INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/build-e2e-prefetch-bundler/component-prefetch-bundler
[2026-08-18T04:38:47,932863614+00:00] Upload SBOM
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/build-e2e-prefetch-bundler/component-prefetch-bundler:on-pr-a092cf83395afc329b05794d7ef446fb40da4d3e@sha256:9b4256e41786b11f3ff18153bf3cec6299be3144f64f36cc60bdf4f8296ab170
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/build-e2e-prefetch-bundler/component-prefetch-bundler@sha256:9b4256e41786b11f3ff18153bf3cec6299be3144f64f36cc60bdf4f8296ab170] to [quay.io/redhat-appstudio-qe/build-e2e-prefetch-bundler/component-prefetch-bundler:sha256-9b4256e41786b11f3ff18153bf3cec6299be3144f64f36cc60bdf4f8296ab170.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/build-e2e-prefetch-bundler/component-prefetch-bundler@sha256:0a64ec09e29b439dab5e948c8e450d03359267299d50f0da4550a41d02d725ff
[2026-08-18T04:38:50,712023642+00:00] Handle keyless signing if enabled
[retry] executing: kubectl get configmap cluster-config -n konflux-info -o json
Keyless signing is disabled (none of rekorInternalUrl, fulcioInternalUrl, defaultOIDCIssuer, tufInternalUrl are configured in the konflux-info/cluster-config configmap)

[2026-08-18T04:38:51,331794608+00:00] End upload-sbom