Attestations for
  ghcr.io/kapsl-sh/openssh-scp@sha256:22635d3fc3f5c6f39031688b23c1cb733dd97ff55b196b9d7e6eb6279411ee39

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/openssh-scp@sha256:22635d3fc3f5c6f39031688b23c1cb733dd97ff55b196b9d7e6eb6279411ee39

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/openssh-scp
  digest    sha256:22635d3fc3f5c6f39031688b23c1cb733dd97ff55b196b9d7e6eb6279411ee39
  states    1 component(s) are inside this image
      openssh                1:10.2p1-2ubuntu3.5      pkg:deb/ubuntu/openssh@1%3A10.2p1-2ubuntu3.5?distro=

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/openssh-scp
  digest    sha256:22635d3fc3f5c6f39031688b23c1cb733dd97ff55b196b9d7e6eb6279411ee39
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/openssh-client@1:10.2p1-2ubuntu3.5?arch=arm64
  sbom      sbom.json sha256:0f9d89cf7f69149e03858fc89b9ecb25...