Attestations for
  ghcr.io/kapsl-sh/nvi@sha256:a9b60af7cbbd9b38900fd34413e77a76e4f99bb9a007f08b1f9902f35ef0b150

Signed at seal time, arm64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/nvi@sha256:a9b60af7cbbd9b38900fd34413e77a76e4f99bb9a007f08b1f9902f35ef0b150

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:a2d55633f9be65532393df8387ad2bf8e3293cecf069b51e7a23372152ca3e0c  (2061 bytes)
  signature  sha256:ba1c74f58120dce2203693de18175fb5a6ff1517ab11a0672e1373a7b6264e13  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:33bf063e5b69510ea60fbba727b088fe1edebfcd00c602ba67e239f2e4fb5fef  (4214 bytes)
  signature  sha256:60101ef8c6b38da1e586df0c28854168bd9ae15b5a80e4dbfe0cbd29f4f26180  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:c2863a54c2de54e8b5604814b783a103bf2080adffe17ec73bce56ffb17110be  (226 bytes)
  signature  sha256:e43cf3d815418f5f1f7248b0cd93e01e4d17ee4ef0c7e561739bec9ccb3ed823  (vex.json.sigstore)