Attestations for
  ghcr.io/kapsl-sh/lua@sha256:671137281ebe1a80e745da4202617e899385ce562ff2a8ce31baf8ff858e1fc2

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/lua@sha256:671137281ebe1a80e745da4202617e899385ce562ff2a8ce31baf8ff858e1fc2

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/lua
  digest    sha256:671137281ebe1a80e745da4202617e899385ce562ff2a8ce31baf8ff858e1fc2
  states    3 component(s) are inside this image
      ncurses                6.6+20251231-1           pkg:deb/ubuntu/ncurses@6.6%2B20251231-1?distro=ubunt
      readline               8.3-4                    pkg:deb/ubuntu/readline@8.3-4?distro=ubuntu-26.04
      lua                    5.4.9                    cpe:2.3:a:lua:lua:5.4.9:*:*:*:*:*:*:*

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/lua
  digest    sha256:671137281ebe1a80e745da4202617e899385ce562ff2a8ce31baf8ff858e1fc2
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      15 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/binutils@2.46-3ubuntu2?arch=amd64
      apt-package        pkg:deb/ubuntu/ca-certificates@20260601~26.04.1?arch=amd64
      apt-package        pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.4?arch=amd64
      apt-package        pkg:deb/ubuntu/file@1:5.46-5build2?arch=amd64
      apt-package        pkg:deb/ubuntu/findutils@4.10.0-3build2?arch=amd64
      apt-package        pkg:deb/ubuntu/gcc@4:15.2.0-5ubuntu1?arch=amd64
      apt-package        pkg:deb/ubuntu/gzip@1.14-1~exp2ubuntu1.1?arch=amd64
      apt-package        pkg:deb/ubuntu/libc6-dev@2.43-2ubuntu2.3?arch=amd64
      apt-package        pkg:deb/ubuntu/libreadline-dev@8.3-4?arch=amd64
      apt-package        pkg:deb/ubuntu/libreadline8t64@8.3-4?arch=amd64
      apt-package        pkg:deb/ubuntu/libtinfo6@6.6+20251231-1?arch=amd64
      ... and 3 more
  sbom      sbom.json sha256:6b66234cf968688927a7be6fb2fc3074...