[2026-10-07T14:57:00,497500805+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-oto3/python-component-36z5ud
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-oto3/python-component-36z5ud:b80796c6f292f60354d8403e0c78e8594ca9d6eb@sha256:a827600eae56d2b4b1cf160f32c936b0017ff02777393c052eba18c4143e9e69
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-oto3/python-component-36z5ud@sha256:a827600eae56d2b4b1cf160f32c936b0017ff02777393c052eba18c4143e9e69] to [quay.io/redhat-appstudio-qe/group-oto3/python-component-36z5ud:sha256-a827600eae56d2b4b1cf160f32c936b0017ff02777393c052eba18c4143e9e69.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-oto3/python-component-36z5ud@sha256:740d8dc4159aa7880c1cfd8ea76a137c4ab19af620106e67b29f6ba1f65c6a41
[2026-10-07T14:57:22,254796018+00:00] End upload-sbom