[2026-08-19T15:15:39,519614959+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/stat-rep-30wk/test-component-pac-w0muxi
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/stat-rep-30wk/test-component-pac-w0muxi:on-pr-1d831fda5ccc33ed1bcf6e3d4db49e9b8ff35067@sha256:18fdee15782f35190fc0fb422a08de12f2d8221b9686271a7cd1e34f8b42607d
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/stat-rep-30wk/test-component-pac-w0muxi@sha256:18fdee15782f35190fc0fb422a08de12f2d8221b9686271a7cd1e34f8b42607d] to [quay.io/redhat-appstudio-qe/stat-rep-30wk/test-component-pac-w0muxi:sha256-18fdee15782f35190fc0fb422a08de12f2d8221b9686271a7cd1e34f8b42607d.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/stat-rep-30wk/test-component-pac-w0muxi@sha256:c943b5a9892b9a338e3ab25400984613ac7d43d0b5311aa8266b7f29ec94cb99
[2026-08-19T15:16:21,926808354+00:00] End upload-sbom