Attestations for
  ghcr.io/boks-sh/yarn@sha256:645f40a9c334554e21fe2a5722e830b99ca8423dafda49044683126309fd762e

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/yarn@sha256:645f40a9c334554e21fe2a5722e830b99ca8423dafda49044683126309fd762e

=== cyclonedx ===================================================
  subject   ghcr.io/boks-sh/yarn
  digest    sha256:645f40a9c334554e21fe2a5722e830b99ca8423dafda49044683126309fd762e
  states    250 component(s) are inside this image
      yarn                   1.22.22                  pkg:npm/yarn@1.22.22
      @zkochan/cmd-shim      3.1.0                    pkg:npm/@zkochan/cmd-shim@3.1.0
      ajv                    5.5.2                    pkg:npm/ajv@5.5.2
      ansi-escapes           3.1.0                    pkg:npm/ansi-escapes@3.1.0
      ansi-regex             2.1.1                    pkg:npm/ansi-regex@2.1.1
      ansi-regex             3.0.0                    pkg:npm/ansi-regex@3.0.0
      ansi-styles            3.2.1                    pkg:npm/ansi-styles@3.2.1
      any-promise            1.3.0                    pkg:npm/any-promise@1.3.0
      argparse               1.0.10                   pkg:npm/argparse@1.0.10
      arr-diff               2.0.0                    pkg:npm/arr-diff@2.0.0
      arr-flatten            1.1.0                    pkg:npm/arr-flatten@1.1.0
      array-find-index       1.0.2                    pkg:npm/array-find-index@1.0.2
      ... and 238 more

=== slsaprovenance ==============================================
  subject   ghcr.io/boks-sh/yarn
  digest    sha256:645f40a9c334554e21fe2a5722e830b99ca8423dafda49044683126309fd762e
  build     https://index.boks.sh/buildtype/v1
  builder   https://index.boks.sh
  from      6 resolved input(s)
      base-image         ghcr.io/boks-sh/boks-base-static-ubuntu:latest
      composed-image     compose:bash
      composed-image     compose:env
      composed-image     compose:node
      composed-image     compose:node@26
      composed-image     compose:npm
  sbom      sbom.json sha256:430bf4a3e05470b904f0d4659b6a6389...