[2026-10-07T13:07:07,922096136+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-wxye/python-component-bcmhj5
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-wxye/python-component-bcmhj5:on-pr-dca2f6b4ca39270055a5f2bd671d44bbb4a1ae77@sha256:c4b4897cc74ee68859ef0697f163a91b49294ab7ea9c0fb65ff8bc82611d5776
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-wxye/python-component-bcmhj5@sha256:c4b4897cc74ee68859ef0697f163a91b49294ab7ea9c0fb65ff8bc82611d5776] to [quay.io/redhat-appstudio-qe/group-wxye/python-component-bcmhj5:sha256-c4b4897cc74ee68859ef0697f163a91b49294ab7ea9c0fb65ff8bc82611d5776.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-wxye/python-component-bcmhj5@sha256:bda6a5c811be9711867b250516ff2964a76ff72ee8b3c8ab085b85d3b22028cf
[2026-10-07T13:07:43,656898394+00:00] End upload-sbom