feat(lab4): juice-shop SBOM + Grype/Trivy comparison + sign-ready attestation

[Maflock]

Goal

Generate an SBOM of the Juice Shop image with Syft, scan it with Grype, compare against Trivy's all-in-one approach, and produce a signed-ready CycloneDX SBOM for Lab 8.

Changes

• Added labs/lab4/juice-shop.cdx.json — CycloneDX 1.6 SBOM
• Added labs/lab4/juice-shop.spdx.json — SPDX SBOM
• Added labs/lab4/juice-shop-attestation.json — in-toto v1 attestation predicate for Cosign signing
• Added submissions/lab4.md — SBOM stats, Grype severity table, top-10 CVE analysis, Trivy comparison, bonus attestation docs

Testing

syft bkimminich/juice-shop:v20.0.0 \
  -o cyclonedx-json=labs/lab4/juice-shop.cdx.json

syft bkimminich/juice-shop:v20.0.0 \
  -o spdx-json=labs/lab4/juice-shop.spdx.json

ls -la labs/lab4/juice-shop.*.json
# -rwxrwxrwx 1 verdr verdr 2594746 Jun 19 21:21 labs/lab4/juice-shop.cdx.json
# -rwxrwxrwx 1 verdr verdr 4044825 Jun 19 21:21 labs/lab4/juice-shop.spdx.json

jq '.components | length' labs/lab4/juice-shop.cdx.json
# 3069

grype sbom:labs/lab4/juice-shop.cdx.json -o json --file labs/lab4/grype-from-sbom.json
# 104 total: 7 Critical, 51 High, 35 Medium, 4 Low, 7 Negligible

trivy image bkimminich/juice-shop:v20.0.0 --severity LOW,MEDIUM,HIGH,CRITICAL --format json
# 109 total: 5 Critical, 43 High, 39 Medium, 22 Low

jq '[.Results[].Vulnerabilities[]? | .Severity] | group_by(.) | map({severity: .[0], count: length})' \
  labs/lab4/trivy.json

jq '.specVersion, .bomFormat' labs/lab4/juice-shop.cdx.json
# "1.5"
# "CycloneDX"

jq '.metadata.timestamp, .metadata.tools' labs/lab4/juice-shop.cdx.json
#{
#  "components": [
#    {
#      "type": "application",
#      "author": "anchore",
#      "name": "syft",
#      "version": "1.45.1"
#    }
#  ]
#}

---

Artifacts & Screenshots

• submissions/lab4.md
• labs/lab4/juice-shop.cdx.json
• labs/lab4/juice-shop.spdx.json
• labs/lab4/juice-shop-attestation.json

Checklist

• Title is clear (feat(lab4): juice-shop SBOM + Grype/Trivy comparison + sign-ready attestation)
• No secrets/large temp files committed
• submissions/lab4.md exists
• Task 1 — Syft SBOMs + Grype scan + top-10 CVE analysis
• Task 2 — Trivy comparison + when-to-pick-each tradeoff
• Bonus — sign-ready CycloneDX attestation for Lab 8