Attestations for
  ghcr.io/kapsl-sh/haskell-ghc@sha256:54fe91651e89111129f677acd1b1d4934f209c8898241f6045f7a3606d02cc1c

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/haskell-ghc@sha256:54fe91651e89111129f677acd1b1d4934f209c8898241f6045f7a3606d02cc1c

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/haskell-ghc
  digest    sha256:54fe91651e89111129f677acd1b1d4934f209c8898241f6045f7a3606d02cc1c
  states    4 component(s) are inside this image
      gmp                    2:6.3.0+dfsg-5ubuntu2    pkg:deb/ubuntu/gmp@2%3A6.3.0%2Bdfsg-5ubuntu2?distro=
      haskell/ghc            9.14.1                   pkg:generic/haskell/ghc@9.14.1
      ncurses                6.6+20251231-1           pkg:deb/ubuntu/ncurses@6.6%2B20251231-1?distro=ubunt
      haskell                9.14.1                   cpe:2.3:a:haskell:glasgow_haskell_compiler:9.14.1:*:

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/haskell-ghc
  digest    sha256:54fe91651e89111129f677acd1b1d4934f209c8898241f6045f7a3606d02cc1c
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      7 resolved input(s)
      release-asset-x86_64 https://downloads.haskell.org/~ghc/9.14.1/ghc-9.14.1-{uname_arch
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:gcc
      apt-package        pkg:deb/ubuntu/libgmp-dev@2:6.3.0+dfsg-5ubuntu2?arch=amd64
      apt-package        pkg:deb/ubuntu/libgmp10@2:6.3.0+dfsg-5ubuntu2?arch=amd64
      apt-package        pkg:deb/ubuntu/libncurses-dev@6.6+20251231-1?arch=amd64
      apt-package        pkg:deb/ubuntu/libtinfo6@6.6+20251231-1?arch=amd64
  sbom      sbom.json sha256:290b001639a2c6b193c225ddaa5a10fc...