Attestations for
  ghcr.io/kapsl-sh/flake8@sha256:9f51fd4eaf260f7219572d1a1ae8da942b34bf3db820ad436ce52f62818a9e8b

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/flake8@sha256:9f51fd4eaf260f7219572d1a1ae8da942b34bf3db820ad436ce52f62818a9e8b

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/flake8
  digest    sha256:9f51fd4eaf260f7219572d1a1ae8da942b34bf3db820ad436ce52f62818a9e8b
  states    4 component(s) are inside this image
      flake8                 7.3.0                    pkg:pypi/flake8@7.3.0
      mccabe                 0.7.0                    pkg:pypi/mccabe@0.7.0
      pycodestyle            2.14.0                   pkg:pypi/pycodestyle@2.14.0
      pyflakes               3.4.0                    pkg:pypi/pyflakes@3.4.0

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/flake8
  digest    sha256:9f51fd4eaf260f7219572d1a1ae8da942b34bf3db820ad436ce52f62818a9e8b
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.14
  sbom      sbom.json sha256:c52ee38dc0f8f698934811b37f0669e1...