Attestations for
  ghcr.io/boks-sh/nodejs@sha256:1d338b6fcfba7efb2d0bb615146b90679307d98b7b1e46a1424138e388af23f2

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/nodejs@sha256:1d338b6fcfba7efb2d0bb615146b90679307d98b7b1e46a1424138e388af23f2

=== cyclonedx ===================================================
  subject   ghcr.io/boks-sh/nodejs
  digest    sha256:1d338b6fcfba7efb2d0bb615146b90679307d98b7b1e46a1424138e388af23f2
  states    10 component(s) are inside this image
      brotli                 1.2.0-3build1            pkg:deb/ubuntu/brotli@1.2.0-3build1?distro=ubuntu-26
      c-ares                 1.34.6-1                 pkg:deb/ubuntu/c-ares@1.34.6-1?distro=ubuntu-26.04
      libzstd                1.5.7+dfsg-3             pkg:deb/ubuntu/libzstd@1.5.7%2Bdfsg-3?distro=ubuntu-
      nghttp2                1.68.0-2ubuntu0.2        pkg:deb/ubuntu/nghttp2@1.68.0-2ubuntu0.2?distro=ubun
      node                   26.7.0                   pkg:generic/node@26.7.0
      openssl                3.5.5-1ubuntu3.3         pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.3?distro=ubunt
      sqlite3                3.46.1-9ubuntu0.2        pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.2?distro=ubun
      zlib                   1:1.3.dfsg+really1.3.1-1ubuntu3 pkg:deb/ubuntu/zlib@1%3A1.3.dfsg%2Breally1.3.1-1ubun
      nodejs                 26.7.0                   cpe:2.3:a:nodejs:node.js:26.7.0:*:*:*:*:*:*:*
      icu                    78.3                     cpe:2.3:a:unicode:international_components_for_unico

=== slsaprovenance ==============================================
  subject   ghcr.io/boks-sh/nodejs
  digest    sha256:1d338b6fcfba7efb2d0bb615146b90679307d98b7b1e46a1424138e388af23f2
  build     https://index.boks.sh/buildtype/v1
  builder   https://index.boks.sh
  from      29 resolved input(s)
      base-image         ghcr.io/boks-sh/boks-base-static-ubuntu:latest
      apt-package        pkg:deb/ubuntu/binutils
      apt-package        pkg:deb/ubuntu/ca-certificates
      apt-package        pkg:deb/ubuntu/curl
      apt-package        pkg:deb/ubuntu/file
      apt-package        pkg:deb/ubuntu/findutils
      apt-package        pkg:deb/ubuntu/g++
      apt-package        pkg:deb/ubuntu/libbrotli-dev
      apt-package        pkg:deb/ubuntu/libbrotli1
      apt-package        pkg:deb/ubuntu/libc-ares-dev
      apt-package        pkg:deb/ubuntu/libcares2
      apt-package        pkg:deb/ubuntu/libnghttp2-14
      ... and 17 more
  sbom      sbom.json sha256:d9b86ec2daf188f43bcbdea9facc52d2...