Attestations for
  ghcr.io/kapsl-sh/haskell-ghc@sha256:db79555aa6600fdecdb2312e8467660397530b1f82a82219d77d5ca3f383732b

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/haskell-ghc@sha256:db79555aa6600fdecdb2312e8467660397530b1f82a82219d77d5ca3f383732b

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/haskell-ghc
  digest    sha256:db79555aa6600fdecdb2312e8467660397530b1f82a82219d77d5ca3f383732b
  states    4 component(s) are inside this image
      gmp                    2:6.3.0+dfsg-5ubuntu2    pkg:deb/ubuntu/gmp@2%3A6.3.0%2Bdfsg-5ubuntu2?distro=
      haskell/ghc            9.14.1                   pkg:generic/haskell/ghc@9.14.1
      ncurses                6.6+20251231-1           pkg:deb/ubuntu/ncurses@6.6%2B20251231-1?distro=ubunt
      haskell                9.14.1                   cpe:2.3:a:haskell:glasgow_haskell_compiler:9.14.1:*:

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/haskell-ghc
  digest    sha256:db79555aa6600fdecdb2312e8467660397530b1f82a82219d77d5ca3f383732b
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      7 resolved input(s)
      release-asset-aarch64 https://downloads.haskell.org/~ghc/9.14.1/ghc-9.14.1-{uname_arch
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:gcc
      apt-package        pkg:deb/ubuntu/libgmp-dev@2:6.3.0+dfsg-5ubuntu2?arch=arm64
      apt-package        pkg:deb/ubuntu/libgmp10@2:6.3.0+dfsg-5ubuntu2?arch=arm64
      apt-package        pkg:deb/ubuntu/libncurses-dev@6.6+20251231-1?arch=arm64
      apt-package        pkg:deb/ubuntu/libtinfo6@6.6+20251231-1?arch=arm64
  sbom      sbom.json sha256:7fb1dd31a8b1334168768958d08392f7...