[2026-08-21T01:13:50,502613237+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-xhxr/konflux-test-integration-clone-86bmpw
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-xhxr/konflux-test-integration-clone-86bmpw:on-pr-d396c11fa8b9ca2f34e224610292b3063478bc41@sha256:2da500c0ff64d4cba27a43c77f0b6d6ead788c9d4493ab05384a769bf1598188
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-xhxr/konflux-test-integration-clone-86bmpw@sha256:2da500c0ff64d4cba27a43c77f0b6d6ead788c9d4493ab05384a769bf1598188] to [quay.io/redhat-appstudio-qe/group-xhxr/konflux-test-integration-clone-86bmpw:sha256-2da500c0ff64d4cba27a43c77f0b6d6ead788c9d4493ab05384a769bf1598188.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-xhxr/konflux-test-integration-clone-86bmpw@sha256:d3e30574f2193b94443c91757c461d376dd24564ce8dec859e74c80bc8c82758
[2026-08-21T01:14:17,026326660+00:00] End upload-sbom