[2026-08-14T05:28:58,366343155+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-f5h1/python-component-0369oz
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-f5h1/python-component-0369oz:ca00d6e6e7e40c27e4c2c10c2e7262ca937d896c@sha256:dfa4c983ad2dc9b326c90e2858c531a3f83dccbaf61f755206bf7589df1ff71c
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-f5h1/python-component-0369oz@sha256:dfa4c983ad2dc9b326c90e2858c531a3f83dccbaf61f755206bf7589df1ff71c] to [quay.io/redhat-appstudio-qe/group-f5h1/python-component-0369oz:sha256-dfa4c983ad2dc9b326c90e2858c531a3f83dccbaf61f755206bf7589df1ff71c.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-f5h1/python-component-0369oz@sha256:9b6f69770487fb700c28828a9cd162f71fb0577a94dcf4b4b690857d36a4fcff
[2026-08-14T05:29:38,318049692+00:00] End upload-sbom