[2026-07-03T22:13:48,268242026+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/build-e2e-yuhs/gl-test-custom-branch-hqqezk
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/build-e2e-yuhs/gl-test-custom-branch-hqqezk:a18c346c9ff2e8dae3abf4eb586afd7d8cbbf068@sha256:92cd48665fdd0a52ba4cc414193273bc82e96fb9bbc27f7c3e1c5559271773a0
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/build-e2e-yuhs/gl-test-custom-branch-hqqezk@sha256:92cd48665fdd0a52ba4cc414193273bc82e96fb9bbc27f7c3e1c5559271773a0] to [quay.io/redhat-appstudio-qe/build-e2e-yuhs/gl-test-custom-branch-hqqezk:sha256-92cd48665fdd0a52ba4cc414193273bc82e96fb9bbc27f7c3e1c5559271773a0.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/build-e2e-yuhs/gl-test-custom-branch-hqqezk@sha256:5d4e9e973f13ada733198988f1c6c23c5acc56b0f17e3b78e9b238978e126f7c
[2026-07-03T22:14:28,931104974+00:00] End upload-sbom