[2026-10-13T03:22:47,749484821+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/build-e2e-dhuv/fj-multi-component-child-xpye
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/build-e2e-dhuv/fj-multi-component-child-xpye:on-pr-4ea47e0d4835c4d7070dca5818363a908f2d386c@sha256:bc462aba2e9598ee3bdde22abbf1dea74606b25251b3f637293ddd7513810c64
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/build-e2e-dhuv/fj-multi-component-child-xpye@sha256:bc462aba2e9598ee3bdde22abbf1dea74606b25251b3f637293ddd7513810c64] to [quay.io/redhat-appstudio-qe/build-e2e-dhuv/fj-multi-component-child-xpye:sha256-bc462aba2e9598ee3bdde22abbf1dea74606b25251b3f637293ddd7513810c64.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/build-e2e-dhuv/fj-multi-component-child-xpye@sha256:de0d41f1e63317c16ca4f3d2d7e319cf47fff42cf01340a14e8dbc6c7173d305
[2026-10-13T03:23:22,907838133+00:00] End upload-sbom