Attestations for
  ghcr.io/boks-sh/github-cli@sha256:1202422c8a9d7152a83173d5ddcc299d59a8eca5732d87f651e01b21cf27700a

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/github-cli@sha256:1202422c8a9d7152a83173d5ddcc299d59a8eca5732d87f651e01b21cf27700a

=== cyclonedx ===================================================
  subject   ghcr.io/boks-sh/github-cli
  digest    sha256:1202422c8a9d7152a83173d5ddcc299d59a8eca5732d87f651e01b21cf27700a
  states    169 component(s) are inside this image
      charm.land/bubbles/v2  v2.1.1                   pkg:golang/charm.land/bubbles/v2@v2.1.1
      charm.land/bubbletea/v2 v2.0.8                   pkg:golang/charm.land/bubbletea/v2@v2.0.8
      charm.land/huh/v2      v2.0.3                   pkg:golang/charm.land/huh/v2@v2.0.3
      charm.land/lipgloss/v2 v2.0.5                   pkg:golang/charm.land/lipgloss/v2@v2.0.5
      dario.cat/mergo        v1.0.2                   pkg:golang/dario.cat/mergo@v1.0.2
      github.com/AlecAivazis/survey/v2 v2.3.7                   pkg:golang/github.com/AlecAivazis/survey/v2@v2.3.7
      github.com/MakeNowJust/heredoc v1.0.0                   pkg:golang/github.com/MakeNowJust/heredoc@v1.0.0
      github.com/Masterminds/goutils v1.1.1                   pkg:golang/github.com/Masterminds/goutils@v1.1.1
      github.com/Masterminds/semver/v3 v3.4.0                   pkg:golang/github.com/Masterminds/semver/v3@v3.4.0
      github.com/Masterminds/sprig/v3 v3.3.0                   pkg:golang/github.com/Masterminds/sprig/v3@v3.3.0
      github.com/alecthomas/chroma/v2 v2.19.0                  pkg:golang/github.com/alecthomas/chroma/v2@v2.19.0
      github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 pkg:golang/github.com/asaskevich/govalidator@v0.0.0-
      ... and 157 more

=== slsaprovenance ==============================================
  subject   ghcr.io/boks-sh/github-cli
  digest    sha256:1202422c8a9d7152a83173d5ddcc299d59a8eca5732d87f651e01b21cf27700a
  build     https://index.boks.sh/buildtype/v1
  builder   https://index.boks.sh
  from      3 resolved input(s)
      release-asset-aarch64 https://github.com/cli/cli/releases/download/v2.97.0/gh_2.97.0_l
      base-image         ghcr.io/boks-sh/boks-base-static-ubuntu:latest
      composed-image     compose:git
  sbom      sbom.cdx.json sha256:afa70b17d6ef90e7e285fe014485a154...