[2026-08-22T03:23:33,827132643+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-0l5q/konflux-test-integration-clone-vo7gca
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-0l5q/konflux-test-integration-clone-vo7gca:on-pr-32addf8e2426b3193c1139100c06701d33ab8fd1@sha256:3457a79bc7bdeb340bbce9d00ef6a57628ccba02a4a31954637f056554e2312d
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-0l5q/konflux-test-integration-clone-vo7gca@sha256:3457a79bc7bdeb340bbce9d00ef6a57628ccba02a4a31954637f056554e2312d] to [quay.io/redhat-appstudio-qe/group-0l5q/konflux-test-integration-clone-vo7gca:sha256-3457a79bc7bdeb340bbce9d00ef6a57628ccba02a4a31954637f056554e2312d.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-0l5q/konflux-test-integration-clone-vo7gca@sha256:f10475a9f2b34abb9e9d8a248f69cd8b159be664bbe50276cb12eaa0ce9c76d9
[2026-08-22T03:24:02,768335704+00:00] End upload-sbom