Attestations for
  ghcr.io/boks-sh/tar@sha256:cd7bf2421518d3c9479b15bd7323460e846e166a178fe67e05bc06d297165b8a

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/tar@sha256:cd7bf2421518d3c9479b15bd7323460e846e166a178fe67e05bc06d297165b8a

=== cyclonedx ===================================================
  (no attestation matches the document published now -- 0 older one(s) are attached)

=== slsaprovenance ==============================================
  (no attestation matches the document published now -- 0 older one(s) are attached)