[2026-07-01T15:54:41,378326934+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-eqz6/python-component-m6bhin
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-eqz6/python-component-m6bhin:on-pr-f0e7ede68fb8ed1cb9d7666ce8b6ba46e5d8028f@sha256:d50e41429af4c1f4dfdfef1c983a8d75c92bfca1d6b83887308715497945a778
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-eqz6/python-component-m6bhin@sha256:d50e41429af4c1f4dfdfef1c983a8d75c92bfca1d6b83887308715497945a778] to [quay.io/redhat-appstudio-qe/group-eqz6/python-component-m6bhin:sha256-d50e41429af4c1f4dfdfef1c983a8d75c92bfca1d6b83887308715497945a778.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-eqz6/python-component-m6bhin@sha256:59306566ac4c000eeaf7c0e2af101be63f0150a7502bbfccfae3eba1541fedb4
[2026-07-01T15:55:12,482085098+00:00] End upload-sbom