[2026-07-01T16:11:58,044454235+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-eqz6/python-component-m6bhin
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-eqz6/python-component-m6bhin:on-pr-7c486e006460302a7665aeae007dd0c63337fa3c@sha256:8fb53d755eb365d72de03a03747f7f371bef540718cb92b85ea14982465b09aa
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-eqz6/python-component-m6bhin@sha256:8fb53d755eb365d72de03a03747f7f371bef540718cb92b85ea14982465b09aa] to [quay.io/redhat-appstudio-qe/group-eqz6/python-component-m6bhin:sha256-8fb53d755eb365d72de03a03747f7f371bef540718cb92b85ea14982465b09aa.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-eqz6/python-component-m6bhin@sha256:4f7da5cb7ca6b599864017f3e858dbc718dee0d87329ceff8041761986c1c58d
[2026-07-01T16:12:28,820048399+00:00] End upload-sbom