feat(lab8): cosign sign + SBOM/provenance attestations + blob signing

[Maflock]

Goal

Sign the Juice Shop image with Cosign in a local registry, attach the CycloneDX SBOM from Lab 4 as an attestation, and (bonus) sign a tarball using cosign sign-blob to mitigate the Codecov 2021 attack class.

Changes

• Added submissions/lab8.md
• Added labs/lab8/keys/cosign.pub
• Also was added but not commited the labs/lab8/results/containing:
  • juice-shop-digest.txt
  • verify-original.json
  • verify-tampered.txt
  • sbom-from-attestation.json
  • provenance-verify.json
  • my-tool.tar.gz
  • my-tool.tar.gz.bundle

Testing

COSIGN_PASSWORD="***" cosign sign --key labs/lab8/keys/cosign.key --yes "$DIGEST"
# tlog entry created with index: 2063595522
# Pushing signature to: localhost:5000/juice-shop


cosign verify --key labs/lab8/keys/cosign.pub --insecure-ignore-tlog "$DIGEST"
# Verification for localhost:5000/juice-shop@sha256:fd58bdc974... --
# The following checks were performed on each of these signatures:
#   - The cosign claims were validated
#   - The signatures were verified against the specified public key


cosign verify --key labs/lab8/keys/cosign.pub --insecure-ignore-tlog "localhost:5000/juice-shop@sha256:<tampered>"
# Error: no signatures found
# error during command execution: no signatures found


cosign attest --key labs/lab8/keys/cosign.key --type cyclonedx --predicate labs/lab4/juice-shop.cdx.json --yes "$DIGEST"
# tlog entry created with index: 2063635627


cosign verify-blob --key cosign.pub --bundle my-tool.tar.gz.bundle --insecure-ignore-tlog my-tool.tar.gz
# Verified OK


echo "MALICIOUS PAYLOAD" >> my-tool.tar.gz
cosign verify-blob --key cosign.pub --bundle my-tool.tar.gz.bundle --insecure-ignore-tlog my-tool.tar.gz
# Error: invalid signature when validating ASN.1 encoded signature

---

Artifacts & Screenshots

• submissions/lab8.md
• labs/lab8/keys/cosign.pub

Checklist

• Title is clear (feat(lab8): cosign sign + SBOM/provenance attestations + blob signing)
• No secrets/large temp files committed
• submissions/lab8.md exists
• Task 1 — Image signed + tamper demo (both shown)
• Task 2 — SBOM + provenance attestations attached and verified
• Bonus — Blob signed + verify-blob success + tamper failure