Attestations for
  ghcr.io/kapsl-sh/grype@sha256:d4997cb28a62f1f878f1267e494da63bc4865d2c570ecb507f35b30478be08d5

Signed at seal time, amd64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/grype@sha256:d4997cb28a62f1f878f1267e494da63bc4865d2c570ecb507f35b30478be08d5

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:34b2818c052587679e88c74ba6b1b4e838822c2e3368d5a7f8f3e5ac97b305fa  (2046 bytes)
  signature  sha256:71ea486013586a47ac146c76392de7823cf12d8b64fb38a722b7f1e300687bf2  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:d474e1700ee38e1ff5fdd1d7bfc9dba99644344483cd9538ff8f9243434ef31d  (495943 bytes)
  signature  sha256:81525a7b1be63703e24a5b6df1913ce5b02db412c6cad4a4a8ce97cc4fa075b5  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:2db104896c6e99e52ec8d31e09b8f7884b6eb9fba81714b65cc089c2b4d0a086  (228 bytes)
  signature  sha256:caf59192e84f8eb92ddaa9fc7904d64ef0add77dec8f19d44eab1c350aeca4b9  (vex.json.sigstore)