[2026-07-02T15:02:27,660904473+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/integration1-dbzp/test-component-pac-as278r
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/integration1-dbzp/test-component-pac-as278r:on-pr-18819817037678897a93f2a9ae445534f53df5ad@sha256:f0a2c150e92f8b3390a72e05005a4ed94b05d77e13ec6a376f2433c9e255242a
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/integration1-dbzp/test-component-pac-as278r@sha256:f0a2c150e92f8b3390a72e05005a4ed94b05d77e13ec6a376f2433c9e255242a] to [quay.io/redhat-appstudio-qe/integration1-dbzp/test-component-pac-as278r:sha256-f0a2c150e92f8b3390a72e05005a4ed94b05d77e13ec6a376f2433c9e255242a.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/integration1-dbzp/test-component-pac-as278r@sha256:41de65c390742c2dfd6cee27dd6ad50d3db05c4ea5324bc86b346de4d15a0306
[2026-07-02T15:02:53,968360629+00:00] End upload-sbom