Attestations for
  ghcr.io/kapsl-sh/mypy@sha256:9e7d2f4d27103716e0d2657576535a0df47916d14399d19f0ba22d5fec1b86d1

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/mypy@sha256:9e7d2f4d27103716e0d2657576535a0df47916d14399d19f0ba22d5fec1b86d1

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/mypy
  digest    sha256:9e7d2f4d27103716e0d2657576535a0df47916d14399d19f0ba22d5fec1b86d1
  states    118 component(s) are inside this image
      ast-serialize          0.8.0                    pkg:pypi/ast-serialize@0.8.0
      autocommand            2.2.2                    pkg:pypi/autocommand@2.2.2
      backports-tarfile      1.2.0                    pkg:pypi/backports-tarfile@1.2.0
      cli                    UNKNOWN                  cpe:2.3:a:cli:cli:*:*:*:*:*:*:*:*
      cli-32                 UNKNOWN                  cpe:2.3:a:cli-32:cli-32:*:*:*:*:*:*:*:*
      cli-64                 UNKNOWN                  cpe:2.3:a:cli-64:cli-64:*:*:*:*:*:*:*:*
      cli-arm64              UNKNOWN                  cpe:2.3:a:cli-arm64:cli-arm64:*:*:*:*:*:*:*:*
      gui                    UNKNOWN                  cpe:2.3:a:gui:gui:*:*:*:*:*:*:*:*
      gui-32                 UNKNOWN                  cpe:2.3:a:gui-32:gui-32:*:*:*:*:*:*:*:*
      gui-64                 UNKNOWN                  cpe:2.3:a:gui-64:gui-64:*:*:*:*:*:*:*:*
      gui-arm64              UNKNOWN                  cpe:2.3:a:gui-arm64:gui-arm64:*:*:*:*:*:*:*:*
      importlib-metadata     8.7.1                    pkg:pypi/importlib-metadata@8.7.1
      ... and 106 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/mypy
  digest    sha256:9e7d2f4d27103716e0d2657576535a0df47916d14399d19f0ba22d5fec1b86d1
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.14
  sbom      sbom.json sha256:fcfa30fdde10e1a853e635733431dbe9...