feat(lab4): juice-shop SBOM + Grype/Trivy comparison + sign-ready attestation

[semyonnadutkin]

Goal

Generate SBOMs with Syft, analyze them with Grype, compare results with Trivy, and generate a sign-ready attestation for Cosign.

Changes

• Added submissions/lab4.md, labs/lab4/juice-shop.cdx.json, labs/lab4/juice-shop.spdx.json, labs/lab4/juice-shop-attestation.json

Testing

The generated JSON files were validated for JSON syntax using jq.

Commands executed:

jq empty labs/lab4/juice-shop.cdx.json labs/lab4/juice-shop.spdx.json labs/lab4/juice-shop-attestation.json

Observed output:

(No output suggests that the JSONs are valid)

Artifacts & Screenshots

Artifacts

• submissions/lab4.md
• labs/lab4/juice-shop.cdx.json
• labs/lab4/juice-shop.spdx.json
• labs/lab4/juice-shop-attestation.json

Checklist

• Title is clear (feat(labN): <topic> style)
• No secrets/large temp files committed
• Submission file at submissions/labN.md exists

• Task 1 — Syft SBOMs + Grype scan + top-10 CVE analysis
• Task 2 — Trivy comparison + when-to-pick-each tradeoff
• Bonus — sign-ready CycloneDX attestation for Lab 8