pypi/smmap@5.0.3
      stevedore              5.9.1                    pkg:pypi/stevedore@5.9.1

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/bandit
  digest    sha256:5aea85fb214d9986ac3335a2dab1acc8e8b7e221726dc3f9c79748cb86187ec3
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.14
  sbom      sbom.json sha256:86b4baded3240e77b218d2de8596b276...