inno-devops-labs · LegendIU · Feb 9, 2026 · May 18, 2026
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,4 @@
+
+# Lab 8 Cosign keys
+labs/lab8/signing/cosign.key
+labs/lab8/signing/cosign.pub
diff --git a/labs/lab4/syft/juice-shop-syft-native.json b/labs/lab4/syft/juice-shop-syft-native.json
diff --git a/labs/lab8/analysis/ref-after-tamper.txt b/labs/lab8/analysis/ref-after-tamper.txt
diff --git a/labs/lab8/analysis/ref.txt b/labs/lab8/analysis/ref.txt
diff --git a/labs/lab8/analysis/verify-after-tamper-expected-fail.txt b/labs/lab8/analysis/verify-after-tamper-expected-fail.txt
diff --git a/labs/lab8/analysis/verify-original-after-tamper.txt b/labs/lab8/analysis/verify-original-after-tamper.txt
diff --git a/labs/lab8/analysis/verify-original.txt b/labs/lab8/analysis/verify-original.txt
diff --git a/labs/lab8/artifacts/sample.tar.gz b/labs/lab8/artifacts/sample.tar.gz
diff --git a/labs/lab8/artifacts/sample.tar.gz.bundle b/labs/lab8/artifacts/sample.tar.gz.bundle
@@ -0,0 +1 @@
+{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial":{"publicKey":{"hint":"1ZsxBKfuiFaHilIWJD/yXMXRhfnlcuyNmiYhK3gfhbQ="}}, "messageSignature":{"messageDigest":{"algorithm":"SHA2_256", "digest":"x5VGkG761wXVjrVMVKywFHQh+2k83Cavu80pxu5TLK4="}, "signature":"MEQCICo68ONgVUrxLCnsVyVeY5nRsH55FKe5wt0X/wL7C6P0AiACTzStfwl9s08QagqOgK03xqWjkz841Ogut+p+J3S3NQ=="}}
diff --git a/labs/lab8/artifacts/sample.txt b/labs/lab8/artifacts/sample.txt
@@ -0,0 +1 @@
+sample content 2026-05-18 12:39:32Z
diff --git a/labs/lab8/artifacts/verify-blob-full.txt b/labs/lab8/artifacts/verify-blob-full.txt
diff --git a/labs/lab8/artifacts/verify-blob.stderr.txt b/labs/lab8/artifacts/verify-blob.stderr.txt
diff --git a/labs/lab8/artifacts/verify-blob.txt b/labs/lab8/artifacts/verify-blob.txt
@@ -0,0 +1,2 @@
+Verified OK
+Blob verification succeeded with exit code 0.
diff --git a/labs/lab8/attest/juice-shop.cdx.json b/labs/lab8/attest/juice-shop.cdx.json
diff --git a/labs/lab8/attest/provenance-payload-decoded.json b/labs/lab8/attest/provenance-payload-decoded.json
@@ -0,0 +1 @@
+{"_type":"https://in-toto.io/Statement/v0.1", "subject":[{"name":"localhost:5000/juice-shop", "digest":{"sha256":"547bd3fef4a6d7e25e131da68f454e6dc4a59d281f8793df6853e6796c9bbf58"}}], "predicateType":"https://slsa.dev/provenance/v0.2", "predicate":{"buildType":"manual-local-demo", "builder":{"id":"v.galkin@innopolis.university"}, "invocation":{"parameters":{"image":"localhost:5000/juice-shop@sha256:547bd3fef4a6d7e25e131da68f454e6dc4a59d281f8793df6853e6796c9bbf58"}}, "metadata":{"buildStartedOn":"2026-05-18T09:38:38Z", "completeness":{"parameters":true}}}}
diff --git a/labs/lab8/attest/provenance-payload-pretty.json b/labs/lab8/attest/provenance-payload-pretty.json
@@ -0,0 +1,29 @@
+{
+  "_type": "https://in-toto.io/Statement/v0.1",
+  "subject": [
+    {
+      "name": "localhost:5000/juice-shop",
+      "digest": {
+        "sha256": "547bd3fef4a6d7e25e131da68f454e6dc4a59d281f8793df6853e6796c9bbf58"
+      }
+    }
+  ],
+  "predicateType": "https://slsa.dev/provenance/v0.2",
+  "predicate": {
+    "buildType": "manual-local-demo",
+    "builder": {
+      "id": "v.galkin@innopolis.university"
+    },
+    "invocation": {
+      "parameters": {
+        "image": "localhost:5000/juice-shop@sha256:547bd3fef4a6d7e25e131da68f454e6dc4a59d281f8793df6853e6796c9bbf58"
+      }
+    },
+    "metadata": {
+      "buildStartedOn": "2026-05-18T09:38:38Z",
+      "completeness": {
+        "parameters": true
+      }
+    }
+  }
+}
diff --git a/labs/lab8/attest/provenance.json b/labs/lab8/attest/provenance.json
@@ -0,0 +1,18 @@
+{
+  "_type": "https://slsa.dev/provenance/v1",
+  "buildType": "manual-local-demo",
+  "builder": {
+    "id": "v.galkin@innopolis.university"
+  },
+  "invocation": {
+    "parameters": {
+      "image": "localhost:5000/juice-shop@sha256:547bd3fef4a6d7e25e131da68f454e6dc4a59d281f8793df6853e6796c9bbf58"
+    }
+  },
+  "metadata": {
+    "buildStartedOn": "2026-05-18T09:38:38Z",
+    "completeness": {
+      "parameters": true
+    }
+  }
+}
diff --git a/labs/lab8/attest/sbom-payload-decoded.json b/labs/lab8/attest/sbom-payload-decoded.json
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial":{"publicKey":{"hint":"1ZsxBKfuiFaHilIWJD/yXMXRhfnlcuyNmiYhK3gfhbQ="}}, "messageSignature":{"messageDigest":{"algorithm":"SHA2_256", "digest":"x5VGkG761wXVjrVMVKywFHQh+2k83Cavu80pxu5TLK4="}, "signature":"MEQCICo68ONgVUrxLCnsVyVeY5nRsH55FKe5wt0X/wL7C6P0AiACTzStfwl9s08QagqOgK03xqWjkz841Ogut+p+J3S3NQ=="}}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Verified OK
		Blob verification succeeded with exit code 0.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		{"_type":"https://in-toto.io/Statement/v0.1", "subject":[{"name":"localhost:5000/juice-shop", "digest":{"sha256":"547bd3fef4a6d7e25e131da68f454e6dc4a59d281f8793df6853e6796c9bbf58"}}], "predicateType":"https://slsa.dev/provenance/v0.2", "predicate":{"buildType":"manual-local-demo", "builder":{"id":"v.galkin@innopolis.university"}, "invocation":{"parameters":{"image":"localhost:5000/juice-shop@sha256:547bd3fef4a6d7e25e131da68f454e6dc4a59d281f8793df6853e6796c9bbf58"}}, "metadata":{"buildStartedOn":"2026-05-18T09:38:38Z", "completeness":{"parameters":true}}}}