[2026-08-22T03:30:48,330209295+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-0l5q/python-component-jcv7ut
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-0l5q/python-component-jcv7ut:on-pr-ef5a1f4421d272661084c2a291fd0e23c7b4e17d@sha256:3ecd5c5714579670cd938102b08c1cf7c0af2175ac96c8a18d2d54c837d20bac
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-0l5q/python-component-jcv7ut@sha256:3ecd5c5714579670cd938102b08c1cf7c0af2175ac96c8a18d2d54c837d20bac] to [quay.io/redhat-appstudio-qe/group-0l5q/python-component-jcv7ut:sha256-3ecd5c5714579670cd938102b08c1cf7c0af2175ac96c8a18d2d54c837d20bac.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-0l5q/python-component-jcv7ut@sha256:1975135fa29bd659c1fbc0ce64a336e3571cdfd11171f3e1932aa6cf7bd5ee3b
[2026-08-22T03:31:14,507140499+00:00] End upload-sbom