Attestations for
  ghcr.io/boks-sh/xz-utils@sha256:3dca637da4f718315d94a819a0ee3d3f39dd6d2a28233e10554d8c5eac0bc350

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/xz-utils@sha256:3dca637da4f718315d94a819a0ee3d3f39dd6d2a28233e10554d8c5eac0bc350

=== cyclonedx ===================================================
  (no attestation matches the document published now -- 1 older one(s) are attached)

=== slsaprovenance ==============================================
  (no attestation matches the document published now -- 1 older one(s) are attached)