[2026-05-05T12:05:23,263613778+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-dlty/python-component-vupvro
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-dlty/python-component-vupvro:on-pr-19ef1bb788a366392930f621bb3b9bee592cb581@sha256:96b0392c824a4ece837c7121f5d559f5e16a4ff5c5ac34d07701f91074d1b709
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-dlty/python-component-vupvro@sha256:96b0392c824a4ece837c7121f5d559f5e16a4ff5c5ac34d07701f91074d1b709] to [quay.io/redhat-appstudio-qe/group-dlty/python-component-vupvro:sha256-96b0392c824a4ece837c7121f5d559f5e16a4ff5c5ac34d07701f91074d1b709.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-dlty/python-component-vupvro@sha256:90e01c407b6c7fd332b983b576e2b112db6545e5159c373e61d5d58fe961a11b
[2026-05-05T12:05:26,921848052+00:00] End upload-sbom