[2026-08-19T14:35:20,216705118+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-q0v0/python-component-wtdcdx
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-q0v0/python-component-wtdcdx:on-pr-f101bd5d2d83aa82347834d603bdef478d71094d@sha256:dce6fdb58f60f1017828b7a71bc42429db68a672b8427b027e011f95a173c88a
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-q0v0/python-component-wtdcdx@sha256:dce6fdb58f60f1017828b7a71bc42429db68a672b8427b027e011f95a173c88a] to [quay.io/redhat-appstudio-qe/group-q0v0/python-component-wtdcdx:sha256-dce6fdb58f60f1017828b7a71bc42429db68a672b8427b027e011f95a173c88a.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-q0v0/python-component-wtdcdx@sha256:d3cf3165f823f6099220094fe133d2a052877b2372e0cee5a6528fa899d1a52e
[2026-08-19T14:35:59,830026364+00:00] End upload-sbom