[2026-08-21T05:08:30,921859902+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-qhe2/konflux-test-integration-clone-6oayd5
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-qhe2/konflux-test-integration-clone-6oayd5:on-pr-3d4d12b8e0e7ae949b9b957ee40935fba1f5a855@sha256:a03695703c26a3a81de68bed965ee56bec8e181148e962e781691a09af2ccdeb
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-qhe2/konflux-test-integration-clone-6oayd5@sha256:a03695703c26a3a81de68bed965ee56bec8e181148e962e781691a09af2ccdeb] to [quay.io/redhat-appstudio-qe/group-qhe2/konflux-test-integration-clone-6oayd5:sha256-a03695703c26a3a81de68bed965ee56bec8e181148e962e781691a09af2ccdeb.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-qhe2/konflux-test-integration-clone-6oayd5@sha256:e559b75e9d0e73833c62d6a946bb61ba6a0b2d8469b31e3b1977b7e6daeb7a86
[2026-08-21T05:09:09,926609921+00:00] End upload-sbom