Attestations for
  ghcr.io/kapsl-sh/grype@sha256:8c9eb685534a7d5eb23908d6c716356aed066615edee99d9845f217adb100326

Signed at seal time, arm64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/grype@sha256:8c9eb685534a7d5eb23908d6c716356aed066615edee99d9845f217adb100326

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:e967667244b377d302d8c410038f8e91f1d67a25afbd8b2b08f7b7ed91451068  (2046 bytes)
  signature  sha256:9d09c671fecda8bf048cdf527e9d52d8a7d16c6224db3df4b6ce6f2309299b74  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:bae233d6d67899c1ea99f940c4f580c4c9de516eaf71d7576561ec43d91e27e4  (495943 bytes)
  signature  sha256:dac2bcd8e8e1fb15dca11c12e3a0650b1c3671c116cbe540c5107cf7d6cb0d09  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:557998062b5f35bb7279037f88f21a3e07b27597a1e0b6f99d87f2628eb4850d  (228 bytes)
  signature  sha256:2dbe08ab657c24532b2ec87481b22048e86dd55cfe87149307bb39f8f6521d84  (vex.json.sigstore)