[2026-08-12T12:22:12,436372087+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-vxjp/konflux-test-integration-clone-dq3b8l
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-vxjp/konflux-test-integration-clone-dq3b8l:on-pr-c0017fc55b4b6198d05d12b4caf83f4bcc0fb9f7@sha256:e99b0b0e772b11f01d1b348fd2b8844a1a6fe23514e2db3315128e69ffe78a09
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-vxjp/konflux-test-integration-clone-dq3b8l@sha256:e99b0b0e772b11f01d1b348fd2b8844a1a6fe23514e2db3315128e69ffe78a09] to [quay.io/redhat-appstudio-qe/group-vxjp/konflux-test-integration-clone-dq3b8l:sha256-e99b0b0e772b11f01d1b348fd2b8844a1a6fe23514e2db3315128e69ffe78a09.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-vxjp/konflux-test-integration-clone-dq3b8l@sha256:799415e9e7b7d2b3bcc42e77c4fe4cec57ec8c49fe542ce2340f227dcf84d360
[2026-08-12T12:22:38,704498597+00:00] End upload-sbom