SBOM generation, SCA analysis, and toolchain comparison (Lab 4)

[Boogyy]

Goal

Implement SBOM generation and Software Composition Analysis for OWASP Juice Shop using Syft, Grype, and Trivy, and provide a comprehensive comparison of the toolchains.

Changes

• Generated SBOMs with Syft and Trivy
• Performed vulnerability analysis using Grype and Trivy
• Compared package and vulnerability detection accuracy
• Documented findings and recommendations

Testing

• Verified SBOM generation using both tools
• Validated vulnerability counts and severity distribution
• Cross-checked overlap between Grype and Trivy results
• Confirmed secrets scanning results

Artifacts & Screenshots

• SBOM JSON and table outputs (Syft & Trivy)
• Vulnerability reports (Grype & Trivy)
• License analysis files
• Toolchain comparison metrics

---

Checklist

• Task 1 completed — SBOM Generation with Syft and Trivy
• Task 2 completed — SCA with Grype and Trivy
• Task 3 completed — Toolchain comparison and analysis
• All generated artifacts committed
• No secrets or temporary files committed