Attestations for
  ghcr.io/kapsl-sh/pylint@sha256:35cf6dbe11a9025d664c61cc76b35710650e8a4dc635c187759ee044035c7d35

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/pylint@sha256:35cf6dbe11a9025d664c61cc76b35710650e8a4dc635c187759ee044035c7d35

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/pylint
  digest    sha256:35cf6dbe11a9025d664c61cc76b35710650e8a4dc635c187759ee044035c7d35
  states    7 component(s) are inside this image
      astroid                4.0.4                    pkg:pypi/astroid@4.0.4
      dill                   0.4.1                    pkg:pypi/dill@0.4.1
      isort                  8.0.1                    pkg:pypi/isort@8.0.1
      mccabe                 0.7.0                    pkg:pypi/mccabe@0.7.0
      platformdirs           4.11.4                   pkg:pypi/platformdirs@4.11.4
      pylint                 4.0.7                    pkg:pypi/pylint@4.0.7
      tomlkit                0.15.1                   pkg:pypi/tomlkit@0.15.1

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/pylint
  digest    sha256:35cf6dbe11a9025d664c61cc76b35710650e8a4dc635c187759ee044035c7d35
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      2 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:python@3.14
  sbom      sbom.json sha256:75d06e7fa3f19db1c03fd282836ba63b...