[2026-08-14T14:13:36,006020750+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-70fo/konflux-test-integration-clone-j2vbin
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-70fo/konflux-test-integration-clone-j2vbin:on-pr-420384f5e6eb1223623a1b19c9e77931d112f9ce@sha256:86655cb4016b112b1e19dd462099ec02d4a4a06f7d925ff12850d196fe0cce38
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-70fo/konflux-test-integration-clone-j2vbin@sha256:86655cb4016b112b1e19dd462099ec02d4a4a06f7d925ff12850d196fe0cce38] to [quay.io/redhat-appstudio-qe/group-70fo/konflux-test-integration-clone-j2vbin:sha256-86655cb4016b112b1e19dd462099ec02d4a4a06f7d925ff12850d196fe0cce38.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-70fo/konflux-test-integration-clone-j2vbin@sha256:9b0ee00add56879db9942df06aca69b1dd1ff9635e47b3545e95142a9394bcf8
[2026-08-14T14:14:12,616004009+00:00] End upload-sbom