Attestations for
  ghcr.io/kapsl-sh/perl@sha256:91a3f71c01f23f3fe0d9b8c890942db7d650b38e02491aafbf11a854288266b3

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/perl@sha256:91a3f71c01f23f3fe0d9b8c890942db7d650b38e02491aafbf11a854288266b3

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/perl
  digest    sha256:91a3f71c01f23f3fe0d9b8c890942db7d650b38e02491aafbf11a854288266b3
  states    3 component(s) are inside this image
      perl                   5.42.3                   cpe:2.3:a:perl:perl:5.42.3:*:*:*:*:*:*:*
      zlib                   1.3.2                    cpe:2.3:a:zlib:zlib:1.3.2:*:*:*:*:*:*:*
      bzip2                  1.0.8                    cpe:2.3:a:bzip:bzip2:1.0.8:*:*:*:*:*:*:*

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/perl
  digest    sha256:91a3f71c01f23f3fe0d9b8c890942db7d650b38e02491aafbf11a854288266b3
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      14 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/binutils@2.46-3ubuntu2?arch=amd64
      apt-package        pkg:deb/ubuntu/ca-certificates@20260601~26.04.1?arch=amd64
      apt-package        pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.4?arch=amd64
      apt-package        pkg:deb/ubuntu/file@1:5.46-5build2?arch=amd64
      apt-package        pkg:deb/ubuntu/findutils@4.10.0-3build2?arch=amd64
      apt-package        pkg:deb/ubuntu/gcc@4:15.2.0-5ubuntu1?arch=amd64
      apt-package        pkg:deb/ubuntu/libc6-dev@2.43-2ubuntu2.3?arch=amd64
      apt-package        pkg:deb/ubuntu/libcrypt-dev@1:4.5.1-1?arch=amd64
      apt-package        pkg:deb/ubuntu/make@4.4.1-3?arch=amd64
      apt-package        pkg:deb/ubuntu/patch@2.8-2build1?arch=amd64
      apt-package        pkg:deb/ubuntu/patchelf@0.18.0-1.4build1?arch=amd64
      ... and 2 more
  sbom      sbom.json sha256:e243b84c6a054a781543155b8a878643...