[2026-08-17T06:27:42,945320085+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-wd2n/python-component-ffgc70
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-wd2n/python-component-ffgc70:on-pr-cf81630de594ed79216000910203bb91928d6018@sha256:2208da8fc621aefbffe8e96cf25f3f96f1afe926dbd184e0ce00749492281e89
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-wd2n/python-component-ffgc70@sha256:2208da8fc621aefbffe8e96cf25f3f96f1afe926dbd184e0ce00749492281e89] to [quay.io/redhat-appstudio-qe/group-wd2n/python-component-ffgc70:sha256-2208da8fc621aefbffe8e96cf25f3f96f1afe926dbd184e0ce00749492281e89.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-wd2n/python-component-ffgc70@sha256:c8d75735e652d660feeef9595c39baec15d248892eeab8555a3e683c528029bd
[2026-08-17T06:28:20,621734713+00:00] End upload-sbom