Complete Lab 4

[MMenshikh]

Goal

Generate SBOMs and perform Software Composition Analysis (SCA) for OWASP
Juice Shop (bkimminich/juice-shop:v19.0.0) using Syft, Grype, and
Trivy.
Compare Syft+Grype vs Trivy all-in-one approach.

Changes

• Generated SBOMs with Syft and Trivy
• Performed vulnerability scanning with Grype and Trivy
• Conducted license and secrets scanning with Trivy
• Compared package detection and CVE overlap
• Added analysis in labs/submission4.md

Testing

• Pulled required Docker images (syft, grype, trivy, juice-shop)
• Successfully generated SBOM JSON and table outputs
• Executed vulnerability scans with both tools
• Verified analysis and comparison files were created
• Confirmed all artifacts committed without errors

Artifacts & Screenshots

Included: - labs/lab4/syft/ - labs/lab4/trivy/ - labs/lab4/analysis/ -
labs/lab4/comparison/

---

Checklist

• Clear PR title
• Documentation updated if needed
• No secrets or large temporary files