The Rekor UUID for this release is 108e9186e8c5677a12fc7bf8df7322fd4041d9232c3110daf0990e596b05f7d957a1690cd3cb290f

Verify that all container images in the release file are in the attestation:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/dashboard/previous/v0.63.1/release.yaml
REKOR_UUID=108e9186e8c5677a12fc7bf8df7322fd4041d9232c3110daf0990e596b05f7d957a1690cd3cb290f

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGE=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|select(.name | startswith("ghcr.io"))|.name + ":v0.63.1@sha256:" + .digest.sha256')

# Download the release file
curl -s -L "$RELEASE_FILE" -o release.yaml

# Match the image used in the release file to an image in the attestation
DASHBOARD_IMAGE=$(cat release.yaml | grep image: | awk -F' ' '{print $2}')
echo
printf $DASHBOARD_IMAGE
if [[ "${REKOR_ATTESTATION_IMAGE}" = "${DASHBOARD_IMAGE}" ]]; then
  echo " ===> ok"
else
  echo " ===> no match"
fi