lab8 completed

[MikeNovikoff]

Goal

Lab 8 — Supply Chain Security: Cosign sign + SBOM/provenance attestation + blob signing

---

Changes

• Task 1: Local registry, image sign, tamper demo
• Task 2: CycloneDX SBOM + SLSA provenance attestations
• Bonus: Blob signing (Codecov 2021 mitigation)

---

Testing

cosign verify          → PASSED (original digest)
cosign verify          → FAILED (tampered re-tag, correctly)
cosign verify-attestation --type cyclonedx       → PASSED
cosign verify-attestation --type slsaprovenance  → PASSED
cosign verify-blob     → PASSED (original)
cosign verify-blob     → FAILED (tampered, correctly)

---

Artifacts

• submissions/lab8.md
• labs/lab8/keys/cosign.pub
• labs/lab8/results/

---

Checklist

• Title is clear (feat(lab8): <topic>)
• No secrets/large temp files committed
• submissions/lab8.md exists

• Task 1 — Image signed + tamper demo (both shown)
• Task 2 — SBOM + provenance attestations attached and verified
• Bonus — Blob signed + verify-blob success + tamper failure

---

Personal Notes