Attestations for
  ghcr.io/kapsl-sh/nodejs@sha256:0af69ff1716fb2554d14d48237f5344bd2a687b8c053ed6a71f60818ad383e4e

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/nodejs@sha256:0af69ff1716fb2554d14d48237f5344bd2a687b8c053ed6a71f60818ad383e4e

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/nodejs
  digest    sha256:0af69ff1716fb2554d14d48237f5344bd2a687b8c053ed6a71f60818ad383e4e
  states    11 component(s) are inside this image
      brotli                 1.2.0-3build1            pkg:deb/ubuntu/brotli@1.2.0-3build1?distro=ubuntu-26
      c-ares                 1.34.6-1                 pkg:deb/ubuntu/c-ares@1.34.6-1?distro=ubuntu-26.04
      corepack               0.35.0                   pkg:npm/corepack@0.35.0
      libzstd                1.5.7+dfsg-3             pkg:deb/ubuntu/libzstd@1.5.7%2Bdfsg-3?distro=ubuntu-
      nghttp2                1.68.0-2ubuntu0.2        pkg:deb/ubuntu/nghttp2@1.68.0-2ubuntu0.2?distro=ubun
      node                   24.20.0                  pkg:generic/node@24.20.0
      openssl                3.5.5-1ubuntu3.4         pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.4?distro=ubunt
      sqlite3                3.46.1-9ubuntu0.2        pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.2?distro=ubun
      zlib                   1:1.3.dfsg+really1.3.1-1ubuntu3 pkg:deb/ubuntu/zlib@1%3A1.3.dfsg%2Breally1.3.1-1ubun
      nodejs                 24.20.0                  cpe:2.3:a:nodejs:node.js:24.20.0:*:*:*:*:*:*:*
      icu                    78.3                     cpe:2.3:a:unicode:international_components_for_unico

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/nodejs
  digest    sha256:0af69ff1716fb2554d14d48237f5344bd2a687b8c053ed6a71f60818ad383e4e
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      29 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/binutils
      apt-package        pkg:deb/ubuntu/ca-certificates
      apt-package        pkg:deb/ubuntu/curl
      apt-package        pkg:deb/ubuntu/file
      apt-package        pkg:deb/ubuntu/findutils
      apt-package        pkg:deb/ubuntu/g++
      apt-package        pkg:deb/ubuntu/libbrotli-dev
      apt-package        pkg:deb/ubuntu/libbrotli1
      apt-package        pkg:deb/ubuntu/libc-ares-dev
      apt-package        pkg:deb/ubuntu/libcares2
      apt-package        pkg:deb/ubuntu/libnghttp2-14
      ... and 17 more
  sbom      sbom.json sha256:078d10fb666b52dc63db8127cbff710a...