Attestations for
  ghcr.io/kapsl-sh/composer@sha256:60efe2b2beb21326a1399dab3b6d7dc9bf85e3a77cba306a54bf32d598fc830b

Signed at seal time, arm64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/composer@sha256:60efe2b2beb21326a1399dab3b6d7dc9bf85e3a77cba306a54bf32d598fc830b

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:56ddc5c10cc6a91cacbb312fe0e6d17ee315e573d504494db6b5b9e76cea0338  (2660 bytes)
  signature  sha256:c721e828431413fbdc8cb2a8c60ac7c4abf36d553879b8f57e3bfcda9f2e2852  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:c82e0484dc989c88577ccbb8d4f149d55206f46e59a5354a1ee6569a2b1f7444  (55180 bytes)
  signature  sha256:0b52f4857510b935c7cab2be314fec0a45ad82098d35feca1331c45bdc96c552  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:e97ec9454d228732f72982409ecadf84a59d6829b7cb73223fd423b1af5f08cd  (231 bytes)
  signature  sha256:4d9c81f62777dc4c44c4d470ee9d6527bbfbe01e0ac96d76a6dbbdf5d5b403dd  (vex.json.sigstore)