[2026-08-21T06:12:32,875932029+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/gitlab-rep-nwln/test-comp-pac-gitlab-jfhhep
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/gitlab-rep-nwln/test-comp-pac-gitlab-jfhhep:on-pr-2c34b5c124cfe5485f9c373c28266b7413577d6b@sha256:5544c3e0050ab61da29f33919e700389b6a364776b7e1730ff91110c093d45fa
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/gitlab-rep-nwln/test-comp-pac-gitlab-jfhhep@sha256:5544c3e0050ab61da29f33919e700389b6a364776b7e1730ff91110c093d45fa] to [quay.io/redhat-appstudio-qe/gitlab-rep-nwln/test-comp-pac-gitlab-jfhhep:sha256-5544c3e0050ab61da29f33919e700389b6a364776b7e1730ff91110c093d45fa.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/gitlab-rep-nwln/test-comp-pac-gitlab-jfhhep@sha256:b920ffe61352c5e9c69063e6731d447ffde7b708461e8df78a489ec5d32aa68a
[2026-08-21T06:13:13,146582784+00:00] End upload-sbom