feat(lab8): implement image signing, attestations and blob verification with Cosign

[d13-l1t3]

Goal

To implement and validate software supply chain security practices using Sigstore cosign. This includes signing Docker images to prevent tampering, attaching SBOM and SLSA Provenance attestations to verify the build process, and signing arbitrary blobs to mitigate attacks similar to the Codecov 2021 incident.

Changes

• Generated a local Cosign key pair.
• Pushed and signed the juice-shop:v20.0.0 image in a local registry (localhost:5000).
• Attached a CycloneDX SBOM attestation (cosign attest --type cyclonedx).
• Created and attached a SLSA Provenance attestation (cosign attest --type slsaprovenance).
• Created a dummy installer script, packaged it into a tar.gz archive, and signed it using cosign sign-blob.
• Completed the lab8.md report with terminal outputs and explanations regarding digest binding importance and the Codecov 2021 mitigation.

Testing

• Task 1 (Image Signing): Successfully verified the original signed image. Conducted a tamper demo by re-tagging an alpine:3.20 image as juice-shop; cosign verify correctly failed and rejected the tampered image.
• Task 2 (Attestations): Extracted the SBOM payload from the registry using cosign verify-attestation and confirmed it perfectly matches the original Lab 4 SBOM component count. Successfully verified the SLSA Provenance attestation.
• Bonus (Blob Signing): Verified the original .tar.gz bundle. Appended a malicious payload to the archive, which was successfully detected and blocked by cosign verify-blob with an ASN.1 signature validation error.

Artifacts & Screenshots

• Updated lab8.md report containing all required execution logs and theoretical answers.
• Locally generated outputs:
  • verify-original.json
  • verify-tampered.txt
  • sbom-from-attestation.json
  • provenance-verify.json
  • blob-tamper.txt

Checklist

• Title is clear (feat(labN): style)
• No secrets/large temp files committed
• Submission file at lab8.md exists
• Task 1 — Image signed + tamper demo (both shown)
• Task 2 — SBOM + provenance attestations attached and verified
• Bonus — Blob signed + verify-blob success + tamper failure