Attestations for
  ghcr.io/boks-sh/zola@sha256:3b38c751006d59f8ea0e4ee813c78b162764d6bf3932b18c10d73798ddefa3fe

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/zola@sha256:3b38c751006d59f8ea0e4ee813c78b162764d6bf3932b18c10d73798ddefa3fe

=== cyclonedx ===================================================
  subject   ghcr.io/boks-sh/zola
  digest    sha256:3b38c751006d59f8ea0e4ee813c78b162764d6bf3932b18c10d73798ddefa3fe
  states    645 component(s) are inside this image
      gcc-16                 16-20260322-1ubuntu1     pkg:deb/ubuntu/gcc-16@16-20260322-1ubuntu1?distro=ub
      zola                   0.23.3                   pkg:cargo/zola@0.23.3
      adler2                 2.0.1                    pkg:cargo/adler2@2.0.1
      ahash                  0.7.8                    pkg:cargo/ahash@0.7.8
      ahash                  0.8.12                   pkg:cargo/ahash@0.8.12
      aho-corasick           1.1.5                    pkg:cargo/aho-corasick@1.1.5
      aligned                0.4.3                    pkg:cargo/aligned@0.4.3
      aligned-vec            0.6.4                    pkg:cargo/aligned-vec@0.6.4
      alloca                 0.4.0                    pkg:cargo/alloca@0.4.0
      allocator-api2         0.2.21                   pkg:cargo/allocator-api2@0.2.21
      ammonia                4.1.4                    pkg:cargo/ammonia@4.1.4
      anes                   0.1.6                    pkg:cargo/anes@0.1.6
      ... and 633 more

=== slsaprovenance ==============================================
  subject   ghcr.io/boks-sh/zola
  digest    sha256:3b38c751006d59f8ea0e4ee813c78b162764d6bf3932b18c10d73798ddefa3fe
  build     https://index.boks.sh/buildtype/v1
  builder   https://index.boks.sh
  from      3 resolved input(s)
      base-image         ghcr.io/boks-sh/boks-base-static-ubuntu:latest
      composed-image     compose:cargo
      apt-package        pkg:deb/ubuntu/libgcc-s1@16-20260322-1ubuntu1?arch=amd64
  sbom      sbom.cdx.json sha256:1d5d7db12394a3cf05850bf143340d86...