COSIGN_EXPERIMENTAL=1 cosign verify-attestation ghcr.io/complianceascode/compliance-operator-bundle@sha256:29229fc3aa8398f6273faacd7ceef2fa936dd1847662fd8bc0dd6c3e96a20c16 | jq '.payload |= @base64d | .payload | fromjson | select(.predicateType == "https://spdx.dev/Document") | .predicate.Data | fromjson'