[2026-08-19T06:01:11,895482326+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-g4bu/python-component-8lfbzz
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-g4bu/python-component-8lfbzz:on-pr-056a70c0c5f9f57f7dabc9ac5b1af309eae93fcc@sha256:cc2b0429e9a1038e42e674b5b03e28f67a7a6d6d3ac46d5d89daa3bbe592c2b1
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-g4bu/python-component-8lfbzz@sha256:cc2b0429e9a1038e42e674b5b03e28f67a7a6d6d3ac46d5d89daa3bbe592c2b1] to [quay.io/redhat-appstudio-qe/group-g4bu/python-component-8lfbzz:sha256-cc2b0429e9a1038e42e674b5b03e28f67a7a6d6d3ac46d5d89daa3bbe592c2b1.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-g4bu/python-component-8lfbzz@sha256:f156f916963c10d9281ca526864f1d0c0685c98f578d576dd4c0daa75a23258f
[2026-08-19T06:01:50,337949714+00:00] End upload-sbom