Attestations for
  ghcr.io/kapsl-sh/perl@sha256:c10c919f4be75174a1a1a25a29a501dee5b251bbb245afad19e112c3e8d54426

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/perl@sha256:c10c919f4be75174a1a1a25a29a501dee5b251bbb245afad19e112c3e8d54426

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/perl
  digest    sha256:c10c919f4be75174a1a1a25a29a501dee5b251bbb245afad19e112c3e8d54426
  states    3 component(s) are inside this image
      perl                   5.44.0                   cpe:2.3:a:perl:perl:5.44.0:*:*:*:*:*:*:*
      zlib                   1.3.2                    cpe:2.3:a:zlib:zlib:1.3.2:*:*:*:*:*:*:*
      bzip2                  1.0.8                    cpe:2.3:a:bzip:bzip2:1.0.8:*:*:*:*:*:*:*

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/perl
  digest    sha256:c10c919f4be75174a1a1a25a29a501dee5b251bbb245afad19e112c3e8d54426
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      14 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      apt-package        pkg:deb/ubuntu/binutils@2.46-3ubuntu2?arch=amd64
      apt-package        pkg:deb/ubuntu/ca-certificates@20260601~26.04.1?arch=amd64
      apt-package        pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.4?arch=amd64
      apt-package        pkg:deb/ubuntu/file@1:5.46-5build2?arch=amd64
      apt-package        pkg:deb/ubuntu/findutils@4.10.0-3build2?arch=amd64
      apt-package        pkg:deb/ubuntu/gcc@4:15.2.0-5ubuntu1?arch=amd64
      apt-package        pkg:deb/ubuntu/libc6-dev@2.43-2ubuntu2.3?arch=amd64
      apt-package        pkg:deb/ubuntu/libcrypt-dev@1:4.5.1-1?arch=amd64
      apt-package        pkg:deb/ubuntu/make@4.4.1-3?arch=amd64
      apt-package        pkg:deb/ubuntu/patch@2.8-2build1?arch=amd64
      apt-package        pkg:deb/ubuntu/patchelf@0.18.0-1.4build1?arch=amd64
      ... and 2 more
  sbom      sbom.json sha256:3cfa6cc3f18c48a4ac789d5ffcf5e4a3...