[2026-08-22T03:09:47,784052724+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-0l5q/python-component-jcv7ut
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-0l5q/python-component-jcv7ut:on-pr-b5b7a7111f5ad110ca8e89f86d6c9acd2d249f75@sha256:9cdd95d49e1ffc904406becde9e4efb61a64f67ba9f01d4c8eff7a3d73f300e8
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-0l5q/python-component-jcv7ut@sha256:9cdd95d49e1ffc904406becde9e4efb61a64f67ba9f01d4c8eff7a3d73f300e8] to [quay.io/redhat-appstudio-qe/group-0l5q/python-component-jcv7ut:sha256-9cdd95d49e1ffc904406becde9e4efb61a64f67ba9f01d4c8eff7a3d73f300e8.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-0l5q/python-component-jcv7ut@sha256:16fe654e4d57656af13bf9344ecde1ae28dc94830c44bc54eaeafd70b05ea2b9
[2026-08-22T03:10:13,357938252+00:00] End upload-sbom