[2026-08-19T15:02:15,376548662+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-q0v0/python-component-wtdcdx
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-q0v0/python-component-wtdcdx:on-pr-ac721b16c9cfe50bcd0c957b03ccb87faf1cd8dd@sha256:b0a7147f183b7d87d7b6e3fb2dad9a37019b4600fe7c05f2b1762a05921ebffd
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-q0v0/python-component-wtdcdx@sha256:b0a7147f183b7d87d7b6e3fb2dad9a37019b4600fe7c05f2b1762a05921ebffd] to [quay.io/redhat-appstudio-qe/group-q0v0/python-component-wtdcdx:sha256-b0a7147f183b7d87d7b6e3fb2dad9a37019b4600fe7c05f2b1762a05921ebffd.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-q0v0/python-component-wtdcdx@sha256:5360795ea85f79ad237964c82bf3612731768e5b4073adf174d1746961a0e16a
[2026-08-19T15:03:01,477735496+00:00] End upload-sbom