[2026-10-07T04:00:35,590015143+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/gitlab-rep-j29p/test-comp-pac-gitlab-2c21e3
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/gitlab-rep-j29p/test-comp-pac-gitlab-2c21e3:on-pr-cd8e9a4f58f98873909fb8d25f116f44d372e37f@sha256:7a606908856d6a5168b6bde5a24c739ab23a9392536cb485aa52f8e2fe7aa1a7
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/gitlab-rep-j29p/test-comp-pac-gitlab-2c21e3@sha256:7a606908856d6a5168b6bde5a24c739ab23a9392536cb485aa52f8e2fe7aa1a7] to [quay.io/redhat-appstudio-qe/gitlab-rep-j29p/test-comp-pac-gitlab-2c21e3:sha256-7a606908856d6a5168b6bde5a24c739ab23a9392536cb485aa52f8e2fe7aa1a7.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/gitlab-rep-j29p/test-comp-pac-gitlab-2c21e3@sha256:1830b6c6ef24806260965a02113f44b5c1307d937a10c03be652f1cecd159c05
[2026-10-07T04:01:00,225627137+00:00] End upload-sbom