Attestations for
  ghcr.io/boks-sh/hermes-agent@sha256:43db865e8353f77f620d4188051fad067b3915bf804f52dd1fc0346cb985f9aa

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/hermes-agent@sha256:43db865e8353f77f620d4188051fad067b3915bf804f52dd1fc0346cb985f9aa

=== cyclonedx ===================================================
  subject   ghcr.io/boks-sh/hermes-agent
  digest    sha256:43db865e8353f77f620d4188051fad067b3915bf804f52dd1fc0346cb985f9aa
  states    61 component(s) are inside this image
      annotated-doc          0.0.5                    pkg:pypi/annotated-doc@0.0.5
      annotated-types        0.8.0                    pkg:pypi/annotated-types@0.8.0
      anyio                  4.14.2                   pkg:pypi/anyio@4.14.2
      certifi                2026.5.20                pkg:pypi/certifi@2026.5.20
      cffi                   2.1.1                    pkg:pypi/cffi@2.1.1
      charset-normalizer     3.5.1                    pkg:pypi/charset-normalizer@3.5.1
      click                  8.4.2                    pkg:pypi/click@8.4.2
      croniter               6.0.0                    pkg:pypi/croniter@6.0.0
      cryptography           50.0.0                   pkg:pypi/cryptography@50.0.0
      distro                 1.9.0                    pkg:pypi/distro@1.9.0
      fastapi                0.141.1                  pkg:pypi/fastapi@0.141.1
      fire                   0.7.1                    pkg:pypi/fire@0.7.1
      ... and 49 more

=== slsaprovenance ==============================================
  subject   ghcr.io/boks-sh/hermes-agent
  digest    sha256:43db865e8353f77f620d4188051fad067b3915bf804f52dd1fc0346cb985f9aa
  build     https://index.boks.sh/buildtype/v1
  builder   https://index.boks.sh
  from      2 resolved input(s)
      base-image         ghcr.io/boks-sh/boks-base-static-ubuntu:latest
      composed-image     compose:python@3.13
  sbom      sbom.json sha256:55d8df6217ec2b2c00158674f4b9549a...