[2026-08-21T12:38:14,281950171+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/build-e2e-uutw/gh-test-custom-branch-uzvtvl
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/build-e2e-uutw/gh-test-custom-branch-uzvtvl:on-pr-9afd673787dd0a1ddc211fc5aa8496a5515be06f@sha256:f3b6e940d03eeb60786148a27fb0928ac80ee626936a958082d19fcc46d201d9
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/build-e2e-uutw/gh-test-custom-branch-uzvtvl@sha256:f3b6e940d03eeb60786148a27fb0928ac80ee626936a958082d19fcc46d201d9] to [quay.io/redhat-appstudio-qe/build-e2e-uutw/gh-test-custom-branch-uzvtvl:sha256-f3b6e940d03eeb60786148a27fb0928ac80ee626936a958082d19fcc46d201d9.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/build-e2e-uutw/gh-test-custom-branch-uzvtvl@sha256:0fc4eb9e7286080278e3ed3b2a1cdea31523e205d78b60c81e63ab7bf87264a9
[2026-08-21T12:38:39,101395289+00:00] End upload-sbom