Attestations for
  ghcr.io/boks-sh/perl@sha256:5a35e7ad9f121bf4ba367ff94a232939ca8e99da61cd24d03dd9c616e553eb92

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/perl@sha256:5a35e7ad9f121bf4ba367ff94a232939ca8e99da61cd24d03dd9c616e553eb92

=== cyclonedx ===================================================
  subject   ghcr.io/boks-sh/perl
  digest    sha256:5a35e7ad9f121bf4ba367ff94a232939ca8e99da61cd24d03dd9c616e553eb92
  states    3 component(s) are inside this image
      perl                   5.42.3                   cpe:2.3:a:perl:perl:5.42.3:*:*:*:*:*:*:*
      zlib                   1.3.2                    cpe:2.3:a:zlib:zlib:1.3.2:*:*:*:*:*:*:*
      bzip2                  1.0.8                    cpe:2.3:a:bzip:bzip2:1.0.8:*:*:*:*:*:*:*

=== slsaprovenance ==============================================
  subject   ghcr.io/boks-sh/perl
  digest    sha256:5a35e7ad9f121bf4ba367ff94a232939ca8e99da61cd24d03dd9c616e553eb92
  build     https://index.boks.sh/buildtype/v1
  builder   https://index.boks.sh
  from      14 resolved input(s)
      base-image         ghcr.io/boks-sh/boks-base-static-ubuntu:latest
      apt-package        pkg:deb/ubuntu/binutils@2.46-3ubuntu2?arch=arm64
      apt-package        pkg:deb/ubuntu/ca-certificates@20260601~26.04.1?arch=arm64
      apt-package        pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.4?arch=arm64
      apt-package        pkg:deb/ubuntu/file@1:5.46-5build2?arch=arm64
      apt-package        pkg:deb/ubuntu/findutils@4.10.0-3build2?arch=arm64
      apt-package        pkg:deb/ubuntu/gcc@4:15.2.0-5ubuntu1?arch=arm64
      apt-package        pkg:deb/ubuntu/libc6-dev@2.43-2ubuntu2.3?arch=arm64
      apt-package        pkg:deb/ubuntu/libcrypt-dev@1:4.5.1-1?arch=arm64
      apt-package        pkg:deb/ubuntu/make@4.4.1-3?arch=arm64
      apt-package        pkg:deb/ubuntu/patch@2.8-2build1?arch=arm64
      apt-package        pkg:deb/ubuntu/patchelf@0.18.0-1.4build1?arch=arm64
      ... and 2 more
  sbom      sbom.json sha256:a3fa73e0ba3ac97aa871b4f2e81a0e3e...