Pull Request

Goal

Comparing Syft SBOM Generation + Grype SCA and trivy in vulnerability detection

Changes

• Edited .gitignore to ignore specified files
• Increased file size in pre-commmit. (packages turned out larger than expected)
• Added labs/lab4/juice-shop.cdx.json
• Added labs/lab4/juice-shop.spdx.json
• Added labs/lab4/juice-shop.attestation.json

Testing

• Commands run and observed output

git switch main && git pull
git switch -c feature/lab4
mkdir -p labs/lab4
# generate SBOMs
syft bkimminich/juice-shop:v20.0.0 -o cyclonedx-json=labs/lab4/juice-shop.cdx.json
syft bkimminich/juice-shop:v20.0.0 -o spdx-json=labs/lab4/juice-shop.spdx.json
# scan SBOM
grype sbom:labs/lab4/juice-shop.cdx.json -o json --file labs/lab4/grype-from-sbom.json
# image scan
trivy imaimminich/juice-shop:v20.0.0 --severity LOW,MEDIUM,HIGH,CRITICAL --format json --output labs/lab4/trivy.json
# generate attestation predicate
# (contents already produced locally in labs/lab4/juice-shop-attestation.json)ge bk

Artifacts & Screenshots

Ex nihilo nihil fit

PR checklist

• Task 1 — labs/lab4/juice-shop.cdx.json + labs/lab4/juice-shop.spdx.json + Grype counts
• Task 2 — Trivy comparison + divergent CVEs
• Bonus — sign-ready attestation predicate
  --
• Title uses feat(labN): <topic> style
• No secrets/large temp files committed
• submissions/labN.md present