Attestations for
  ghcr.io/kapsl-sh/flake8@sha256:f3ccf1fb18e55d71aeb0e0c54f1ed9eb1030b4238b86c35348be1671dec7a1db

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/flake8@sha256:f3ccf1fb18e55d71aeb0e0c54f1ed9eb1030b4238b86c35348be1671dec7a1db

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/flake8
  digest    sha256:f3ccf1fb18e55d71aeb0e0c54f1ed9eb1030b4238b86c35348be1671dec7a1db
  states    4 component(s) are inside this image
      flake8                 7.3.0                    pkg:pypi/flake8@7.3.0
      mccabe                 0.7.0                    pkg:pypi/mccabe@0.7.0
      pycodestyle            2.14.0                   pkg:pypi/pycodestyle@2.14.0
      pyflakes               3.4.0                    pkg:pypi/pyflakes@3.4.0

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/flake8
  digest    sha256:f3ccf1fb18e55d71aeb0e0c54f1ed9eb1030b4238b86c35348be1671dec7a1db
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.14
  sbom      sbom.json sha256:de9a2e0a48ca281058759fefdf7fe05f...