Currently, Clair cannot scan attestation manifests as they are not normal container images. This feature request would add support for those manifests to be scanned, results of this scanning should be visible and available through Quay's UI as for any other container image. Is this something that's feasible for Clair?
Thanks!