Attestations for
  ghcr.io/kapsl-sh/claude-code@sha256:0c0d852e7a8f9f0a5a04a1414f7ede8846434a91ba6bab0a4c27cfcb08c212a1

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/claude-code@sha256:0c0d852e7a8f9f0a5a04a1414f7ede8846434a91ba6bab0a4c27cfcb08c212a1

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/claude-code
  digest    sha256:0c0d852e7a8f9f0a5a04a1414f7ede8846434a91ba6bab0a4c27cfcb08c212a1
  states    2 component(s) are inside this image
      claude-code            2.1.246                  pkg:npm/@anthropic-ai/claude-code@2.1.246
      bun                    1.4.0                    pkg:npm/bun@1.4.0

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/claude-code
  digest    sha256:0c0d852e7a8f9f0a5a04a1414f7ede8846434a91ba6bab0a4c27cfcb08c212a1
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      17 resolved input(s)
      release-asset-aarch64 https://github.com/anthropics/claude-code/releases/download/v2.1
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:bash
      composed-image     compose:coreutils
      composed-image     compose:curl
      composed-image     compose:diffutils
      composed-image     compose:findutils
      composed-image     compose:gawk
      composed-image     compose:git
      composed-image     compose:grep
      composed-image     compose:gzip
      composed-image     compose:jq
      ... and 5 more
  sbom      sbom.json sha256:5c011809534f209fd9272b5b15792d46...