[2026-08-15T03:29:04,686306680+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-jy3q/python-component-vpgxqh
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-jy3q/python-component-vpgxqh:on-pr-59649214e29b788bc84bf848cb747f89f9d281fc@sha256:58578256d69366da6eca0738df50bdd667474c511a03256e8ea782a630429f6d
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-jy3q/python-component-vpgxqh@sha256:58578256d69366da6eca0738df50bdd667474c511a03256e8ea782a630429f6d] to [quay.io/redhat-appstudio-qe/group-jy3q/python-component-vpgxqh:sha256-58578256d69366da6eca0738df50bdd667474c511a03256e8ea782a630429f6d.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-jy3q/python-component-vpgxqh@sha256:bf57b4fa85009844449fe26d7a469515203d153eb44db786cfcb4309443b8107
[2026-08-15T03:29:33,055653880+00:00] End upload-sbom