[2026-05-01T23:07:54,227995199+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/build-e2e-ppvu/fj-multi-component-parent-ffqe
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/build-e2e-ppvu/fj-multi-component-parent-ffqe:on-pr-71cf83ad5a481ac462801de5b1164f8a6a05b1da@sha256:6f608d67de7051f7d217eabddf1234a5c536603519a02ecb3f51eebaf227aded
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/build-e2e-ppvu/fj-multi-component-parent-ffqe@sha256:6f608d67de7051f7d217eabddf1234a5c536603519a02ecb3f51eebaf227aded] to [quay.io/redhat-appstudio-qe/build-e2e-ppvu/fj-multi-component-parent-ffqe:sha256-6f608d67de7051f7d217eabddf1234a5c536603519a02ecb3f51eebaf227aded.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/build-e2e-ppvu/fj-multi-component-parent-ffqe@sha256:c4af7ad79c552ee2ba62616aa37eef23082d2b531e9b24f328a0b6ed2006d617
[2026-05-01T23:08:27,066862930+00:00] End upload-sbom