Attestations for
  ghcr.io/boks-sh/go-gofmt@sha256:42c2721f1e6e373a1b726aae5fa4b37eb9f7dad244813464ca453a9a20e57023

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/go-gofmt@sha256:42c2721f1e6e373a1b726aae5fa4b37eb9f7dad244813464ca453a9a20e57023

=== cyclonedx ===================================================
  (no attestation matches the document published now -- 1 older one(s) are attached)

=== slsaprovenance ==============================================
  (no attestation matches the document published now -- 1 older one(s) are attached)