[2026-08-21T05:21:58,955958455+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-bsua/go-component-ucmhoi
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-bsua/go-component-ucmhoi:03cb86caa8c4beb4867eef588d0dfdbb4e7768f2@sha256:e744a03cd05a3dc083dd0ccc88472db7f7c05fdd5eb8a29db4ced3a1bb41dd11
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-bsua/go-component-ucmhoi@sha256:e744a03cd05a3dc083dd0ccc88472db7f7c05fdd5eb8a29db4ced3a1bb41dd11] to [quay.io/redhat-appstudio-qe/group-bsua/go-component-ucmhoi:sha256-e744a03cd05a3dc083dd0ccc88472db7f7c05fdd5eb8a29db4ced3a1bb41dd11.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-bsua/go-component-ucmhoi@sha256:18a74d69987782ef6f503edf8b92d607d6643d092399c742d50679595637f055
[2026-08-21T05:22:25,430972324+00:00] End upload-sbom