feat(lab4): SBOM generation, SCA analysis, Trivy comparison, and Cosign-ready attestation

[Wilikson173]

Goal

Generate SBOMs for the Juice Shop container using Syft, perform vulnerability analysis with Grype, compare results with Trivy, and produce a CycloneDX SBOM prepared for signing and future attestation in Lab 8.

Changes

• Added CycloneDX SBOM: labs/lab4/juice-shop.cdx.json
• Added SPDX SBOM: labs/lab4/juice-shop.spdx.json
• Added Cosign-ready attestation: labs/lab4/juice-shop-attestation.json
• Added analysis report: submissions/lab4.md
• Performed Syft-based SBOM generation for Juice Shop v20.0.0
• Performed Grype vulnerability scan (SBOM-based)
• Performed Trivy image scan for comparison (not committed as per lab instructions)

Testing

docker images | grep juice-shop

syft bkimminich/juice-shop:v20.0.0 -o cyclonedx-json=labs/lab4/juice-shop.cdx.json

syft bkimminich/juice-shop:v20.0.0 -o spdx-json=labs/lab4/juice-shop.spdx.json

grype sbom:labs/lab4/juice-shop.cdx.json -o table

trivy image bkimminich/juice-shop:v20.0.0 --severity HIGH,CRITICAL

jq '.bomFormat, .specVersion' labs/lab4/juice-shop.cdx.json
jq '.components | length' labs/lab4/juice-shop.cdx.json

Artifacts & Screenshots

• submissions/lab4.md
• labs/lab4/juice-shop.cdx.json
• labs/lab4/juice-shop.spdx.json
• labs/lab4/juice-shop-attestation.json

Checklist

• Title follows feat(lab4): style
• No secrets or large temp files committed
• Submission file exists at submissions/lab4.md