[2026-10-09T13:52:45,764697204+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/build-e2e-ksln/gl-multi-component-parent-icbu
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/build-e2e-ksln/gl-multi-component-parent-icbu:on-pr-e74d52fe486af27e5f44a8d8dca3113e37b29e7e@sha256:f7aac382bb85598b1c476bc653f13392a8e7278964a993e9d72099b57627d0dd
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/build-e2e-ksln/gl-multi-component-parent-icbu@sha256:f7aac382bb85598b1c476bc653f13392a8e7278964a993e9d72099b57627d0dd] to [quay.io/redhat-appstudio-qe/build-e2e-ksln/gl-multi-component-parent-icbu:sha256-f7aac382bb85598b1c476bc653f13392a8e7278964a993e9d72099b57627d0dd.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/build-e2e-ksln/gl-multi-component-parent-icbu@sha256:e3e2c502efebc5c0587ea4c1e6dad61ab1d55f267bf1eb04201e5527e9c74263
[2026-10-09T13:53:09,221088809+00:00] End upload-sbom