[2026-08-21T05:14:33,038590589+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-bsua/go-component-ucmhoi
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-bsua/go-component-ucmhoi:on-pr-1541ffc9f2d88972641508789568917539116e84@sha256:91328cc6350c9241aafdab7dbff177024369a0020bfade12521c043d3307d699
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-bsua/go-component-ucmhoi@sha256:91328cc6350c9241aafdab7dbff177024369a0020bfade12521c043d3307d699] to [quay.io/redhat-appstudio-qe/group-bsua/go-component-ucmhoi:sha256-91328cc6350c9241aafdab7dbff177024369a0020bfade12521c043d3307d699.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-bsua/go-component-ucmhoi@sha256:5e7f34df9027f069b17611120a878bb092b8e567e89780061855bb35e2d53ee3
[2026-08-21T05:14:58,916865756+00:00] End upload-sbom