Attestations for
  ghcr.io/kapsl-sh/php@sha256:6ebb7e33c42a5950c063d8baee9f60d06839338c2b4e0c49416efd3c9b349de2

Signed at seal time, amd64. Each document below was signed before
this seal existed: an unsigned one is refused rather than published.

Verify against the registry yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/php@sha256:6ebb7e33c42a5950c063d8baee9f60d06839338c2b4e0c49416efd3c9b349de2

=== receipt.json ============================================
  predicate  https://slsa.dev/provenance/v1
  document   sha256:ca189d162e86e76abf91c83a003d526b2385fdf566e04f01b8234fe5683ad364  (9370 bytes)
  signature  sha256:a306a26eed76c0886b8f95a4793a7aa8b86b7edb10444061d8e146800ed43029  (receipt.json.sigstore)

=== sbom.json ===============================================
  predicate  cyclonedx
  document   sha256:aec372d04b38fe283a07cfce35c88abee42eda52053e743bc85308646a1b7f45  (160973 bytes)
  signature  sha256:dc21e1e202c5b36f41f74eef70b23fb9e6c338e6391e6f034897f0a88098ff46  (sbom.json.sigstore)

=== vex.json ================================================
  predicate  https://openvex.dev/ns/v0.2.0
  document   sha256:e5ff7f127e0fc34d5976993d266278e87430e05033759d33e1c39d35849bac43  (3573 bytes)
  signature  sha256:e21b5a93942a19a60d3fa9364a204c2a8f1c5f88667058fcfbe2afbea65f0ed9  (vex.json.sigstore)