[2026-08-20T06:31:14,049178153+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/integration1-rch0/test-component-pac-93q0qu
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/integration1-rch0/test-component-pac-93q0qu:on-pr-81b98dc05d267ea0aef071ffadcf3e7d09adc423@sha256:f8fa7bb311d132d568419ea86e71cb57d2fc09fc143595a9a59eb51edf514ed2
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/integration1-rch0/test-component-pac-93q0qu@sha256:f8fa7bb311d132d568419ea86e71cb57d2fc09fc143595a9a59eb51edf514ed2] to [quay.io/redhat-appstudio-qe/integration1-rch0/test-component-pac-93q0qu:sha256-f8fa7bb311d132d568419ea86e71cb57d2fc09fc143595a9a59eb51edf514ed2.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/integration1-rch0/test-component-pac-93q0qu@sha256:9439f63b3a7787962ff66d13ffe55e425a738effca1a1346454105fa2d47cbcd
[2026-08-20T06:31:53,523240801+00:00] End upload-sbom