[2026-08-15T00:59:00,235515916+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-8ypg/python-component-lncjal
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-8ypg/python-component-lncjal:on-pr-66cd0a863b6d3e910a2598309f20f62a2a7caf22@sha256:e576a80be754d04e3893b335f173f77f6c57c7d5da1fbc4bee8f33afbf21054e
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-8ypg/python-component-lncjal@sha256:e576a80be754d04e3893b335f173f77f6c57c7d5da1fbc4bee8f33afbf21054e] to [quay.io/redhat-appstudio-qe/group-8ypg/python-component-lncjal:sha256-e576a80be754d04e3893b335f173f77f6c57c7d5da1fbc4bee8f33afbf21054e.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-8ypg/python-component-lncjal@sha256:9cc4ff52f02cd8f34f0531b4539dfa089a162753a472560b89b4087b4224a127
[2026-08-15T00:59:41,085720086+00:00] End upload-sbom