[2026-10-07T15:13:47,811824778+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/gitlab-rep-5qav/test-comp-pac-gitlab-h9nqtd
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/gitlab-rep-5qav/test-comp-pac-gitlab-h9nqtd:on-pr-bef7b7cfad6839415677b79a2b92df0b419e1b20@sha256:55adb512c37ef49483fee363bf266a361f0ee67453d6dbe745e456b2db7ca99f
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/gitlab-rep-5qav/test-comp-pac-gitlab-h9nqtd@sha256:55adb512c37ef49483fee363bf266a361f0ee67453d6dbe745e456b2db7ca99f] to [quay.io/redhat-appstudio-qe/gitlab-rep-5qav/test-comp-pac-gitlab-h9nqtd:sha256-55adb512c37ef49483fee363bf266a361f0ee67453d6dbe745e456b2db7ca99f.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/gitlab-rep-5qav/test-comp-pac-gitlab-h9nqtd@sha256:9a595064a04cc76ea3c33f38b2d80a814a70d6a634f5e9fc7f4e8187db0036f9
[2026-10-07T15:14:09,989597761+00:00] End upload-sbom