feat(lab4): juice-shop SBOM + Grype/Trivy comparison + sign-ready attestation

[RII6]

Goal

Generate a comprehensive Software Bill of Materials (SBOM) for the OWASP Juice Shop container, perform a decoupled Software Composition Analysis (SCA) using Grype, compare the findings against Trivy's all-in-one scanning approach, and prepare a cryptographically verifiable in-toto attestation envelope for Lab 8.

Changes

• submissions/lab4.md — Contains the full SCA report, top-10 CVE triage analysis, and the Grype vs. Trivy deep-dive comparison.
• labs/lab4/juice-shop.cdx.json & juice-shop.spdx.json — Generated SBOMs via Syft.
• labs/lab4/juice-shop-attestation.json — Bonus attestation envelope natively wrapping the CycloneDX 1.6 predicate.
• .pre-commit-config.yaml — Updated check-added-large-files hook argument to --maxkb=5000 to legitimately allow tracking the heavy SBOM artifacts (~3 MB).

Testing & Results

Task 1 — Syft + Grype (Decoupled SCA)

• Extracted 3068 components into CycloneDX v1.5 and SPDX formats.
• grype sbom:... scan resulted in 97 total vulnerabilities (7 Critical, 48 High).
• Identified immediate patching priorities using the Triage Shortcut (Critical/High with available fixes), such as jsonwebtoken, lodash, and crypto-js.

Task 2 — Trivy (All-in-one SCA)

• Direct image scan yielded 102 total vulnerabilities (5 Critical, 40 High).
• Comparison finding 1 (OS Noise filtering): Trivy filtered out CVE-2026-5450 (libc6) because Debian marked it as "won't fix", while Grype reported it strictly based on the SBOM.
• Comparison finding 2 (Database differences): For lodash Prototype Pollution, Grype reported the NPM-native GHSA-jf85-cpcp-j695, whereas Trivy reported the NVD-standard CVE-2019-10744.
• Comparison finding 3 (Filesystem secrets): Trivy successfully discovered an AsymmetricPrivateKey (RSA key) embedded in insecurity.ts, demonstrating the advantage of its broad image-scanning scope over Grype's pure SBOM analysis.

Bonus — Sign-Ready Attestation

• Successfully captured the immutable sha256 digest using docker inspect.
• Used a continuous jq pipeline to generate the https://in-toto.io/Statement/v1 envelope natively binding the Juice Shop digest to the https://cyclonedx.org/bom/v1.5 predicate.

Checklist

• Task 1 — Syft SBOMs + Grype scan + top-10 CVE analysis
• Task 2 — Trivy comparison + when-to-pick-each tradeoff
• Bonus — sign-ready CycloneDX attestation for Lab 8