[2026-10-11T12:37:56,683912867+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/gitlab-rep-qac7/test-comp-pac-gitlab-gr6dee
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/gitlab-rep-qac7/test-comp-pac-gitlab-gr6dee:on-pr-3b42fbec616e2db0b3b6e58ec1419a4b1787cf47@sha256:bc8d17b76eb4292c9e68e5baf12322cbfbaaca709c3c69041b6f1af784bbe8ac
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/gitlab-rep-qac7/test-comp-pac-gitlab-gr6dee@sha256:bc8d17b76eb4292c9e68e5baf12322cbfbaaca709c3c69041b6f1af784bbe8ac] to [quay.io/redhat-appstudio-qe/gitlab-rep-qac7/test-comp-pac-gitlab-gr6dee:sha256-bc8d17b76eb4292c9e68e5baf12322cbfbaaca709c3c69041b6f1af784bbe8ac.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/gitlab-rep-qac7/test-comp-pac-gitlab-gr6dee@sha256:171363d5d7c84a0958c98aa2b19486b4eb48b55d2e2c7b47a7c4ac0fb12ebc66
[2026-10-11T12:38:21,256046565+00:00] End upload-sbom