[2026-08-21T04:54:02,445074152+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-ajhc/go-component-k6bxb5
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-ajhc/go-component-k6bxb5:on-pr-033dc9a9a605b5c6f1fd46241810a2f3f1806a99@sha256:45c6c339302e82316e4d2bd3192258e2610fafa33fa4dd45fafbbbd9e4982c23
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-ajhc/go-component-k6bxb5@sha256:45c6c339302e82316e4d2bd3192258e2610fafa33fa4dd45fafbbbd9e4982c23] to [quay.io/redhat-appstudio-qe/group-ajhc/go-component-k6bxb5:sha256-45c6c339302e82316e4d2bd3192258e2610fafa33fa4dd45fafbbbd9e4982c23.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-ajhc/go-component-k6bxb5@sha256:f6000f059e0bb085345f23952efeeecdfa1b809726d64b8e2ef8b83e0d0c44f1
[2026-08-21T04:54:27,922605334+00:00] End upload-sbom