[2026-08-14T07:34:51,898075579+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-xsif/python-component-6kfxd3
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-xsif/python-component-6kfxd3:on-pr-428f717feafd7fe7f7d62f39147d7b17a85f4683@sha256:7ff41876e7895048124f5b2771f91fa758548b38d5fa13d9e2bbab6715722aef
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-xsif/python-component-6kfxd3@sha256:7ff41876e7895048124f5b2771f91fa758548b38d5fa13d9e2bbab6715722aef] to [quay.io/redhat-appstudio-qe/group-xsif/python-component-6kfxd3:sha256-7ff41876e7895048124f5b2771f91fa758548b38d5fa13d9e2bbab6715722aef.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-xsif/python-component-6kfxd3@sha256:b45f159ed0a313c9fab38e27bf8376ecc89d52e02ed6d7831714bcbe4d8857d4
[2026-08-14T07:35:19,070876212+00:00] End upload-sbom