[2026-05-19T10:07:44,775878412+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-x0k9/go-component-ipckn5
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-x0k9/go-component-ipckn5:on-pr-ff8453d346fd75331f597029ce02e7109d0d73f0@sha256:d0a4fd8c4e6a3f038d3ec9754810671aa870301d9705c7975a2a381fe6ecbaf0
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-x0k9/go-component-ipckn5@sha256:d0a4fd8c4e6a3f038d3ec9754810671aa870301d9705c7975a2a381fe6ecbaf0] to [quay.io/redhat-appstudio-qe/group-x0k9/go-component-ipckn5:sha256-d0a4fd8c4e6a3f038d3ec9754810671aa870301d9705c7975a2a381fe6ecbaf0.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-x0k9/go-component-ipckn5@sha256:e855275b9601dd847a64da6c731753a02c045b25505fc89de047617d5956a292
[2026-05-19T10:08:14,239738043+00:00] End upload-sbom