Attestations for
  ghcr.io/kapsl-sh/nodejs@sha256:5f0f73ca25049072caaec0206b90ac453a2a32aec3595bb1183d2d717dddfd71

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/nodejs@sha256:5f0f73ca25049072caaec0206b90ac453a2a32aec3595bb1183d2d717dddfd71

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/nodejs
  digest    sha256:5f0f73ca25049072caaec0206b90ac453a2a32aec3595bb1183d2d717dddfd71
  states    10 component(s) are inside this image
      brotli                 1.2.0-3build1            pkg:deb/ubuntu/brotli@1.2.0-3build1?distro=ubuntu-26
      c-ares                 1.34.6-1                 pkg:deb/ubuntu/c-ares@1.34.6-1?distro=ubuntu-26.04
      libzstd                1.5.7+dfsg-3             pkg:deb/ubuntu/libzstd@1.5.7%2Bdfsg-3?distro=ubuntu-
      nghttp2                1.68.0-2ubuntu0.2        pkg:deb/ubuntu/nghttp2@1.68.0-2ubuntu0.2?distro=ubun
      node                   26.8.0                   pkg:generic/node@26.8.0
      openssl                3.5.5-1ubuntu3.4         pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.4?distro=ubunt
      sqlite3                3.46.1-9ubuntu0.2        pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.2?distro=ubun
      zlib                   1:1.3.dfsg+really1.3.1-1ubuntu3 pkg:deb/ubuntu/zlib@1%3A1.3.dfsg%2Breally1.3.1-1ubun
      nodejs                 26.8.0                   cpe:2.3:a:nodejs:node.js:26.8.0:*:*:*:*:*:*:*
      icu                    78.3                     cpe:2.3:a:unicode:international_components_for_unico

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/nodejs
  digest    sha256:5f0f73ca25049072caaec0206b90ac453a2a32aec3595bb1183d2d717dddfd71
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      29 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/binutils
      apt-package        pkg:deb/ubuntu/ca-certificates
      apt-package        pkg:deb/ubuntu/curl
      apt-package        pkg:deb/ubuntu/file
      apt-package        pkg:deb/ubuntu/findutils
      apt-package        pkg:deb/ubuntu/g++
      apt-package        pkg:deb/ubuntu/libbrotli-dev
      apt-package        pkg:deb/ubuntu/libbrotli1
      apt-package        pkg:deb/ubuntu/libc-ares-dev
      apt-package        pkg:deb/ubuntu/libcares2
      apt-package        pkg:deb/ubuntu/libnghttp2-14
      ... and 17 more
  sbom      sbom.json sha256:662733e05889e7986bd20543def8dedc...