Attestations for
  ghcr.io/kapsl-sh/mkdocs@sha256:0add33e6a1b9e9c64d099c5fd05a29081bbb45df44aad93ed79b2b926cb0a964

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/mkdocs@sha256:0add33e6a1b9e9c64d099c5fd05a29081bbb45df44aad93ed79b2b926cb0a964

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/mkdocs
  digest    sha256:0add33e6a1b9e9c64d099c5fd05a29081bbb45df44aad93ed79b2b926cb0a964
  states    16 component(s) are inside this image
      click                  8.5.0                    pkg:pypi/click@8.5.0
      ghp-import             2.1.0                    pkg:pypi/ghp-import@2.1.0
      jinja2                 3.1.6                    pkg:pypi/jinja2@3.1.6
      markdown               3.10.3                   pkg:pypi/markdown@3.10.3
      markupsafe             3.0.3                    pkg:pypi/markupsafe@3.0.3
      mergedeep              1.3.4                    pkg:pypi/mergedeep@1.3.4
      mkdocs                 1.6.1                    pkg:pypi/mkdocs@1.6.1
      mkdocs-get-deps        0.2.2                    pkg:pypi/mkdocs-get-deps@0.2.2
      packaging              26.3                     pkg:pypi/packaging@26.3
      pathspec               1.1.1                    pkg:pypi/pathspec@1.1.1
      platformdirs           4.11.4                   pkg:pypi/platformdirs@4.11.4
      python-dateutil        2.9.0.post0              pkg:pypi/python-dateutil@2.9.0.post0
      ... and 4 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/mkdocs
  digest    sha256:0add33e6a1b9e9c64d099c5fd05a29081bbb45df44aad93ed79b2b926cb0a964
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.14
  sbom      sbom.json sha256:16cffc918116728b611f3ca290b70824...