Attestations for
  ghcr.io/kapsl-sh/go-gofmt@sha256:9cdd635970fd0de0f411633ef82d6f9211bade95c9fb85b79c306a6fbc680ff3

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/go-gofmt@sha256:9cdd635970fd0de0f411633ef82d6f9211bade95c9fb85b79c306a6fbc680ff3

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/go-gofmt
  digest    sha256:9cdd635970fd0de0f411633ef82d6f9211bade95c9fb85b79c306a6fbc680ff3
  states    2 component(s) are inside this image
      stdlib                 go1.27.0                 pkg:golang/stdlib@1.27.0
      go                     1.27.0                   cpe:2.3:a:golang:go:1.27.0:*:*:*:*:*:*:*

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/go-gofmt
  digest    sha256:9cdd635970fd0de0f411633ef82d6f9211bade95c9fb85b79c306a6fbc680ff3
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      3 resolved input(s)
      release-asset-aarch64 https://go.dev/dl/go1.27.0.linux-{goarch}.tar.gz
      release-asset-aarch64 https://go.dev/dl/go1.27.0.linux-{goarch}.tar.gz
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
  sbom      sbom.json sha256:300ecf92b0b64dc4b96e2ad919b393cf...