Attestations for
  ghcr.io/kapsl-sh/ripgrep@sha256:68a46ff12f856b3a4ee7502ffc727e968aed05fb3eee3c333348a24afe40dfa0

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/ripgrep@sha256:68a46ff12f856b3a4ee7502ffc727e968aed05fb3eee3c333348a24afe40dfa0

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/ripgrep
  digest    sha256:68a46ff12f856b3a4ee7502ffc727e968aed05fb3eee3c333348a24afe40dfa0
  states    54 component(s) are inside this image
      ripgrep                15.2.0                   pkg:cargo/ripgrep@15.2.0
      aho-corasick           1.1.4                    pkg:cargo/aho-corasick@1.1.4
      anyhow                 1.0.103                  pkg:cargo/anyhow@1.0.103
      bstr                   1.13.0                   pkg:cargo/bstr@1.13.0
      cc                     1.2.67                   pkg:cargo/cc@1.2.67
      cfg-if                 1.0.4                    pkg:cargo/cfg-if@1.0.4
      crossbeam-deque        0.8.7                    pkg:cargo/crossbeam-deque@0.8.7
      crossbeam-epoch        0.9.20                   pkg:cargo/crossbeam-epoch@0.9.20
      crossbeam-utils        0.8.22                   pkg:cargo/crossbeam-utils@0.8.22
      encoding_rs            0.8.35                   pkg:cargo/encoding_rs@0.8.35
      encoding_rs_io         0.1.7                    pkg:cargo/encoding_rs_io@0.1.7
      find-msvc-tools        0.1.9                    pkg:cargo/find-msvc-tools@0.1.9
      ... and 42 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/ripgrep
  digest    sha256:68a46ff12f856b3a4ee7502ffc727e968aed05fb3eee3c333348a24afe40dfa0
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      3 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:cargo
      apt-package        pkg:deb/ubuntu/libgcc-s1@16-20260322-1ubuntu1?arch=arm64
  sbom      sbom.json sha256:e81e78b0c0c91c30d899d80f253c92f2...