Attestations for
  ghcr.io/kapsl-sh/openssh-sftp@sha256:f58fbc757ab2417d1a03f6f8ea19600d08f2396e7bbc1ee1052bcf5289ced86d

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/openssh-sftp@sha256:f58fbc757ab2417d1a03f6f8ea19600d08f2396e7bbc1ee1052bcf5289ced86d

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/openssh-sftp
  digest    sha256:f58fbc757ab2417d1a03f6f8ea19600d08f2396e7bbc1ee1052bcf5289ced86d
  states    5 component(s) are inside this image
      libbsd                 0.12.2-2build2           pkg:deb/ubuntu/libbsd@0.12.2-2build2?distro=ubuntu-2
      libedit                3.1-20251016-1           pkg:deb/ubuntu/libedit@3.1-20251016-1?distro=ubuntu-
      libmd                  1.1.0-2build4            pkg:deb/ubuntu/libmd@1.1.0-2build4?distro=ubuntu-26.
      ncurses                6.6+20251231-1           pkg:deb/ubuntu/ncurses@6.6%2B20251231-1?distro=ubunt
      openssh                1:10.2p1-2ubuntu3.5      pkg:deb/ubuntu/openssh@1%3A10.2p1-2ubuntu3.5?distro=

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/openssh-sftp
  digest    sha256:f58fbc757ab2417d1a03f6f8ea19600d08f2396e7bbc1ee1052bcf5289ced86d
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/openssh-client@1:10.2p1-2ubuntu3.5?arch=arm64
  sbom      sbom.json sha256:755ffefff618675578b5541b5a6d39f5...