witness verify -p policy-local-signed.json -k swfpublic.pem \
    -a ./release/attestations/build-image.att.json \
    -a ./release/attestations/fmt.att.json \
    -a ./release/attestations/lint.att.json \
    -a ./release/attestations/vet.att.json \
    -a ./release/attestations/sast.att.json \
    -a ./release/attestations/unit-test.att.json \
    -a ./release/attestations/cve-scan.att.json \
    -a ./release/attestations/secret-scan.att.json \
    -s $(docker image inspect jkjell/software:dev | jq -r '.[].Id' | sed s/sha256://)