[2026-10-09T12:51:54,471803087+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/build-e2e-xlsl/gl-multi-component-child-tuds
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/build-e2e-xlsl/gl-multi-component-child-tuds:7de79df01594b1e4089757d2a1db8b1947c6233a@sha256:5d74c3b62b4ad01c9187f350e4b025cf4c99cdf15ebbe4edcf25ecf782e8e18f
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/build-e2e-xlsl/gl-multi-component-child-tuds@sha256:5d74c3b62b4ad01c9187f350e4b025cf4c99cdf15ebbe4edcf25ecf782e8e18f] to [quay.io/redhat-appstudio-qe/build-e2e-xlsl/gl-multi-component-child-tuds:sha256-5d74c3b62b4ad01c9187f350e4b025cf4c99cdf15ebbe4edcf25ecf782e8e18f.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/build-e2e-xlsl/gl-multi-component-child-tuds@sha256:a107d5ab118387bbecc1ed1000456d792e8ee7eab1b9609e628942c103cb7fdb
[2026-10-09T12:52:35,823115900+00:00] End upload-sbom