[2026-10-07T02:53:28,141078929+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/stat-rep-3hbn/test-component-pac-dbch0g
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/stat-rep-3hbn/test-component-pac-dbch0g:on-pr-a16e9b49b945bcd56b5f81a648f4cb543ac328de@sha256:e33f1cb917c5808da2a800b3cd9363521b24998a73138a8f198dee433e7782bb
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/stat-rep-3hbn/test-component-pac-dbch0g@sha256:e33f1cb917c5808da2a800b3cd9363521b24998a73138a8f198dee433e7782bb] to [quay.io/redhat-appstudio-qe/stat-rep-3hbn/test-component-pac-dbch0g:sha256-e33f1cb917c5808da2a800b3cd9363521b24998a73138a8f198dee433e7782bb.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/stat-rep-3hbn/test-component-pac-dbch0g@sha256:8f59cbb2a21a1d832413087f2649d8e4ee1aaa2cf48d72921131558cbfefd30f
[2026-10-07T02:53:53,620140631+00:00] End upload-sbom