Attestations for
  ghcr.io/kapsl-sh/perl@sha256:961b5c51c35e44054113a9ac31fb7b66a30cce1050804e080842a3039f991b9d

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/perl@sha256:961b5c51c35e44054113a9ac31fb7b66a30cce1050804e080842a3039f991b9d

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/perl
  digest    sha256:961b5c51c35e44054113a9ac31fb7b66a30cce1050804e080842a3039f991b9d
  states    3 component(s) are inside this image
      perl                   5.40.5                   cpe:2.3:a:perl:perl:5.40.5:*:*:*:*:*:*:*
      zlib                   1.3.2                    cpe:2.3:a:zlib:zlib:1.3.2:*:*:*:*:*:*:*
      bzip2                  1.0.8                    cpe:2.3:a:bzip:bzip2:1.0.8:*:*:*:*:*:*:*

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/perl
  digest    sha256:961b5c51c35e44054113a9ac31fb7b66a30cce1050804e080842a3039f991b9d
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      14 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/binutils@2.46-3ubuntu2?arch=amd64
      apt-package        pkg:deb/ubuntu/ca-certificates@20260601~26.04.1?arch=amd64
      apt-package        pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.4?arch=amd64
      apt-package        pkg:deb/ubuntu/file@1:5.46-5build2?arch=amd64
      apt-package        pkg:deb/ubuntu/findutils@4.10.0-3build2?arch=amd64
      apt-package        pkg:deb/ubuntu/gcc@4:15.2.0-5ubuntu1?arch=amd64
      apt-package        pkg:deb/ubuntu/libc6-dev@2.43-2ubuntu2.3?arch=amd64
      apt-package        pkg:deb/ubuntu/libcrypt-dev@1:4.5.1-1?arch=amd64
      apt-package        pkg:deb/ubuntu/make@4.4.1-3?arch=amd64
      apt-package        pkg:deb/ubuntu/patch@2.8-2build1?arch=amd64
      apt-package        pkg:deb/ubuntu/patchelf@0.18.0-1.4build1?arch=amd64
      ... and 2 more
  sbom      sbom.json sha256:b8c2ccbec0626868fe8c486a6a74f0b6...