[2026-10-11T01:55:24,378062067+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/build-e2e-klft/gl-multi-component-child-llva
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/build-e2e-klft/gl-multi-component-child-llva:on-pr-89af79a1a09523f23be9a400061317df53d5950a@sha256:da209c5baa54811f0523eadff4de079f254c6807921ef86456e438f6e563675c
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/build-e2e-klft/gl-multi-component-child-llva@sha256:da209c5baa54811f0523eadff4de079f254c6807921ef86456e438f6e563675c] to [quay.io/redhat-appstudio-qe/build-e2e-klft/gl-multi-component-child-llva:sha256-da209c5baa54811f0523eadff4de079f254c6807921ef86456e438f6e563675c.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/build-e2e-klft/gl-multi-component-child-llva@sha256:9c2f50e5b28511d615de2b0d7061412f1b532063a609375500b6004bbc3f7c71
[2026-10-11T01:55:47,172751978+00:00] End upload-sbom