[2026-08-13T06:48:31,535740499+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/forgejo-rep-0wkg/test-comp-pac-forgejo-2oalck
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/forgejo-rep-0wkg/test-comp-pac-forgejo-2oalck:on-pr-5e05ee382730ab12cec19b5527a7e777c3ed3e3f@sha256:227ab9ea91d7e1083460516163fc8eba8574768ae339967a2f61a63934f27199
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/forgejo-rep-0wkg/test-comp-pac-forgejo-2oalck@sha256:227ab9ea91d7e1083460516163fc8eba8574768ae339967a2f61a63934f27199] to [quay.io/redhat-appstudio-qe/forgejo-rep-0wkg/test-comp-pac-forgejo-2oalck:sha256-227ab9ea91d7e1083460516163fc8eba8574768ae339967a2f61a63934f27199.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/forgejo-rep-0wkg/test-comp-pac-forgejo-2oalck@sha256:6fc74638995d3fc670eb6f41b7249c82856ad9b7d7d83e74f86f7dd427470b2f
[2026-08-13T06:48:57,703228078+00:00] End upload-sbom