Completed upto lesson 30

lab/lesson-30-answer.md

@@ -0,0 +1,27 @@
+docker run --rm ghcr.io/anchore/syft:v1.50.0 nginx:1.27-alpine -o cyclonedx-json > .\lab\lesson-30-sbom.json
+
+nginx:1.27-alpine, CycloneDX json
+
+        {
+          "type": "application",
+          "author": "anchore",
+          "name": "syft",
+          "version": "1.50.0"
+        }
+              "bom-ref": "7cfd11f0aac064b9",
+      "type": "container",
+      "name": "nginx",
+      "version": "1.27-alpine"
+            "bom-ref": "pkg:apk/alpine/alpine-baselayout@3.6.8-r1?arch=x86_64&distro=alpine-3.21.3&package-id=0df337d25a2602d5",
+     
+     
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "alpine-baselayout",
+      "version": "3.6.8-r1",
+      "description": "Alpine base dir structure and init scripts",
+
+
+      it inventories components but does not determine whether the image is free of vulnerabilities or safe to deploy
+
+      bom helps after new CVE by revealing if the packege is install insude the image and also if the vulnerable version is running