Attestations for
  ghcr.io/boks-sh/hermes-agent@sha256:61d5fa38d8113ce8c3f220ed6b53192721d96a130b2a6c136144a6403e8d6bf9

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/hermes-agent@sha256:61d5fa38d8113ce8c3f220ed6b53192721d96a130b2a6c136144a6403e8d6bf9

=== cyclonedx ===================================================
  subject   ghcr.io/boks-sh/hermes-agent
  digest    sha256:61d5fa38d8113ce8c3f220ed6b53192721d96a130b2a6c136144a6403e8d6bf9
  states    61 component(s) are inside this image
      annotated-doc          0.0.5                    pkg:pypi/annotated-doc@0.0.5
      annotated-types        0.8.0                    pkg:pypi/annotated-types@0.8.0
      anyio                  4.14.2                   pkg:pypi/anyio@4.14.2
      certifi                2026.5.20                pkg:pypi/certifi@2026.5.20
      cffi                   2.1.1                    pkg:pypi/cffi@2.1.1
      charset-normalizer     3.5.1                    pkg:pypi/charset-normalizer@3.5.1
      click                  8.4.2                    pkg:pypi/click@8.4.2
      croniter               6.0.0                    pkg:pypi/croniter@6.0.0
      cryptography           50.0.0                   pkg:pypi/cryptography@50.0.0
      distro                 1.9.0                    pkg:pypi/distro@1.9.0
      fastapi                0.141.1                  pkg:pypi/fastapi@0.141.1
      fire                   0.7.1                    pkg:pypi/fire@0.7.1
      ... and 49 more

=== slsaprovenance ==============================================
  subject   ghcr.io/boks-sh/hermes-agent
  digest    sha256:61d5fa38d8113ce8c3f220ed6b53192721d96a130b2a6c136144a6403e8d6bf9
  build     https://index.boks.sh/buildtype/v1
  builder   https://index.boks.sh
  from      2 resolved input(s)
      base-image         ghcr.io/boks-sh/boks-base-static-ubuntu:latest
      composed-image     compose:python@3.13
  sbom      sbom.json sha256:dd65fb134c206e9ad6503ddf4a46cee0...