Lab4 submission: Basanov Maxim

[scruffyscarf]

Goal

Generate Software Bills of Materials (SBOMs) for OWASP Juice Shop using Syft and Trivy, perform comprehensive Software Composition Analysis with Grype and Trivy, then compare the toolchain capabilities.

Changes

• Added labs/submission4.md
• Added labs/lab4/analysis/sbom-analysis.txt
• Added labs/lab4/analysis/vulnerability-analysis.txt
• Added labs/lab4/comparison/accuracy-analysis.txt
• Added labs/lab4/comparison/common-packages.txt
• Added labs/lab4/comparison/grype-cves.txt
• Added labs/lab4/comparison/syft-only.txt
• Added labs/lab4/comparison/syft-packages.txt
• Added labs/lab4/comparison/trivy-cves.txt
• Added labs/lab4/comparison/trivy-only.txt
• Added labs/lab4/comparison/trivy-packages.txt
• Added labs/lab4/syft/grype-vuln-results.json
• Added labs/lab4/syft/grype-vuln-table.txt
• Added labs/lab4/syft/juice-shop-licenses.txt
• Added labs/lab4/syft/juice-shop-syft-native.json
• Added labs/lab4/syft/juice-shop-syft-table.txt
• Added labs/lab4/trivy/juice-shop-trivy-detailed.json
• Added labs/lab4/trivy/juice-shop-trivy-table.txt
• Added labs/lab4/trivy/trivy-licenses.json
• Added labs/lab4/trivy/trivy-secrets.txt
• Added labs/lab4/trivy/trivy-vuln-detailed.json

Testing

No testing

Artifacts & Screenshots

labs/lab4/
├── analysis/
│   ├── sbom-analysis.txt
│   └── vulnerability-analysis.txt
├── comparison/
│   ├── accuracy-analysis.txt
│   ├── common-packages.txt
│   ├── syft-only.txt
│   └── trivy-only.txt
├── syft/
│   ├── juice-shop-syft-native.json
│   ├── juice-shop-syft-table.txt
│   ├── grype-vuln-results.json
│   └── grype-vuln-table.txt
└── trivy/
    ├── juice-shop-trivy-detailed.json
    ├── juice-shop-trivy-table.txt
    ├── trivy-vuln-detailed.json
    ├── trivy-secrets.txt
    └── trivy-licenses.json

Checklist

• Task 1 done — SBOM Generation with Syft and Trivy
• Task 2 done — SCA with Grype and Trivy
• Task 3 done — Comprehensive Toolchain Comparison
• PR has a clear and descriptive title
• Documentation has been updated if necessary
• No sensitive data or large temporary files have been committed