[2026-08-14T10:35:25,104268039+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-sqmg/konflux-test-integration-clone-fzvq0u
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-sqmg/konflux-test-integration-clone-fzvq0u:on-pr-94c688481098c6ffc43bb2924439a333f64576f8@sha256:f52412b0b28aec280ec204317dded4c5d4c8de9bb048288af4616f695667eeaa
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-sqmg/konflux-test-integration-clone-fzvq0u@sha256:f52412b0b28aec280ec204317dded4c5d4c8de9bb048288af4616f695667eeaa] to [quay.io/redhat-appstudio-qe/group-sqmg/konflux-test-integration-clone-fzvq0u:sha256-f52412b0b28aec280ec204317dded4c5d4c8de9bb048288af4616f695667eeaa.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-sqmg/konflux-test-integration-clone-fzvq0u@sha256:39a821b17b8511e5d4db6d9bedd3fea1a2ff0810fb6ef43ba94d7e3cd784de7d
[2026-08-14T10:35:58,454396081+00:00] End upload-sbom