feat(lab8): cosign sign + SBOM/provenance attestations + blob signing

[demonit4028]

Goal

Sign the Juice Shop image with Cosign in a local registry, attach CycloneDX SBOM + SLSA provenance attestations, and demonstrate blob signing to mitigate the Codecov 2021 attack class.

Changes

• submissions/lab8.md — full lab report with all outputs and analysis
• labs/lab8/keys/cosign.pub — public key (private key gitignored)
• labs/lab8/results/juice-shop-digest.txt — captured registry digest
• labs/lab8/results/verify-original.json — cosign verify output (pass)
• labs/lab8/results/verify-tampered.txt — cosign verify output (fail)
• labs/lab8/results/sbom-from-attestation.json — SBOM extracted from attestation
• labs/lab8/results/provenance-verify.json — provenance verification output
• labs/lab8/results/my-tool.tar.gz — signed tarball (bonus)
• labs/lab8/results/my-tool.tar.gz.bundle — blob signature bundle (bonus)

Testing

# Task 1: Sign + verify
cosign verify --key labs/lab8/keys/cosign.pub --insecure-ignore-tlog --allow-http-registry \
  localhost:5000/juice-shop@sha256:8c76bce948965bcb2ad33c24a659d58f307d679ff48ec253a3d29138329f3c0d
# PASS — signature verified against public key

# Task 1: Tamper demo
cosign verify --key labs/lab8/keys/cosign.pub --insecure-ignore-tlog --allow-http-registry \
  localhost:5000/juice-shop@sha256:6c2a9711b0a9f32b0239d9222eb1072309cf46c6431d319ae249186d811a987c
# FAIL — "no signatures found"

# Task 2: SBOM attestation verify
cosign verify-attestation --key labs/lab8/keys/cosign.pub --type cyclonedx \
  --insecure-ignore-tlog --allow-http-registry \
  localhost:5000/juice-shop@sha256:8c76bce948965bcb2ad33c24a659d58f307d679ff48ec253a3d29138329f3c0d
# PASS — 3069 components match Lab 4 SBOM

# Task 2: Provenance attestation verify
cosign verify-attestation --key labs/lab8/keys/cosign.pub --type slsaprovenance \
  --insecure-ignore-tlog --allow-http-registry \
  localhost:5000/juice-shop@sha256:8c76bce948965bcb2ad33c24a659d58f307d679ff48ec253a3d29138329f3c0d
# PASS — builder: https://localhost/lab8-student

# Bonus: Blob verify
cosign verify-blob --key cosign.pub --bundle my-tool.tar.gz.bundle \
  --insecure-ignore-tlog my-tool.tar.gz
# "Verified OK"

# Bonus: Blob tamper test
echo "MALICIOUS PAYLOAD" >> my-tool.tar.gz
cosign verify-blob --key cosign.pub --bundle my-tool.tar.gz.bundle \
  --insecure-ignore-tlog my-tool.tar.gz
# FAIL — "invalid signature"

Artifacts & Screenshots

• submissions/lab8.md — full report with all outputs and analysis questions answered

---

Checklist

• Title follows feat(labN): <topic> format
• No secrets or large temp files committed
• Submission file at submissions/lab8.md exists