docs: update generated docs (#981)

diff --git a/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html b/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html
index 5c29a7e..86d6758 100644
--- a/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html
+++ b/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html
@@ -124,441 +124,19 @@
 { # Request to create occurrences in batch.
     "occurrences": [ # Required. The occurrences to create. Max allowed length is 1000.
       { # An instance of an analysis type that has been found on a resource.
-        "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
-            # specified. This field can be used as a filter in list requests.
-        "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
-          "name": "A String", # Deprecated, do not use. Use uri instead.
-              #
-              # The name of the resource. For example, the name of a Docker image -
-              # "Debian".
-          "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
-              #
-              # The hash of the resource content. For example, the Docker digest.
-            "type": "A String", # Required. The type of hash that was performed.
-            "value": "A String", # Required. The hash value.
-          },
-          "uri": "A String", # Required. The unique URI of the resource. For example,
-              # `https://gcr.io/project/image@sha256:foo` for a Docker image.
-        },
-        "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
-          "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
-              # attestation can be verified using the attached signature. If the verifier
-              # trusts the public key of the signer, then verifying the signature is
-              # sufficient to establish trust. In this circumstance, the authority to which
-              # this attestation is attached is primarily useful for look-up (how to find
-              # this attestation if you already know the authority and artifact to be
-              # verified) and intent (which authority was this attestation intended to sign
-              # for).
-            "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
-                # supports `ATTACHED` signatures, where the payload that is signed is included
-                # alongside the signature itself in the same file.
-              "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
-                  # The verifier must ensure that the provided type is one that the verifier
-                  # supports, and that the attestation payload is a valid instantiation of that
-                  # type (for example by validating a JSON schema).
-              "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
-                  # (GPG) or equivalent. Since this message only supports attached signatures,
-                  # the payload that was signed must be attached. While the signature format
-                  # supported is dependent on the verification implementation, currently only
-                  # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
-                  # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
-                  # --output=signature.gpg payload.json` will create the signature content
-                  # expected in this field in `signature.gpg` for the `payload.json`
-                  # attestation payload.
-              "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
-                  # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
-                  # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
-                  # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
-                  # Implementations may choose to acknowledge "LONG", "SHORT", or other
-                  # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
-                  # In gpg, the full fingerprint can be retrieved from the `fpr` field
-                  # returned when calling --list-keys with --with-colons.  For example:
-                  # ```
-                  # gpg --with-colons --with-fingerprint --force-v4-certs \
-                  #     --list-keys attester@example.com
-                  # tru::1:1513631572:0:3:1:5
-                  # pub:...<SNIP>...
-                  # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
-                  # ```
-                  # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
-            },
-            "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
-                # This attestation must define the `serialized_payload` that the `signatures`
-                # verify and any metadata necessary to interpret that plaintext.  The
-                # signatures should always be over the `serialized_payload` bytestring.
-              "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
-                  # The verifier must ensure that the provided type is one that the verifier
-                  # supports, and that the attestation payload is a valid instantiation of that
-                  # type (for example by validating a JSON schema).
-              "signatures": [ # One or more signatures over `serialized_payload`.  Verifier implementations
-                  # should consider this attestation message verified if at least one
-                  # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
-                  # for more details on signature structure and verification.
-                { # Verifiers (e.g. Kritis implementations) MUST verify signatures
-                    # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
-                    # Typically this means that the verifier has been configured with a map from
-                    # `public_key_id` to public key material (and any required parameters, e.g.
-                    # signing algorithm).
-                    #
-                    # In particular, verification implementations MUST NOT treat the signature
-                    # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
-                    # DOES NOT validate or authenticate a public key; it only provides a mechanism
-                    # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
-                    # a trusted channel. Verification implementations MUST reject signatures in any
-                    # of the following circumstances:
-                    #   * The `public_key_id` is not recognized by the verifier.
-                    #   * The public key that `public_key_id` refers to does not verify the
-                    #     signature with respect to the payload.
-                    #
-                    # The `signature` contents SHOULD NOT be "attached" (where the payload is
-                    # included with the serialized `signature` bytes). Verifiers MUST ignore any
-                    # "attached" payload and only verify signatures with respect to explicitly
-                    # provided payload (e.g. a `payload` field on the proto message that holds
-                    # this Signature, or the canonical serialization of the proto message that
-                    # holds this signature).
-                  "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
-                      #   * The `public_key_id` is required.
-                      #   * The `public_key_id` MUST be an RFC3986 conformant URI.
-                      #   * When possible, the `public_key_id` SHOULD be an immutable reference,
-                      #     such as a cryptographic digest.
-                      #
-                      # Examples of valid `public_key_id`s:
-                      #
-                      # OpenPGP V4 public key fingerprint:
-                      #   * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
-                      # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
-                      # details on this scheme.
-                      #
-                      # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
-                      # serialization):
-                      #   * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
-                      #   * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
-                  "signature": "A String", # The content of the signature, an opaque bytestring.
-                      # The payload that this signature verifies MUST be unambiguously provided
-                      # with the Signature during verification. A wrapper message might provide
-                      # the payload explicitly. Alternatively, a message might have a canonical
-                      # serialization that can always be unambiguously computed to derive the
-                      # payload.
-                },
-              ],
-              "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
-                  # The encoding and semantic meaning of this payload must match what is set in
-                  # `content_type`.
-            },
-          },
-        },
+        "createTime": "A String", # Output only. The time this occurrence was created.
         "name": "A String", # Output only. The name of the occurrence in the form of
             # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
-        "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
-          "longDescription": "A String", # Output only. A detailed description of this vulnerability.
-          "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
-          "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
-              # available, and note provider assigned severity when distro has not yet
-              # assigned a severity for this vulnerability.
-          "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
-          "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
-              # scale of 0-10 where 0 indicates low severity and 10 indicates high
-              # severity.
-          "relatedUrls": [ # Output only. URLs related to this vulnerability.
-            { # Metadata for any related URL information.
-              "url": "A String", # Specific URL associated with the resource.
-              "label": "A String", # Label to describe usage of the URL.
-            },
-          ],
-          "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
-              # packages etc)
-          "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
-              # within the associated resource.
-            { # This message wraps a location affected by a vulnerability and its
-                # associated fix (if one is available).
-              "severityName": "A String", # Deprecated, use Details.effective_severity instead
-                  # The severity (e.g., distro assigned severity) for this vulnerability.
-              "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
-                "package": "A String", # Required. The package being described.
-                "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-                  "revision": "A String", # The iteration of the package build from the above version.
-                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
-                      # name.
-                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                      # versions.
-                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
-                },
-                "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                    # format. Examples include distro or storage location for vulnerable jar.
-              },
-              "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
-                "package": "A String", # Required. The package being described.
-                "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-                  "revision": "A String", # The iteration of the package build from the above version.
-                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
-                      # name.
-                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                      # versions.
-                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
-                },
-                "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                    # format. Examples include distro or storage location for vulnerable jar.
-              },
-            },
-          ],
-        },
-        "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
-          "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
-              # system.
-            "location": [ # Required. All of the places within the filesystem versions of this package
-                # have been found.
-              { # An occurrence of a particular package installation found within a system's
-                  # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
-                "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
-                    # denoting the package manager version distributing a package.
-                "version": { # Version contains structured information about the version of a package. # The version installed at this location.
-                  "revision": "A String", # The iteration of the package build from the above version.
-                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
-                      # name.
-                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                      # versions.
-                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
-                },
-                "path": "A String", # The path from which we gathered that this package/version is installed.
-              },
-            ],
-            "name": "A String", # Output only. The name of the installed package.
-          },
-        },
-        "build": { # Details of a build occurrence. # Describes a verifiable build.
-          "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
-              # build signature in the corresponding build note. After verifying the
-              # signature, `provenance_bytes` can be unmarshalled and compared to the
-              # provenance to confirm that it is unchanged. A base64-encoded string
-              # representation of the provenance bytes is used for the signature in order
-              # to interoperate with openssl which expects this format for signature
-              # verification.
-              #
-              # The serialized form is captured both to avoid ambiguity in how the
-              # provenance is marshalled to json as well to prevent incompatibilities with
-              # future changes.
-          "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
-              # details about the build from source to completion.
-            "endTime": "A String", # Time at which execution of the build was finished.
-            "startTime": "A String", # Time at which execution of the build was started.
-            "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
-            "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
-              "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
-                  # location.
-              "additionalContexts": [ # If provided, some of the source code used for the build may be found in
-                  # these locations, in the case where the source repository had multiple
-                  # remotes or submodules. This list will not include the context specified in
-                  # the context field.
-                { # A SourceContext is a reference to a tree of files. A SourceContext together
-                    # with a path point to a unique revision of a single file or directory.
-                  "labels": { # Labels with user defined metadata.
-                    "a_key": "A String",
-                  },
-                  "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                      # repository (e.g., GitHub).
-                    "url": "A String", # Git repository URL.
-                    "revisionId": "A String", # Git commit hash.
-                  },
-                  "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-                    "hostUri": "A String", # The URI of a running Gerrit instance.
-                    "revisionId": "A String", # A revision (commit) ID.
-                    "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
-                        # "project/subproject" is a valid project name. The "repo name" is the
-                        # hostURI/project.
-                    "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                      "name": "A String", # The alias name.
-                      "kind": "A String", # The alias kind.
-                    },
-                  },
-                  "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                      # Source Repo.
-                    "revisionId": "A String", # A revision ID.
-                    "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                      "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                          # winged-cargo-31) and a repo name within that project.
-                        "projectId": "A String", # The ID of the project.
-                        "repoName": "A String", # The name of the repo. Leave empty for the default repo.
-                      },
-                      "uid": "A String", # A server-assigned, globally unique identifier.
-                    },
-                    "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                      "name": "A String", # The alias name.
-                      "kind": "A String", # The alias kind.
-                    },
-                  },
-                },
-              ],
-              "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
-                  # source integrity was maintained in the build.
-                  #
-                  # The keys to this map are file paths used as build source and the values
-                  # contain the hash values for those files.
-                  #
-                  # If the build source came in a single package such as a gzipped tarfile
-                  # (.tar.gz), the FileHash will be for the single path to that file.
-                "a_key": { # Container message for hashes of byte content of files, used in source
-                    # messages to verify integrity of source input to the build.
-                  "fileHash": [ # Required. Collection of file hashes.
-                    { # Container message for hash values.
-                      "type": "A String", # Required. The type of hash that was performed.
-                      "value": "A String", # Required. The hash value.
-                    },
-                  ],
-                },
-              },
-              "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
-                  # with a path point to a unique revision of a single file or directory.
-                "labels": { # Labels with user defined metadata.
-                  "a_key": "A String",
-                },
-                "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                    # repository (e.g., GitHub).
-                  "url": "A String", # Git repository URL.
-                  "revisionId": "A String", # Git commit hash.
-                },
-                "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-                  "hostUri": "A String", # The URI of a running Gerrit instance.
-                  "revisionId": "A String", # A revision (commit) ID.
-                  "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
-                      # "project/subproject" is a valid project name. The "repo name" is the
-                      # hostURI/project.
-                  "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                    "name": "A String", # The alias name.
-                    "kind": "A String", # The alias kind.
-                  },
-                },
-                "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                    # Source Repo.
-                  "revisionId": "A String", # A revision ID.
-                  "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                    "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                        # winged-cargo-31) and a repo name within that project.
-                      "projectId": "A String", # The ID of the project.
-                      "repoName": "A String", # The name of the repo. Leave empty for the default repo.
-                    },
-                    "uid": "A String", # A server-assigned, globally unique identifier.
-                  },
-                  "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                    "name": "A String", # The alias name.
-                    "kind": "A String", # The alias kind.
-                  },
-                },
-              },
-            },
-            "createTime": "A String", # Time at which the build was created.
-            "projectId": "A String", # ID of the project.
-            "logsUri": "A String", # URI where any logs for this provenance were written.
-            "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
-                # user's e-mail address at the time the build was initiated; this address may
-                # not represent the same end-user for all time.
-            "builderVersion": "A String", # Version string of the builder at the time this build was executed.
-            "commands": [ # Commands requested by the build.
-              { # Command describes a step performed as part of the build pipeline.
-                "dir": "A String", # Working directory (relative to project source root) used when running this
-                    # command.
-                "waitFor": [ # The ID(s) of the command(s) that this command depends on.
-                  "A String",
-                ],
-                "env": [ # Environment variables set before running this command.
-                  "A String",
-                ],
-                "args": [ # Command-line arguments used when executing this command.
-                  "A String",
-                ],
-                "name": "A String", # Required. Name of the command, as presented on the command line, or if the
-                    # command is packaged as a Docker container, as presented to `docker pull`.
-                "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
-                    # this command as a dependency.
-              },
-            ],
-            "builtArtifacts": [ # Output of the build.
-              { # Artifact describes a build product.
-                "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
-                    # container.
-                "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
-                    # like `gcr.io/projectID/imagename@sha256:123456`.
-                "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
-                    # the case of a container build, the name used to push the container image to
-                    # Google Container Registry, as presented to `docker push`. Note that a
-                    # single Artifact ID can have multiple names, for example if two tags are
-                    # applied to one image.
-                  "A String",
-                ],
-              },
-            ],
-            "id": "A String", # Required. Unique identifier of the build.
-            "buildOptions": { # Special options applied to this build. This is a catch-all field where
-                # build providers can enter any desired additional details.
-              "a_key": "A String",
-            },
-          },
-        },
-        "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
-          "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
-            "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
-                # details to show to the user. The LocalizedMessage is output only and
-                # populated by the API.
-                # different programming environments, including REST APIs and RPC APIs. It is
-                # used by [gRPC](https://github.com/grpc). Each `Status` message contains
-                # three pieces of data: error code, error message, and error details.
-                #
-                # You can find out more about this error model and how to work with it in the
-                # [API Design Guide](https://cloud.google.com/apis/design/errors).
-              "details": [ # A list of messages that carry the error details.  There is a common set of
-                  # message types for APIs to use.
-                {
-                  "a_key": "", # Properties of the object. Contains field @type with type URL.
-                },
-              ],
-              "code": 42, # The status code, which should be an enum value of google.rpc.Code.
-              "message": "A String", # A developer-facing error message, which should be in English. Any
-                  # user-facing error message should be localized and sent in the
-                  # google.rpc.Status.details field, or localized by the client.
-            },
-            "analysisStatus": "A String", # The status of discovery for the resource.
-            "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
-            "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
-                # Deprecated, do not use.
-          },
-        },
-        "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
-            # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
-            # used as a filter in list requests.
-        "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
-          "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
-            "userEmail": "A String", # Identity of the user that triggered this deployment.
-            "config": "A String", # Configuration used to create this deployment.
-            "undeployTime": "A String", # End of the lifetime of this deployment.
-            "platform": "A String", # Platform hosting this deployment.
-            "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
-            "address": "A String", # Address of the runtime element hosting this deployment.
-            "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
-                # the deployable field with the same name.
-              "A String",
-            ],
-          },
-        },
-        "createTime": "A String", # Output only. The time this occurrence was created.
-        "updateTime": "A String", # Output only. The time this occurrence was last updated.
-        "remediation": "A String", # A description of actions that can be taken to remedy the note.
         "intoto": { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
             # signatures and the in-toto link itself. This is used for occurrences of a
             # Grafeas in-toto note.
-          "signed": { # This corresponds to an in-toto link.
-            "command": [ # This field contains the full command executed for the step. This can also
-                # be empty if links are generated for operations that aren't directly mapped
-                # to a specific command. Each term in the command is an independent string
-                # in the list. An example of a command in the in-toto metadata field is:
-                # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
-              "A String",
-            ],
-            "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
-                # are not the actual result of the step.
-                # fields are "stderr", "stdout", and "return-value".
-              "customValues": {
-                "a_key": "A String",
-              },
+          "signatures": [
+            { # A signature object consists of the KeyID used and the signature itself.
+              "sig": "A String",
+              "keyid": "A String",
             },
+          ],
+          "signed": { # This corresponds to an in-toto link.
             "environment": { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
                 # environment. It is suggested for this field to contain information that
                 # details environment variables, filesystem information, and the present
@@ -604,29 +182,442 @@
                 "resourceUri": "A String",
               },
             ],
+            "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
+                # are not the actual result of the step.
+                # fields are "stderr", "stdout", and "return-value".
+              "customValues": {
+                "a_key": "A String",
+              },
+            },
+            "command": [ # This field contains the full command executed for the step. This can also
+                # be empty if links are generated for operations that aren't directly mapped
+                # to a specific command. Each term in the command is an independent string
+                # in the list. An example of a command in the in-toto metadata field is:
+                # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
+              "A String",
+            ],
           },
-          "signatures": [
-            { # A signature object consists of the KeyID used and the signature itself.
-              "sig": "A String",
-              "keyid": "A String",
+        },
+        "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
+          "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
+              #
+              # The hash of the resource content. For example, the Docker digest.
+            "type": "A String", # Required. The type of hash that was performed.
+            "value": "A String", # Required. The hash value.
+          },
+          "uri": "A String", # Required. The unique URI of the resource. For example,
+              # `https://gcr.io/project/image@sha256:foo` for a Docker image.
+          "name": "A String", # Deprecated, do not use. Use uri instead.
+              #
+              # The name of the resource. For example, the name of a Docker image -
+              # "Debian".
+        },
+        "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
+          "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
+              # attestation can be verified using the attached signature. If the verifier
+              # trusts the public key of the signer, then verifying the signature is
+              # sufficient to establish trust. In this circumstance, the authority to which
+              # this attestation is attached is primarily useful for look-up (how to find
+              # this attestation if you already know the authority and artifact to be
+              # verified) and intent (which authority was this attestation intended to sign
+              # for).
+            "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
+                # This attestation must define the `serialized_payload` that the `signatures`
+                # verify and any metadata necessary to interpret that plaintext.  The
+                # signatures should always be over the `serialized_payload` bytestring.
+              "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
+                  # The verifier must ensure that the provided type is one that the verifier
+                  # supports, and that the attestation payload is a valid instantiation of that
+                  # type (for example by validating a JSON schema).
+              "signatures": [ # One or more signatures over `serialized_payload`.  Verifier implementations
+                  # should consider this attestation message verified if at least one
+                  # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
+                  # for more details on signature structure and verification.
+                { # Verifiers (e.g. Kritis implementations) MUST verify signatures
+                    # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
+                    # Typically this means that the verifier has been configured with a map from
+                    # `public_key_id` to public key material (and any required parameters, e.g.
+                    # signing algorithm).
+                    #
+                    # In particular, verification implementations MUST NOT treat the signature
+                    # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
+                    # DOES NOT validate or authenticate a public key; it only provides a mechanism
+                    # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
+                    # a trusted channel. Verification implementations MUST reject signatures in any
+                    # of the following circumstances:
+                    #   * The `public_key_id` is not recognized by the verifier.
+                    #   * The public key that `public_key_id` refers to does not verify the
+                    #     signature with respect to the payload.
+                    #
+                    # The `signature` contents SHOULD NOT be "attached" (where the payload is
+                    # included with the serialized `signature` bytes). Verifiers MUST ignore any
+                    # "attached" payload and only verify signatures with respect to explicitly
+                    # provided payload (e.g. a `payload` field on the proto message that holds
+                    # this Signature, or the canonical serialization of the proto message that
+                    # holds this signature).
+                  "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
+                      #   * The `public_key_id` is required.
+                      #   * The `public_key_id` SHOULD be an RFC3986 conformant URI.
+                      #   * When possible, the `public_key_id` SHOULD be an immutable reference,
+                      #     such as a cryptographic digest.
+                      #
+                      # Examples of valid `public_key_id`s:
+                      #
+                      # OpenPGP V4 public key fingerprint:
+                      #   * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
+                      # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
+                      # details on this scheme.
+                      #
+                      # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
+                      # serialization):
+                      #   * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
+                      #   * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
+                  "signature": "A String", # The content of the signature, an opaque bytestring.
+                      # The payload that this signature verifies MUST be unambiguously provided
+                      # with the Signature during verification. A wrapper message might provide
+                      # the payload explicitly. Alternatively, a message might have a canonical
+                      # serialization that can always be unambiguously computed to derive the
+                      # payload.
+                },
+              ],
+              "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
+                  # The encoding and semantic meaning of this payload must match what is set in
+                  # `content_type`.
+            },
+            "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
+                # supports `ATTACHED` signatures, where the payload that is signed is included
+                # alongside the signature itself in the same file.
+              "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
+                  # (GPG) or equivalent. Since this message only supports attached signatures,
+                  # the payload that was signed must be attached. While the signature format
+                  # supported is dependent on the verification implementation, currently only
+                  # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
+                  # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
+                  # --output=signature.gpg payload.json` will create the signature content
+                  # expected in this field in `signature.gpg` for the `payload.json`
+                  # attestation payload.
+              "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
+                  # The verifier must ensure that the provided type is one that the verifier
+                  # supports, and that the attestation payload is a valid instantiation of that
+                  # type (for example by validating a JSON schema).
+              "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
+                  # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
+                  # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
+                  # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
+                  # Implementations may choose to acknowledge "LONG", "SHORT", or other
+                  # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
+                  # In gpg, the full fingerprint can be retrieved from the `fpr` field
+                  # returned when calling --list-keys with --with-colons.  For example:
+                  # ```
+                  # gpg --with-colons --with-fingerprint --force-v4-certs \
+                  #     --list-keys attester@example.com
+                  # tru::1:1513631572:0:3:1:5
+                  # pub:...<SNIP>...
+                  # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
+                  # ```
+                  # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
+            },
+          },
+        },
+        "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
+          "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
+            "undeployTime": "A String", # End of the lifetime of this deployment.
+            "userEmail": "A String", # Identity of the user that triggered this deployment.
+            "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
+                # the deployable field with the same name.
+              "A String",
+            ],
+            "platform": "A String", # Platform hosting this deployment.
+            "config": "A String", # Configuration used to create this deployment.
+            "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
+            "address": "A String", # Address of the runtime element hosting this deployment.
+          },
+        },
+        "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
+            # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
+            # used as a filter in list requests.
+        "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
+          "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
+              # system.
+            "name": "A String", # Output only. The name of the installed package.
+            "location": [ # Required. All of the places within the filesystem versions of this package
+                # have been found.
+              { # An occurrence of a particular package installation found within a system's
+                  # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
+                "path": "A String", # The path from which we gathered that this package/version is installed.
+                "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
+                    # denoting the package manager version distributing a package.
+                "version": { # Version contains structured information about the version of a package. # The version installed at this location.
+                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                      # versions.
+                  "revision": "A String", # The iteration of the package build from the above version.
+                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
+                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
+                      # name.
+                },
+              },
+            ],
+          },
+        },
+        "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
+          "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
+          "relatedUrls": [ # Output only. URLs related to this vulnerability.
+            { # Metadata for any related URL information.
+              "url": "A String", # Specific URL associated with the resource.
+              "label": "A String", # Label to describe usage of the URL.
             },
           ],
+          "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
+              # available, and note provider assigned severity when distro has not yet
+              # assigned a severity for this vulnerability.
+          "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
+          "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
+              # packages etc)
+          "longDescription": "A String", # Output only. A detailed description of this vulnerability.
+          "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
+              # scale of 0-10 where 0 indicates low severity and 10 indicates high
+              # severity.
+          "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
+              # within the associated resource.
+            { # This message wraps a location affected by a vulnerability and its
+                # associated fix (if one is available).
+              "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
+                "package": "A String", # Required. The package being described.
+                "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                    # format. Examples include distro or storage location for vulnerable jar.
+                "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                      # versions.
+                  "revision": "A String", # The iteration of the package build from the above version.
+                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
+                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
+                      # name.
+                },
+              },
+              "severityName": "A String", # Deprecated, use Details.effective_severity instead
+                  # The severity (e.g., distro assigned severity) for this vulnerability.
+              "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
+                "package": "A String", # Required. The package being described.
+                "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                    # format. Examples include distro or storage location for vulnerable jar.
+                "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                      # versions.
+                  "revision": "A String", # The iteration of the package build from the above version.
+                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
+                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
+                      # name.
+                },
+              },
+            },
+          ],
+        },
+        "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
+          "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
+            "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
+                # Deprecated, do not use.
+            "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
+                # details to show to the user. The LocalizedMessage is output only and
+                # populated by the API.
+                # different programming environments, including REST APIs and RPC APIs. It is
+                # used by [gRPC](https://github.com/grpc). Each `Status` message contains
+                # three pieces of data: error code, error message, and error details.
+                #
+                # You can find out more about this error model and how to work with it in the
+                # [API Design Guide](https://cloud.google.com/apis/design/errors).
+              "message": "A String", # A developer-facing error message, which should be in English. Any
+                  # user-facing error message should be localized and sent in the
+                  # google.rpc.Status.details field, or localized by the client.
+              "code": 42, # The status code, which should be an enum value of google.rpc.Code.
+              "details": [ # A list of messages that carry the error details.  There is a common set of
+                  # message types for APIs to use.
+                {
+                  "a_key": "", # Properties of the object. Contains field @type with type URL.
+                },
+              ],
+            },
+            "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
+            "analysisStatus": "A String", # The status of discovery for the resource.
+          },
+        },
+        "updateTime": "A String", # Output only. The time this occurrence was last updated.
+        "build": { # Details of a build occurrence. # Describes a verifiable build.
+          "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
+              # details about the build from source to completion.
+            "endTime": "A String", # Time at which execution of the build was finished.
+            "builderVersion": "A String", # Version string of the builder at the time this build was executed.
+            "startTime": "A String", # Time at which execution of the build was started.
+            "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
+                # user's e-mail address at the time the build was initiated; this address may
+                # not represent the same end-user for all time.
+            "logsUri": "A String", # URI where any logs for this provenance were written.
+            "builtArtifacts": [ # Output of the build.
+              { # Artifact describes a build product.
+                "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
+                    # the case of a container build, the name used to push the container image to
+                    # Google Container Registry, as presented to `docker push`. Note that a
+                    # single Artifact ID can have multiple names, for example if two tags are
+                    # applied to one image.
+                  "A String",
+                ],
+                "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
+                    # like `gcr.io/projectID/imagename@sha256:123456`.
+                "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
+                    # container.
+              },
+            ],
+            "buildOptions": { # Special options applied to this build. This is a catch-all field where
+                # build providers can enter any desired additional details.
+              "a_key": "A String",
+            },
+            "id": "A String", # Required. Unique identifier of the build.
+            "projectId": "A String", # ID of the project.
+            "commands": [ # Commands requested by the build.
+              { # Command describes a step performed as part of the build pipeline.
+                "waitFor": [ # The ID(s) of the command(s) that this command depends on.
+                  "A String",
+                ],
+                "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
+                    # this command as a dependency.
+                "dir": "A String", # Working directory (relative to project source root) used when running this
+                    # command.
+                "args": [ # Command-line arguments used when executing this command.
+                  "A String",
+                ],
+                "name": "A String", # Required. Name of the command, as presented on the command line, or if the
+                    # command is packaged as a Docker container, as presented to `docker pull`.
+                "env": [ # Environment variables set before running this command.
+                  "A String",
+                ],
+              },
+            ],
+            "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
+              "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
+                  # with a path point to a unique revision of a single file or directory.
+                "labels": { # Labels with user defined metadata.
+                  "a_key": "A String",
+                },
+                "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+                  "hostUri": "A String", # The URI of a running Gerrit instance.
+                  "revisionId": "A String", # A revision (commit) ID.
+                  "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
+                      # "project/subproject" is a valid project name. The "repo name" is the
+                      # hostURI/project.
+                  "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                    "kind": "A String", # The alias kind.
+                    "name": "A String", # The alias name.
+                  },
+                },
+                "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                    # repository (e.g., GitHub).
+                  "revisionId": "A String", # Git commit hash.
+                  "url": "A String", # Git repository URL.
+                },
+                "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                    # Source Repo.
+                  "revisionId": "A String", # A revision ID.
+                  "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                    "uid": "A String", # A server-assigned, globally unique identifier.
+                    "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                        # winged-cargo-31) and a repo name within that project.
+                      "projectId": "A String", # The ID of the project.
+                      "repoName": "A String", # The name of the repo. Leave empty for the default repo.
+                    },
+                  },
+                  "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                    "kind": "A String", # The alias kind.
+                    "name": "A String", # The alias name.
+                  },
+                },
+              },
+              "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
+                  # location.
+              "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
+                  # source integrity was maintained in the build.
+                  #
+                  # The keys to this map are file paths used as build source and the values
+                  # contain the hash values for those files.
+                  #
+                  # If the build source came in a single package such as a gzipped tarfile
+                  # (.tar.gz), the FileHash will be for the single path to that file.
+                "a_key": { # Container message for hashes of byte content of files, used in source
+                    # messages to verify integrity of source input to the build.
+                  "fileHash": [ # Required. Collection of file hashes.
+                    { # Container message for hash values.
+                      "type": "A String", # Required. The type of hash that was performed.
+                      "value": "A String", # Required. The hash value.
+                    },
+                  ],
+                },
+              },
+              "additionalContexts": [ # If provided, some of the source code used for the build may be found in
+                  # these locations, in the case where the source repository had multiple
+                  # remotes or submodules. This list will not include the context specified in
+                  # the context field.
+                { # A SourceContext is a reference to a tree of files. A SourceContext together
+                    # with a path point to a unique revision of a single file or directory.
+                  "labels": { # Labels with user defined metadata.
+                    "a_key": "A String",
+                  },
+                  "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+                    "hostUri": "A String", # The URI of a running Gerrit instance.
+                    "revisionId": "A String", # A revision (commit) ID.
+                    "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
+                        # "project/subproject" is a valid project name. The "repo name" is the
+                        # hostURI/project.
+                    "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                      "kind": "A String", # The alias kind.
+                      "name": "A String", # The alias name.
+                    },
+                  },
+                  "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                      # repository (e.g., GitHub).
+                    "revisionId": "A String", # Git commit hash.
+                    "url": "A String", # Git repository URL.
+                  },
+                  "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                      # Source Repo.
+                    "revisionId": "A String", # A revision ID.
+                    "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                      "uid": "A String", # A server-assigned, globally unique identifier.
+                      "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                          # winged-cargo-31) and a repo name within that project.
+                        "projectId": "A String", # The ID of the project.
+                        "repoName": "A String", # The name of the repo. Leave empty for the default repo.
+                      },
+                    },
+                    "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                      "kind": "A String", # The alias kind.
+                      "name": "A String", # The alias name.
+                    },
+                  },
+                },
+              ],
+            },
+            "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
+            "createTime": "A String", # Time at which the build was created.
+          },
+          "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
+              # build signature in the corresponding build note. After verifying the
+              # signature, `provenance_bytes` can be unmarshalled and compared to the
+              # provenance to confirm that it is unchanged. A base64-encoded string
+              # representation of the provenance bytes is used for the signature in order
+              # to interoperate with openssl which expects this format for signature
+              # verification.
+              #
+              # The serialized form is captured both to avoid ambiguity in how the
+              # provenance is marshalled to json as well to prevent incompatibilities with
+              # future changes.
         },
         "derivedImage": { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
             # note.
           "derivedImage": { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
               # relationship. This image would be produced from a Dockerfile with FROM
               # <DockerImage.Basis in attached Note>.
-            "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
-              "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
-                "A String",
-              ],
-              "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
-                  # representation.
-              "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
-                  #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
-                  # Only the name of the final blob is kept.
-            },
+            "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
+                # occurrence.
+            "distance": 42, # Output only. The number of layers by which this image differs from the
+                # associated image basis.
             "layerInfo": [ # This contains layer-specific metadata, if populated it has length
                 # "distance" and is ordered with [distance] being the layer immediately
                 # following the base image and [1] being the final layer.
@@ -635,12 +626,21 @@
                 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
               },
             ],
-            "distance": 42, # Output only. The number of layers by which this image differs from the
-                # associated image basis.
-            "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
-                # occurrence.
+            "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
+              "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
+                  # representation.
+              "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
+                "A String",
+              ],
+              "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
+                  #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
+                  # Only the name of the final blob is kept.
+            },
           },
         },
+        "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
+            # specified. This field can be used as a filter in list requests.
+        "remediation": "A String", # A description of actions that can be taken to remedy the note.
       },
     ],
   }
@@ -656,441 +656,19 @@
     { # Response for creating occurrences in batch.
     "occurrences": [ # The occurrences that were created.
       { # An instance of an analysis type that has been found on a resource.
-        "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
-            # specified. This field can be used as a filter in list requests.
-        "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
-          "name": "A String", # Deprecated, do not use. Use uri instead.
-              #
-              # The name of the resource. For example, the name of a Docker image -
-              # "Debian".
-          "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
-              #
-              # The hash of the resource content. For example, the Docker digest.
-            "type": "A String", # Required. The type of hash that was performed.
-            "value": "A String", # Required. The hash value.
-          },
-          "uri": "A String", # Required. The unique URI of the resource. For example,
-              # `https://gcr.io/project/image@sha256:foo` for a Docker image.
-        },
-        "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
-          "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
-              # attestation can be verified using the attached signature. If the verifier
-              # trusts the public key of the signer, then verifying the signature is
-              # sufficient to establish trust. In this circumstance, the authority to which
-              # this attestation is attached is primarily useful for look-up (how to find
-              # this attestation if you already know the authority and artifact to be
-              # verified) and intent (which authority was this attestation intended to sign
-              # for).
-            "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
-                # supports `ATTACHED` signatures, where the payload that is signed is included
-                # alongside the signature itself in the same file.
-              "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
-                  # The verifier must ensure that the provided type is one that the verifier
-                  # supports, and that the attestation payload is a valid instantiation of that
-                  # type (for example by validating a JSON schema).
-              "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
-                  # (GPG) or equivalent. Since this message only supports attached signatures,
-                  # the payload that was signed must be attached. While the signature format
-                  # supported is dependent on the verification implementation, currently only
-                  # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
-                  # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
-                  # --output=signature.gpg payload.json` will create the signature content
-                  # expected in this field in `signature.gpg` for the `payload.json`
-                  # attestation payload.
-              "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
-                  # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
-                  # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
-                  # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
-                  # Implementations may choose to acknowledge "LONG", "SHORT", or other
-                  # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
-                  # In gpg, the full fingerprint can be retrieved from the `fpr` field
-                  # returned when calling --list-keys with --with-colons.  For example:
-                  # ```
-                  # gpg --with-colons --with-fingerprint --force-v4-certs \
-                  #     --list-keys attester@example.com
-                  # tru::1:1513631572:0:3:1:5
-                  # pub:...<SNIP>...
-                  # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
-                  # ```
-                  # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
-            },
-            "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
-                # This attestation must define the `serialized_payload` that the `signatures`
-                # verify and any metadata necessary to interpret that plaintext.  The
-                # signatures should always be over the `serialized_payload` bytestring.
-              "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
-                  # The verifier must ensure that the provided type is one that the verifier
-                  # supports, and that the attestation payload is a valid instantiation of that
-                  # type (for example by validating a JSON schema).
-              "signatures": [ # One or more signatures over `serialized_payload`.  Verifier implementations
-                  # should consider this attestation message verified if at least one
-                  # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
-                  # for more details on signature structure and verification.
-                { # Verifiers (e.g. Kritis implementations) MUST verify signatures
-                    # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
-                    # Typically this means that the verifier has been configured with a map from
-                    # `public_key_id` to public key material (and any required parameters, e.g.
-                    # signing algorithm).
-                    #
-                    # In particular, verification implementations MUST NOT treat the signature
-                    # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
-                    # DOES NOT validate or authenticate a public key; it only provides a mechanism
-                    # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
-                    # a trusted channel. Verification implementations MUST reject signatures in any
-                    # of the following circumstances:
-                    #   * The `public_key_id` is not recognized by the verifier.
-                    #   * The public key that `public_key_id` refers to does not verify the
-                    #     signature with respect to the payload.
-                    #
-                    # The `signature` contents SHOULD NOT be "attached" (where the payload is
-                    # included with the serialized `signature` bytes). Verifiers MUST ignore any
-                    # "attached" payload and only verify signatures with respect to explicitly
-                    # provided payload (e.g. a `payload` field on the proto message that holds
-                    # this Signature, or the canonical serialization of the proto message that
-                    # holds this signature).
-                  "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
-                      #   * The `public_key_id` is required.
-                      #   * The `public_key_id` MUST be an RFC3986 conformant URI.
-                      #   * When possible, the `public_key_id` SHOULD be an immutable reference,
-                      #     such as a cryptographic digest.
-                      #
-                      # Examples of valid `public_key_id`s:
-                      #
-                      # OpenPGP V4 public key fingerprint:
-                      #   * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
-                      # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
-                      # details on this scheme.
-                      #
-                      # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
-                      # serialization):
-                      #   * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
-                      #   * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
-                  "signature": "A String", # The content of the signature, an opaque bytestring.
-                      # The payload that this signature verifies MUST be unambiguously provided
-                      # with the Signature during verification. A wrapper message might provide
-                      # the payload explicitly. Alternatively, a message might have a canonical
-                      # serialization that can always be unambiguously computed to derive the
-                      # payload.
-                },
-              ],
-              "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
-                  # The encoding and semantic meaning of this payload must match what is set in
-                  # `content_type`.
-            },
-          },
-        },
+        "createTime": "A String", # Output only. The time this occurrence was created.
         "name": "A String", # Output only. The name of the occurrence in the form of
             # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
-        "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
-          "longDescription": "A String", # Output only. A detailed description of this vulnerability.
-          "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
-          "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
-              # available, and note provider assigned severity when distro has not yet
-              # assigned a severity for this vulnerability.
-          "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
-          "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
-              # scale of 0-10 where 0 indicates low severity and 10 indicates high
-              # severity.
-          "relatedUrls": [ # Output only. URLs related to this vulnerability.
-            { # Metadata for any related URL information.
-              "url": "A String", # Specific URL associated with the resource.
-              "label": "A String", # Label to describe usage of the URL.
-            },
-          ],
-          "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
-              # packages etc)
-          "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
-              # within the associated resource.
-            { # This message wraps a location affected by a vulnerability and its
-                # associated fix (if one is available).
-              "severityName": "A String", # Deprecated, use Details.effective_severity instead
-                  # The severity (e.g., distro assigned severity) for this vulnerability.
-              "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
-                "package": "A String", # Required. The package being described.
-                "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-                  "revision": "A String", # The iteration of the package build from the above version.
-                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
-                      # name.
-                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                      # versions.
-                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
-                },
-                "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                    # format. Examples include distro or storage location for vulnerable jar.
-              },
-              "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
-                "package": "A String", # Required. The package being described.
-                "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-                  "revision": "A String", # The iteration of the package build from the above version.
-                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
-                      # name.
-                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                      # versions.
-                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
-                },
-                "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                    # format. Examples include distro or storage location for vulnerable jar.
-              },
-            },
-          ],
-        },
-        "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
-          "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
-              # system.
-            "location": [ # Required. All of the places within the filesystem versions of this package
-                # have been found.
-              { # An occurrence of a particular package installation found within a system's
-                  # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
-                "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
-                    # denoting the package manager version distributing a package.
-                "version": { # Version contains structured information about the version of a package. # The version installed at this location.
-                  "revision": "A String", # The iteration of the package build from the above version.
-                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
-                      # name.
-                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                      # versions.
-                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
-                },
-                "path": "A String", # The path from which we gathered that this package/version is installed.
-              },
-            ],
-            "name": "A String", # Output only. The name of the installed package.
-          },
-        },
-        "build": { # Details of a build occurrence. # Describes a verifiable build.
-          "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
-              # build signature in the corresponding build note. After verifying the
-              # signature, `provenance_bytes` can be unmarshalled and compared to the
-              # provenance to confirm that it is unchanged. A base64-encoded string
-              # representation of the provenance bytes is used for the signature in order
-              # to interoperate with openssl which expects this format for signature
-              # verification.
-              #
-              # The serialized form is captured both to avoid ambiguity in how the
-              # provenance is marshalled to json as well to prevent incompatibilities with
-              # future changes.
-          "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
-              # details about the build from source to completion.
-            "endTime": "A String", # Time at which execution of the build was finished.
-            "startTime": "A String", # Time at which execution of the build was started.
-            "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
-            "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
-              "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
-                  # location.
-              "additionalContexts": [ # If provided, some of the source code used for the build may be found in
-                  # these locations, in the case where the source repository had multiple
-                  # remotes or submodules. This list will not include the context specified in
-                  # the context field.
-                { # A SourceContext is a reference to a tree of files. A SourceContext together
-                    # with a path point to a unique revision of a single file or directory.
-                  "labels": { # Labels with user defined metadata.
-                    "a_key": "A String",
-                  },
-                  "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                      # repository (e.g., GitHub).
-                    "url": "A String", # Git repository URL.
-                    "revisionId": "A String", # Git commit hash.
-                  },
-                  "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-                    "hostUri": "A String", # The URI of a running Gerrit instance.
-                    "revisionId": "A String", # A revision (commit) ID.
-                    "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
-                        # "project/subproject" is a valid project name. The "repo name" is the
-                        # hostURI/project.
-                    "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                      "name": "A String", # The alias name.
-                      "kind": "A String", # The alias kind.
-                    },
-                  },
-                  "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                      # Source Repo.
-                    "revisionId": "A String", # A revision ID.
-                    "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                      "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                          # winged-cargo-31) and a repo name within that project.
-                        "projectId": "A String", # The ID of the project.
-                        "repoName": "A String", # The name of the repo. Leave empty for the default repo.
-                      },
-                      "uid": "A String", # A server-assigned, globally unique identifier.
-                    },
-                    "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                      "name": "A String", # The alias name.
-                      "kind": "A String", # The alias kind.
-                    },
-                  },
-                },
-              ],
-              "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
-                  # source integrity was maintained in the build.
-                  #
-                  # The keys to this map are file paths used as build source and the values
-                  # contain the hash values for those files.
-                  #
-                  # If the build source came in a single package such as a gzipped tarfile
-                  # (.tar.gz), the FileHash will be for the single path to that file.
-                "a_key": { # Container message for hashes of byte content of files, used in source
-                    # messages to verify integrity of source input to the build.
-                  "fileHash": [ # Required. Collection of file hashes.
-                    { # Container message for hash values.
-                      "type": "A String", # Required. The type of hash that was performed.
-                      "value": "A String", # Required. The hash value.
-                    },
-                  ],
-                },
-              },
-              "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
-                  # with a path point to a unique revision of a single file or directory.
-                "labels": { # Labels with user defined metadata.
-                  "a_key": "A String",
-                },
-                "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                    # repository (e.g., GitHub).
-                  "url": "A String", # Git repository URL.
-                  "revisionId": "A String", # Git commit hash.
-                },
-                "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-                  "hostUri": "A String", # The URI of a running Gerrit instance.
-                  "revisionId": "A String", # A revision (commit) ID.
-                  "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
-                      # "project/subproject" is a valid project name. The "repo name" is the
-                      # hostURI/project.
-                  "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                    "name": "A String", # The alias name.
-                    "kind": "A String", # The alias kind.
-                  },
-                },
-                "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                    # Source Repo.
-                  "revisionId": "A String", # A revision ID.
-                  "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                    "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                        # winged-cargo-31) and a repo name within that project.
-                      "projectId": "A String", # The ID of the project.
-                      "repoName": "A String", # The name of the repo. Leave empty for the default repo.
-                    },
-                    "uid": "A String", # A server-assigned, globally unique identifier.
-                  },
-                  "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                    "name": "A String", # The alias name.
-                    "kind": "A String", # The alias kind.
-                  },
-                },
-              },
-            },
-            "createTime": "A String", # Time at which the build was created.
-            "projectId": "A String", # ID of the project.
-            "logsUri": "A String", # URI where any logs for this provenance were written.
-            "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
-                # user's e-mail address at the time the build was initiated; this address may
-                # not represent the same end-user for all time.
-            "builderVersion": "A String", # Version string of the builder at the time this build was executed.
-            "commands": [ # Commands requested by the build.
-              { # Command describes a step performed as part of the build pipeline.
-                "dir": "A String", # Working directory (relative to project source root) used when running this
-                    # command.
-                "waitFor": [ # The ID(s) of the command(s) that this command depends on.
-                  "A String",
-                ],
-                "env": [ # Environment variables set before running this command.
-                  "A String",
-                ],
-                "args": [ # Command-line arguments used when executing this command.
-                  "A String",
-                ],
-                "name": "A String", # Required. Name of the command, as presented on the command line, or if the
-                    # command is packaged as a Docker container, as presented to `docker pull`.
-                "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
-                    # this command as a dependency.
-              },
-            ],
-            "builtArtifacts": [ # Output of the build.
-              { # Artifact describes a build product.
-                "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
-                    # container.
-                "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
-                    # like `gcr.io/projectID/imagename@sha256:123456`.
-                "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
-                    # the case of a container build, the name used to push the container image to
-                    # Google Container Registry, as presented to `docker push`. Note that a
-                    # single Artifact ID can have multiple names, for example if two tags are
-                    # applied to one image.
-                  "A String",
-                ],
-              },
-            ],
-            "id": "A String", # Required. Unique identifier of the build.
-            "buildOptions": { # Special options applied to this build. This is a catch-all field where
-                # build providers can enter any desired additional details.
-              "a_key": "A String",
-            },
-          },
-        },
-        "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
-          "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
-            "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
-                # details to show to the user. The LocalizedMessage is output only and
-                # populated by the API.
-                # different programming environments, including REST APIs and RPC APIs. It is
-                # used by [gRPC](https://github.com/grpc). Each `Status` message contains
-                # three pieces of data: error code, error message, and error details.
-                #
-                # You can find out more about this error model and how to work with it in the
-                # [API Design Guide](https://cloud.google.com/apis/design/errors).
-              "details": [ # A list of messages that carry the error details.  There is a common set of
-                  # message types for APIs to use.
-                {
-                  "a_key": "", # Properties of the object. Contains field @type with type URL.
-                },
-              ],
-              "code": 42, # The status code, which should be an enum value of google.rpc.Code.
-              "message": "A String", # A developer-facing error message, which should be in English. Any
-                  # user-facing error message should be localized and sent in the
-                  # google.rpc.Status.details field, or localized by the client.
-            },
-            "analysisStatus": "A String", # The status of discovery for the resource.
-            "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
-            "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
-                # Deprecated, do not use.
-          },
-        },
-        "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
-            # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
-            # used as a filter in list requests.
-        "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
-          "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
-            "userEmail": "A String", # Identity of the user that triggered this deployment.
-            "config": "A String", # Configuration used to create this deployment.
-            "undeployTime": "A String", # End of the lifetime of this deployment.
-            "platform": "A String", # Platform hosting this deployment.
-            "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
-            "address": "A String", # Address of the runtime element hosting this deployment.
-            "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
-                # the deployable field with the same name.
-              "A String",
-            ],
-          },
-        },
-        "createTime": "A String", # Output only. The time this occurrence was created.
-        "updateTime": "A String", # Output only. The time this occurrence was last updated.
-        "remediation": "A String", # A description of actions that can be taken to remedy the note.
         "intoto": { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
             # signatures and the in-toto link itself. This is used for occurrences of a
             # Grafeas in-toto note.
-          "signed": { # This corresponds to an in-toto link.
-            "command": [ # This field contains the full command executed for the step. This can also
-                # be empty if links are generated for operations that aren't directly mapped
-                # to a specific command. Each term in the command is an independent string
-                # in the list. An example of a command in the in-toto metadata field is:
-                # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
-              "A String",
-            ],
-            "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
-                # are not the actual result of the step.
-                # fields are "stderr", "stdout", and "return-value".
-              "customValues": {
-                "a_key": "A String",
-              },
+          "signatures": [
+            { # A signature object consists of the KeyID used and the signature itself.
+              "sig": "A String",
+              "keyid": "A String",
             },
+          ],
+          "signed": { # This corresponds to an in-toto link.
             "environment": { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
                 # environment. It is suggested for this field to contain information that
                 # details environment variables, filesystem information, and the present
@@ -1136,29 +714,442 @@
                 "resourceUri": "A String",
               },
             ],
+            "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
+                # are not the actual result of the step.
+                # fields are "stderr", "stdout", and "return-value".
+              "customValues": {
+                "a_key": "A String",
+              },
+            },
+            "command": [ # This field contains the full command executed for the step. This can also
+                # be empty if links are generated for operations that aren't directly mapped
+                # to a specific command. Each term in the command is an independent string
+                # in the list. An example of a command in the in-toto metadata field is:
+                # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
+              "A String",
+            ],
           },
-          "signatures": [
-            { # A signature object consists of the KeyID used and the signature itself.
-              "sig": "A String",
-              "keyid": "A String",
+        },
+        "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
+          "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
+              #
+              # The hash of the resource content. For example, the Docker digest.
+            "type": "A String", # Required. The type of hash that was performed.
+            "value": "A String", # Required. The hash value.
+          },
+          "uri": "A String", # Required. The unique URI of the resource. For example,
+              # `https://gcr.io/project/image@sha256:foo` for a Docker image.
+          "name": "A String", # Deprecated, do not use. Use uri instead.
+              #
+              # The name of the resource. For example, the name of a Docker image -
+              # "Debian".
+        },
+        "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
+          "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
+              # attestation can be verified using the attached signature. If the verifier
+              # trusts the public key of the signer, then verifying the signature is
+              # sufficient to establish trust. In this circumstance, the authority to which
+              # this attestation is attached is primarily useful for look-up (how to find
+              # this attestation if you already know the authority and artifact to be
+              # verified) and intent (which authority was this attestation intended to sign
+              # for).
+            "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
+                # This attestation must define the `serialized_payload` that the `signatures`
+                # verify and any metadata necessary to interpret that plaintext.  The
+                # signatures should always be over the `serialized_payload` bytestring.
+              "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
+                  # The verifier must ensure that the provided type is one that the verifier
+                  # supports, and that the attestation payload is a valid instantiation of that
+                  # type (for example by validating a JSON schema).
+              "signatures": [ # One or more signatures over `serialized_payload`.  Verifier implementations
+                  # should consider this attestation message verified if at least one
+                  # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
+                  # for more details on signature structure and verification.
+                { # Verifiers (e.g. Kritis implementations) MUST verify signatures
+                    # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
+                    # Typically this means that the verifier has been configured with a map from
+                    # `public_key_id` to public key material (and any required parameters, e.g.
+                    # signing algorithm).
+                    #
+                    # In particular, verification implementations MUST NOT treat the signature
+                    # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
+                    # DOES NOT validate or authenticate a public key; it only provides a mechanism
+                    # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
+                    # a trusted channel. Verification implementations MUST reject signatures in any
+                    # of the following circumstances:
+                    #   * The `public_key_id` is not recognized by the verifier.
+                    #   * The public key that `public_key_id` refers to does not verify the
+                    #     signature with respect to the payload.
+                    #
+                    # The `signature` contents SHOULD NOT be "attached" (where the payload is
+                    # included with the serialized `signature` bytes). Verifiers MUST ignore any
+                    # "attached" payload and only verify signatures with respect to explicitly
+                    # provided payload (e.g. a `payload` field on the proto message that holds
+                    # this Signature, or the canonical serialization of the proto message that
+                    # holds this signature).
+                  "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
+                      #   * The `public_key_id` is required.
+                      #   * The `public_key_id` SHOULD be an RFC3986 conformant URI.
+                      #   * When possible, the `public_key_id` SHOULD be an immutable reference,
+                      #     such as a cryptographic digest.
+                      #
+                      # Examples of valid `public_key_id`s:
+                      #
+                      # OpenPGP V4 public key fingerprint:
+                      #   * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
+                      # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
+                      # details on this scheme.
+                      #
+                      # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
+                      # serialization):
+                      #   * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
+                      #   * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
+                  "signature": "A String", # The content of the signature, an opaque bytestring.
+                      # The payload that this signature verifies MUST be unambiguously provided
+                      # with the Signature during verification. A wrapper message might provide
+                      # the payload explicitly. Alternatively, a message might have a canonical
+                      # serialization that can always be unambiguously computed to derive the
+                      # payload.
+                },
+              ],
+              "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
+                  # The encoding and semantic meaning of this payload must match what is set in
+                  # `content_type`.
+            },
+            "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
+                # supports `ATTACHED` signatures, where the payload that is signed is included
+                # alongside the signature itself in the same file.
+              "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
+                  # (GPG) or equivalent. Since this message only supports attached signatures,
+                  # the payload that was signed must be attached. While the signature format
+                  # supported is dependent on the verification implementation, currently only
+                  # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
+                  # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
+                  # --output=signature.gpg payload.json` will create the signature content
+                  # expected in this field in `signature.gpg` for the `payload.json`
+                  # attestation payload.
+              "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
+                  # The verifier must ensure that the provided type is one that the verifier
+                  # supports, and that the attestation payload is a valid instantiation of that
+                  # type (for example by validating a JSON schema).
+              "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
+                  # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
+                  # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
+                  # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
+                  # Implementations may choose to acknowledge "LONG", "SHORT", or other
+                  # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
+                  # In gpg, the full fingerprint can be retrieved from the `fpr` field
+                  # returned when calling --list-keys with --with-colons.  For example:
+                  # ```
+                  # gpg --with-colons --with-fingerprint --force-v4-certs \
+                  #     --list-keys attester@example.com
+                  # tru::1:1513631572:0:3:1:5
+                  # pub:...<SNIP>...
+                  # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
+                  # ```
+                  # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
+            },
+          },
+        },
+        "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
+          "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
+            "undeployTime": "A String", # End of the lifetime of this deployment.
+            "userEmail": "A String", # Identity of the user that triggered this deployment.
+            "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
+                # the deployable field with the same name.
+              "A String",
+            ],
+            "platform": "A String", # Platform hosting this deployment.
+            "config": "A String", # Configuration used to create this deployment.
+            "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
+            "address": "A String", # Address of the runtime element hosting this deployment.
+          },
+        },
+        "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
+            # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
+            # used as a filter in list requests.
+        "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
+          "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
+              # system.
+            "name": "A String", # Output only. The name of the installed package.
+            "location": [ # Required. All of the places within the filesystem versions of this package
+                # have been found.
+              { # An occurrence of a particular package installation found within a system's
+                  # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
+                "path": "A String", # The path from which we gathered that this package/version is installed.
+                "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
+                    # denoting the package manager version distributing a package.
+                "version": { # Version contains structured information about the version of a package. # The version installed at this location.
+                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                      # versions.
+                  "revision": "A String", # The iteration of the package build from the above version.
+                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
+                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
+                      # name.
+                },
+              },
+            ],
+          },
+        },
+        "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
+          "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
+          "relatedUrls": [ # Output only. URLs related to this vulnerability.
+            { # Metadata for any related URL information.
+              "url": "A String", # Specific URL associated with the resource.
+              "label": "A String", # Label to describe usage of the URL.
             },
           ],
+          "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
+              # available, and note provider assigned severity when distro has not yet
+              # assigned a severity for this vulnerability.
+          "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
+          "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
+              # packages etc)
+          "longDescription": "A String", # Output only. A detailed description of this vulnerability.
+          "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
+              # scale of 0-10 where 0 indicates low severity and 10 indicates high
+              # severity.
+          "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
+              # within the associated resource.
+            { # This message wraps a location affected by a vulnerability and its
+                # associated fix (if one is available).
+              "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
+                "package": "A String", # Required. The package being described.
+                "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                    # format. Examples include distro or storage location for vulnerable jar.
+                "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                      # versions.
+                  "revision": "A String", # The iteration of the package build from the above version.
+                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
+                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
+                      # name.
+                },
+              },
+              "severityName": "A String", # Deprecated, use Details.effective_severity instead
+                  # The severity (e.g., distro assigned severity) for this vulnerability.
+              "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
+                "package": "A String", # Required. The package being described.
+                "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                    # format. Examples include distro or storage location for vulnerable jar.
+                "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+                  "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                      # versions.
+                  "revision": "A String", # The iteration of the package build from the above version.
+                  "epoch": 42, # Used to correct mistakes in the version numbering scheme.
+                  "name": "A String", # Required only when version kind is NORMAL. The main part of the version
+                      # name.
+                },
+              },
+            },
+          ],
+        },
+        "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
+          "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
+            "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
+                # Deprecated, do not use.
+            "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
+                # details to show to the user. The LocalizedMessage is output only and
+                # populated by the API.
+                # different programming environments, including REST APIs and RPC APIs. It is
+                # used by [gRPC](https://github.com/grpc). Each `Status` message contains
+                # three pieces of data: error code, error message, and error details.
+                #
+                # You can find out more about this error model and how to work with it in the
+                # [API Design Guide](https://cloud.google.com/apis/design/errors).
+              "message": "A String", # A developer-facing error message, which should be in English. Any
+                  # user-facing error message should be localized and sent in the
+                  # google.rpc.Status.details field, or localized by the client.
+              "code": 42, # The status code, which should be an enum value of google.rpc.Code.
+              "details": [ # A list of messages that carry the error details.  There is a common set of
+                  # message types for APIs to use.
+                {
+                  "a_key": "", # Properties of the object. Contains field @type with type URL.
+                },
+              ],
+            },
+            "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
+            "analysisStatus": "A String", # The status of discovery for the resource.
+          },
+        },
+        "updateTime": "A String", # Output only. The time this occurrence was last updated.
+        "build": { # Details of a build occurrence. # Describes a verifiable build.
+          "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
+              # details about the build from source to completion.
+            "endTime": "A String", # Time at which execution of the build was finished.
+            "builderVersion": "A String", # Version string of the builder at the time this build was executed.
+            "startTime": "A String", # Time at which execution of the build was started.
+            "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
+                # user's e-mail address at the time the build was initiated; this address may
+                # not represent the same end-user for all time.
+            "logsUri": "A String", # URI where any logs for this provenance were written.
+            "builtArtifacts": [ # Output of the build.
+              { # Artifact describes a build product.
+                "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
+                    # the case of a container build, the name used to push the container image to
+                    # Google Container Registry, as presented to `docker push`. Note that a
+                    # single Artifact ID can have multiple names, for example if two tags are
+                    # applied to one image.
+                  "A String",
+                ],
+                "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
+                    # like `gcr.io/projectID/imagename@sha256:123456`.
+                "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
+                    # container.
+              },
+            ],
+            "buildOptions": { # Special options applied to this build. This is a catch-all field where
+                # build providers can enter any desired additional details.
+              "a_key": "A String",
+            },
+            "id": "A String", # Required. Unique identifier of the build.
+            "projectId": "A String", # ID of the project.
+            "commands": [ # Commands requested by the build.
+              { # Command describes a step performed as part of the build pipeline.
+                "waitFor": [ # The ID(s) of the command(s) that this command depends on.
+                  "A String",
+                ],
+                "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
+                    # this command as a dependency.
+                "dir": "A String", # Working directory (relative to project source root) used when running this
+                    # command.
+                "args": [ # Command-line arguments used when executing this command.
+                  "A String",
+                ],
+                "name": "A String", # Required. Name of the command, as presented on the command line, or if the
+                    # command is packaged as a Docker container, as presented to `docker pull`.
+                "env": [ # Environment variables set before running this command.
+                  "A String",
+                ],
+              },
+            ],
+            "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
+              "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
+                  # with a path point to a unique revision of a single file or directory.
+                "labels": { # Labels with user defined metadata.
+                  "a_key": "A String",
+                },
+                "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+                  "hostUri": "A String", # The URI of a running Gerrit instance.
+                  "revisionId": "A String", # A revision (commit) ID.
+                  "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
+                      # "project/subproject" is a valid project name. The "repo name" is the
+                      # hostURI/project.
+                  "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                    "kind": "A String", # The alias kind.
+                    "name": "A String", # The alias name.
+                  },
+                },
+                "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                    # repository (e.g., GitHub).
+                  "revisionId": "A String", # Git commit hash.
+                  "url": "A String", # Git repository URL.
+                },
+                "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                    # Source Repo.
+                  "revisionId": "A String", # A revision ID.
+                  "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                    "uid": "A String", # A server-assigned, globally unique identifier.
+                    "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                        # winged-cargo-31) and a repo name within that project.
+                      "projectId": "A String", # The ID of the project.
+                      "repoName": "A String", # The name of the repo. Leave empty for the default repo.
+                    },
+                  },
+                  "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                    "kind": "A String", # The alias kind.
+                    "name": "A String", # The alias name.
+                  },
+                },
+              },
+              "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
+                  # location.
+              "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
+                  # source integrity was maintained in the build.
+                  #
+                  # The keys to this map are file paths used as build source and the values
+                  # contain the hash values for those files.
+                  #
+                  # If the build source came in a single package such as a gzipped tarfile
+                  # (.tar.gz), the FileHash will be for the single path to that file.
+                "a_key": { # Container message for hashes of byte content of files, used in source
+                    # messages to verify integrity of source input to the build.
+                  "fileHash": [ # Required. Collection of file hashes.
+                    { # Container message for hash values.
+                      "type": "A String", # Required. The type of hash that was performed.
+                      "value": "A String", # Required. The hash value.
+                    },
+                  ],
+                },
+              },
+              "additionalContexts": [ # If provided, some of the source code used for the build may be found in
+                  # these locations, in the case where the source repository had multiple
+                  # remotes or submodules. This list will not include the context specified in
+                  # the context field.
+                { # A SourceContext is a reference to a tree of files. A SourceContext together
+                    # with a path point to a unique revision of a single file or directory.
+                  "labels": { # Labels with user defined metadata.
+                    "a_key": "A String",
+                  },
+                  "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+                    "hostUri": "A String", # The URI of a running Gerrit instance.
+                    "revisionId": "A String", # A revision (commit) ID.
+                    "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
+                        # "project/subproject" is a valid project name. The "repo name" is the
+                        # hostURI/project.
+                    "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                      "kind": "A String", # The alias kind.
+                      "name": "A String", # The alias name.
+                    },
+                  },
+                  "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                      # repository (e.g., GitHub).
+                    "revisionId": "A String", # Git commit hash.
+                    "url": "A String", # Git repository URL.
+                  },
+                  "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                      # Source Repo.
+                    "revisionId": "A String", # A revision ID.
+                    "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                      "uid": "A String", # A server-assigned, globally unique identifier.
+                      "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                          # winged-cargo-31) and a repo name within that project.
+                        "projectId": "A String", # The ID of the project.
+                        "repoName": "A String", # The name of the repo. Leave empty for the default repo.
+                      },
+                    },
+                    "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                      "kind": "A String", # The alias kind.
+                      "name": "A String", # The alias name.
+                    },
+                  },
+                },
+              ],
+            },
+            "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
+            "createTime": "A String", # Time at which the build was created.
+          },
+          "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
+              # build signature in the corresponding build note. After verifying the
+              # signature, `provenance_bytes` can be unmarshalled and compared to the
+              # provenance to confirm that it is unchanged. A base64-encoded string
+              # representation of the provenance bytes is used for the signature in order
+              # to interoperate with openssl which expects this format for signature
+              # verification.
+              #
+              # The serialized form is captured both to avoid ambiguity in how the
+              # provenance is marshalled to json as well to prevent incompatibilities with
+              # future changes.
         },
         "derivedImage": { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
             # note.
           "derivedImage": { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
               # relationship. This image would be produced from a Dockerfile with FROM
               # <DockerImage.Basis in attached Note>.
-            "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
-              "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
-                "A String",
-              ],
-              "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
-                  # representation.
-              "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
-                  #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
-                  # Only the name of the final blob is kept.
-            },
+            "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
+                # occurrence.
+            "distance": 42, # Output only. The number of layers by which this image differs from the
+                # associated image basis.
             "layerInfo": [ # This contains layer-specific metadata, if populated it has length
                 # "distance" and is ordered with [distance] being the layer immediately
                 # following the base image and [1] being the final layer.
@@ -1167,12 +1158,21 @@
                 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
               },
             ],
-            "distance": 42, # Output only. The number of layers by which this image differs from the
-                # associated image basis.
-            "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
-                # occurrence.
+            "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
+              "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
+                  # representation.
+              "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
+                "A String",
+              ],
+              "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
+                  #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
+                  # Only the name of the final blob is kept.
+            },
           },
         },
+        "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
+            # specified. This field can be used as a filter in list requests.
+        "remediation": "A String", # A description of actions that can be taken to remedy the note.
       },
     ],
   }</pre>
@@ -1189,441 +1189,19 @@
     The object takes the form of:
 
 { # An instance of an analysis type that has been found on a resource.
-  &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
-      # specified. This field can be used as a filter in list requests.
-  &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
-    &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
-        #
-        # The name of the resource. For example, the name of a Docker image -
-        # &quot;Debian&quot;.
-    &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
-        #
-        # The hash of the resource content. For example, the Docker digest.
-      &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-      &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-    },
-    &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
-        # `https://gcr.io/project/image@sha256:foo` for a Docker image.
-  },
-  &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
-    &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
-        # attestation can be verified using the attached signature. If the verifier
-        # trusts the public key of the signer, then verifying the signature is
-        # sufficient to establish trust. In this circumstance, the authority to which
-        # this attestation is attached is primarily useful for look-up (how to find
-        # this attestation if you already know the authority and artifact to be
-        # verified) and intent (which authority was this attestation intended to sign
-        # for).
-      &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
-          # supports `ATTACHED` signatures, where the payload that is signed is included
-          # alongside the signature itself in the same file.
-        &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-            # The verifier must ensure that the provided type is one that the verifier
-            # supports, and that the attestation payload is a valid instantiation of that
-            # type (for example by validating a JSON schema).
-        &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
-            # (GPG) or equivalent. Since this message only supports attached signatures,
-            # the payload that was signed must be attached. While the signature format
-            # supported is dependent on the verification implementation, currently only
-            # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
-            # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
-            # --output=signature.gpg payload.json` will create the signature content
-            # expected in this field in `signature.gpg` for the `payload.json`
-            # attestation payload.
-        &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
-            # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
-            # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
-            # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
-            # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
-            # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
-            # In gpg, the full fingerprint can be retrieved from the `fpr` field
-            # returned when calling --list-keys with --with-colons.  For example:
-            # ```
-            # gpg --with-colons --with-fingerprint --force-v4-certs \
-            #     --list-keys attester@example.com
-            # tru::1:1513631572:0:3:1:5
-            # pub:...&lt;SNIP&gt;...
-            # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
-            # ```
-            # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
-      },
-      &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
-          # This attestation must define the `serialized_payload` that the `signatures`
-          # verify and any metadata necessary to interpret that plaintext.  The
-          # signatures should always be over the `serialized_payload` bytestring.
-        &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-            # The verifier must ensure that the provided type is one that the verifier
-            # supports, and that the attestation payload is a valid instantiation of that
-            # type (for example by validating a JSON schema).
-        &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
-            # should consider this attestation message verified if at least one
-            # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
-            # for more details on signature structure and verification.
-          { # Verifiers (e.g. Kritis implementations) MUST verify signatures
-              # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
-              # Typically this means that the verifier has been configured with a map from
-              # `public_key_id` to public key material (and any required parameters, e.g.
-              # signing algorithm).
-              #
-              # In particular, verification implementations MUST NOT treat the signature
-              # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
-              # DOES NOT validate or authenticate a public key; it only provides a mechanism
-              # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
-              # a trusted channel. Verification implementations MUST reject signatures in any
-              # of the following circumstances:
-              #   * The `public_key_id` is not recognized by the verifier.
-              #   * The public key that `public_key_id` refers to does not verify the
-              #     signature with respect to the payload.
-              #
-              # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
-              # included with the serialized `signature` bytes). Verifiers MUST ignore any
-              # &quot;attached&quot; payload and only verify signatures with respect to explicitly
-              # provided payload (e.g. a `payload` field on the proto message that holds
-              # this Signature, or the canonical serialization of the proto message that
-              # holds this signature).
-            &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
-                #   * The `public_key_id` is required.
-                #   * The `public_key_id` MUST be an RFC3986 conformant URI.
-                #   * When possible, the `public_key_id` SHOULD be an immutable reference,
-                #     such as a cryptographic digest.
-                #
-                # Examples of valid `public_key_id`s:
-                #
-                # OpenPGP V4 public key fingerprint:
-                #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
-                # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
-                # details on this scheme.
-                #
-                # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
-                # serialization):
-                #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
-                #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
-            &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
-                # The payload that this signature verifies MUST be unambiguously provided
-                # with the Signature during verification. A wrapper message might provide
-                # the payload explicitly. Alternatively, a message might have a canonical
-                # serialization that can always be unambiguously computed to derive the
-                # payload.
-          },
-        ],
-        &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
-            # The encoding and semantic meaning of this payload must match what is set in
-            # `content_type`.
-      },
-    },
-  },
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the occurrence in the form of
       # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
-  &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
-    &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
-    &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
-    &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
-        # available, and note provider assigned severity when distro has not yet
-        # assigned a severity for this vulnerability.
-    &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
-    &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
-        # scale of 0-10 where 0 indicates low severity and 10 indicates high
-        # severity.
-    &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
-      { # Metadata for any related URL information.
-        &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
-        &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
-      },
-    ],
-    &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
-        # packages etc)
-    &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
-        # within the associated resource.
-      { # This message wraps a location affected by a vulnerability and its
-          # associated fix (if one is available).
-        &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
-            # The severity (e.g., distro assigned severity) for this vulnerability.
-        &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
-          &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-          &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                # name.
-            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                # versions.
-            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-          },
-          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-              # format. Examples include distro or storage location for vulnerable jar.
-        },
-        &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
-          &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-          &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                # name.
-            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                # versions.
-            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-          },
-          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-              # format. Examples include distro or storage location for vulnerable jar.
-        },
-      },
-    ],
-  },
-  &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
-    &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
-        # system.
-      &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
-          # have been found.
-        { # An occurrence of a particular package installation found within a system&#x27;s
-            # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
-          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
-              # denoting the package manager version distributing a package.
-          &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
-            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                # name.
-            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                # versions.
-            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-          },
-          &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
-        },
-      ],
-      &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
-    },
-  },
-  &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
-    &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
-        # build signature in the corresponding build note. After verifying the
-        # signature, `provenance_bytes` can be unmarshalled and compared to the
-        # provenance to confirm that it is unchanged. A base64-encoded string
-        # representation of the provenance bytes is used for the signature in order
-        # to interoperate with openssl which expects this format for signature
-        # verification.
-        #
-        # The serialized form is captured both to avoid ambiguity in how the
-        # provenance is marshalled to json as well to prevent incompatibilities with
-        # future changes.
-    &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
-        # details about the build from source to completion.
-      &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
-      &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
-      &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
-      &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
-        &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
-            # location.
-        &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
-            # these locations, in the case where the source repository had multiple
-            # remotes or submodules. This list will not include the context specified in
-            # the context field.
-          { # A SourceContext is a reference to a tree of files. A SourceContext together
-              # with a path point to a unique revision of a single file or directory.
-            &quot;labels&quot;: { # Labels with user defined metadata.
-              &quot;a_key&quot;: &quot;A String&quot;,
-            },
-            &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                # repository (e.g., GitHub).
-              &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-              &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-            },
-            &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-              &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-              &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-              &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                  # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                  # hostURI/project.
-              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-              },
-            },
-            &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                # Source Repo.
-              &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-              &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                    # winged-cargo-31) and a repo name within that project.
-                  &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                  &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-                },
-                &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-              },
-              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-              },
-            },
-          },
-        ],
-        &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
-            # source integrity was maintained in the build.
-            #
-            # The keys to this map are file paths used as build source and the values
-            # contain the hash values for those files.
-            #
-            # If the build source came in a single package such as a gzipped tarfile
-            # (.tar.gz), the FileHash will be for the single path to that file.
-          &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
-              # messages to verify integrity of source input to the build.
-            &quot;fileHash&quot;: [ # Required. Collection of file hashes.
-              { # Container message for hash values.
-                &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-                &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-              },
-            ],
-          },
-        },
-        &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
-            # with a path point to a unique revision of a single file or directory.
-          &quot;labels&quot;: { # Labels with user defined metadata.
-            &quot;a_key&quot;: &quot;A String&quot;,
-          },
-          &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-              # repository (e.g., GitHub).
-            &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-            &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-          },
-          &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-            &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-            &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-            &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                # hostURI/project.
-            &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-              &quot;name&quot;: &quot;A String&quot;, # The alias name.
-              &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-            },
-          },
-          &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-              # Source Repo.
-            &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-            &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-              &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                  # winged-cargo-31) and a repo name within that project.
-                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-              },
-              &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-            },
-            &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-              &quot;name&quot;: &quot;A String&quot;, # The alias name.
-              &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-            },
-          },
-        },
-      },
-      &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
-      &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
-      &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
-      &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
-          # user&#x27;s e-mail address at the time the build was initiated; this address may
-          # not represent the same end-user for all time.
-      &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
-      &quot;commands&quot;: [ # Commands requested by the build.
-        { # Command describes a step performed as part of the build pipeline.
-          &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
-              # command.
-          &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
-            &quot;A String&quot;,
-          ],
-          &quot;env&quot;: [ # Environment variables set before running this command.
-            &quot;A String&quot;,
-          ],
-          &quot;args&quot;: [ # Command-line arguments used when executing this command.
-            &quot;A String&quot;,
-          ],
-          &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
-              # command is packaged as a Docker container, as presented to `docker pull`.
-          &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
-              # this command as a dependency.
-        },
-      ],
-      &quot;builtArtifacts&quot;: [ # Output of the build.
-        { # Artifact describes a build product.
-          &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
-              # container.
-          &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
-              # like `gcr.io/projectID/imagename@sha256:123456`.
-          &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
-              # the case of a container build, the name used to push the container image to
-              # Google Container Registry, as presented to `docker push`. Note that a
-              # single Artifact ID can have multiple names, for example if two tags are
-              # applied to one image.
-            &quot;A String&quot;,
-          ],
-        },
-      ],
-      &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
-      &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
-          # build providers can enter any desired additional details.
-        &quot;a_key&quot;: &quot;A String&quot;,
-      },
-    },
-  },
-  &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
-    &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
-      &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
-          # details to show to the user. The LocalizedMessage is output only and
-          # populated by the API.
-          # different programming environments, including REST APIs and RPC APIs. It is
-          # used by [gRPC](https://github.com/grpc). Each `Status` message contains
-          # three pieces of data: error code, error message, and error details.
-          #
-          # You can find out more about this error model and how to work with it in the
-          # [API Design Guide](https://cloud.google.com/apis/design/errors).
-        &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
-            # message types for APIs to use.
-          {
-            &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
-          },
-        ],
-        &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
-        &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
-            # user-facing error message should be localized and sent in the
-            # google.rpc.Status.details field, or localized by the client.
-      },
-      &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
-      &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
-      &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
-          # Deprecated, do not use.
-    },
-  },
-  &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
-      # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
-      # used as a filter in list requests.
-  &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
-    &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
-      &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
-      &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
-      &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
-      &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
-      &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
-      &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
-      &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
-          # the deployable field with the same name.
-        &quot;A String&quot;,
-      ],
-    },
-  },
-  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
-  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
-  &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
   &quot;intoto&quot;: { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
       # signatures and the in-toto link itself. This is used for occurrences of a
       # Grafeas in-toto note.
-    &quot;signed&quot;: { # This corresponds to an in-toto link.
-      &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
-          # be empty if links are generated for operations that aren&#x27;t directly mapped
-          # to a specific command. Each term in the command is an independent string
-          # in the list. An example of a command in the in-toto metadata field is:
-          # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
-        &quot;A String&quot;,
-      ],
-      &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
-          # are not the actual result of the step.
-          # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
-        &quot;customValues&quot;: {
-          &quot;a_key&quot;: &quot;A String&quot;,
-        },
+    &quot;signatures&quot;: [
+      { # A signature object consists of the KeyID used and the signature itself.
+        &quot;sig&quot;: &quot;A String&quot;,
+        &quot;keyid&quot;: &quot;A String&quot;,
       },
+    ],
+    &quot;signed&quot;: { # This corresponds to an in-toto link.
       &quot;environment&quot;: { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
           # environment. It is suggested for this field to contain information that
           # details environment variables, filesystem information, and the present
@@ -1669,29 +1247,442 @@
           &quot;resourceUri&quot;: &quot;A String&quot;,
         },
       ],
+      &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
+          # are not the actual result of the step.
+          # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
+        &quot;customValues&quot;: {
+          &quot;a_key&quot;: &quot;A String&quot;,
+        },
+      },
+      &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
+          # be empty if links are generated for operations that aren&#x27;t directly mapped
+          # to a specific command. Each term in the command is an independent string
+          # in the list. An example of a command in the in-toto metadata field is:
+          # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
+        &quot;A String&quot;,
+      ],
     },
-    &quot;signatures&quot;: [
-      { # A signature object consists of the KeyID used and the signature itself.
-        &quot;sig&quot;: &quot;A String&quot;,
-        &quot;keyid&quot;: &quot;A String&quot;,
+  },
+  &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
+    &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
+        #
+        # The hash of the resource content. For example, the Docker digest.
+      &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+      &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+    },
+    &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
+        # `https://gcr.io/project/image@sha256:foo` for a Docker image.
+    &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
+        #
+        # The name of the resource. For example, the name of a Docker image -
+        # &quot;Debian&quot;.
+  },
+  &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
+    &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
+        # attestation can be verified using the attached signature. If the verifier
+        # trusts the public key of the signer, then verifying the signature is
+        # sufficient to establish trust. In this circumstance, the authority to which
+        # this attestation is attached is primarily useful for look-up (how to find
+        # this attestation if you already know the authority and artifact to be
+        # verified) and intent (which authority was this attestation intended to sign
+        # for).
+      &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
+          # This attestation must define the `serialized_payload` that the `signatures`
+          # verify and any metadata necessary to interpret that plaintext.  The
+          # signatures should always be over the `serialized_payload` bytestring.
+        &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+            # The verifier must ensure that the provided type is one that the verifier
+            # supports, and that the attestation payload is a valid instantiation of that
+            # type (for example by validating a JSON schema).
+        &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
+            # should consider this attestation message verified if at least one
+            # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
+            # for more details on signature structure and verification.
+          { # Verifiers (e.g. Kritis implementations) MUST verify signatures
+              # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
+              # Typically this means that the verifier has been configured with a map from
+              # `public_key_id` to public key material (and any required parameters, e.g.
+              # signing algorithm).
+              #
+              # In particular, verification implementations MUST NOT treat the signature
+              # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
+              # DOES NOT validate or authenticate a public key; it only provides a mechanism
+              # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
+              # a trusted channel. Verification implementations MUST reject signatures in any
+              # of the following circumstances:
+              #   * The `public_key_id` is not recognized by the verifier.
+              #   * The public key that `public_key_id` refers to does not verify the
+              #     signature with respect to the payload.
+              #
+              # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
+              # included with the serialized `signature` bytes). Verifiers MUST ignore any
+              # &quot;attached&quot; payload and only verify signatures with respect to explicitly
+              # provided payload (e.g. a `payload` field on the proto message that holds
+              # this Signature, or the canonical serialization of the proto message that
+              # holds this signature).
+            &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
+                #   * The `public_key_id` is required.
+                #   * The `public_key_id` SHOULD be an RFC3986 conformant URI.
+                #   * When possible, the `public_key_id` SHOULD be an immutable reference,
+                #     such as a cryptographic digest.
+                #
+                # Examples of valid `public_key_id`s:
+                #
+                # OpenPGP V4 public key fingerprint:
+                #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
+                # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
+                # details on this scheme.
+                #
+                # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
+                # serialization):
+                #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
+                #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
+            &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
+                # The payload that this signature verifies MUST be unambiguously provided
+                # with the Signature during verification. A wrapper message might provide
+                # the payload explicitly. Alternatively, a message might have a canonical
+                # serialization that can always be unambiguously computed to derive the
+                # payload.
+          },
+        ],
+        &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
+            # The encoding and semantic meaning of this payload must match what is set in
+            # `content_type`.
+      },
+      &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
+          # supports `ATTACHED` signatures, where the payload that is signed is included
+          # alongside the signature itself in the same file.
+        &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
+            # (GPG) or equivalent. Since this message only supports attached signatures,
+            # the payload that was signed must be attached. While the signature format
+            # supported is dependent on the verification implementation, currently only
+            # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
+            # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
+            # --output=signature.gpg payload.json` will create the signature content
+            # expected in this field in `signature.gpg` for the `payload.json`
+            # attestation payload.
+        &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+            # The verifier must ensure that the provided type is one that the verifier
+            # supports, and that the attestation payload is a valid instantiation of that
+            # type (for example by validating a JSON schema).
+        &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
+            # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
+            # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
+            # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
+            # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
+            # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
+            # In gpg, the full fingerprint can be retrieved from the `fpr` field
+            # returned when calling --list-keys with --with-colons.  For example:
+            # ```
+            # gpg --with-colons --with-fingerprint --force-v4-certs \
+            #     --list-keys attester@example.com
+            # tru::1:1513631572:0:3:1:5
+            # pub:...&lt;SNIP&gt;...
+            # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
+            # ```
+            # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
+      },
+    },
+  },
+  &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
+    &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
+      &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
+      &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
+      &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
+          # the deployable field with the same name.
+        &quot;A String&quot;,
+      ],
+      &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
+      &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
+      &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
+      &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
+    },
+  },
+  &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
+      # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
+      # used as a filter in list requests.
+  &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
+    &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
+        # system.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
+      &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
+          # have been found.
+        { # An occurrence of a particular package installation found within a system&#x27;s
+            # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
+          &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
+          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
+              # denoting the package manager version distributing a package.
+          &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
+            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                # versions.
+            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                # name.
+          },
+        },
+      ],
+    },
+  },
+  &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
+    &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
+    &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
+      { # Metadata for any related URL information.
+        &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
+        &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
       },
     ],
+    &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
+        # available, and note provider assigned severity when distro has not yet
+        # assigned a severity for this vulnerability.
+    &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
+    &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
+        # packages etc)
+    &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
+    &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
+        # scale of 0-10 where 0 indicates low severity and 10 indicates high
+        # severity.
+    &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
+        # within the associated resource.
+      { # This message wraps a location affected by a vulnerability and its
+          # associated fix (if one is available).
+        &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
+          &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+              # format. Examples include distro or storage location for vulnerable jar.
+          &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                # versions.
+            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                # name.
+          },
+        },
+        &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
+            # The severity (e.g., distro assigned severity) for this vulnerability.
+        &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
+          &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+              # format. Examples include distro or storage location for vulnerable jar.
+          &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                # versions.
+            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                # name.
+          },
+        },
+      },
+    ],
+  },
+  &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
+    &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
+      &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
+          # Deprecated, do not use.
+      &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
+          # details to show to the user. The LocalizedMessage is output only and
+          # populated by the API.
+          # different programming environments, including REST APIs and RPC APIs. It is
+          # used by [gRPC](https://github.com/grpc). Each `Status` message contains
+          # three pieces of data: error code, error message, and error details.
+          #
+          # You can find out more about this error model and how to work with it in the
+          # [API Design Guide](https://cloud.google.com/apis/design/errors).
+        &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
+            # user-facing error message should be localized and sent in the
+            # google.rpc.Status.details field, or localized by the client.
+        &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+        &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
+            # message types for APIs to use.
+          {
+            &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+          },
+        ],
+      },
+      &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
+      &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
+    },
+  },
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
+  &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
+    &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
+        # details about the build from source to completion.
+      &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
+      &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
+      &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
+      &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
+          # user&#x27;s e-mail address at the time the build was initiated; this address may
+          # not represent the same end-user for all time.
+      &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
+      &quot;builtArtifacts&quot;: [ # Output of the build.
+        { # Artifact describes a build product.
+          &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
+              # the case of a container build, the name used to push the container image to
+              # Google Container Registry, as presented to `docker push`. Note that a
+              # single Artifact ID can have multiple names, for example if two tags are
+              # applied to one image.
+            &quot;A String&quot;,
+          ],
+          &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
+              # like `gcr.io/projectID/imagename@sha256:123456`.
+          &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
+              # container.
+        },
+      ],
+      &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
+          # build providers can enter any desired additional details.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
+      &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
+      &quot;commands&quot;: [ # Commands requested by the build.
+        { # Command describes a step performed as part of the build pipeline.
+          &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
+            &quot;A String&quot;,
+          ],
+          &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
+              # this command as a dependency.
+          &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
+              # command.
+          &quot;args&quot;: [ # Command-line arguments used when executing this command.
+            &quot;A String&quot;,
+          ],
+          &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
+              # command is packaged as a Docker container, as presented to `docker pull`.
+          &quot;env&quot;: [ # Environment variables set before running this command.
+            &quot;A String&quot;,
+          ],
+        },
+      ],
+      &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
+        &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
+            # with a path point to a unique revision of a single file or directory.
+          &quot;labels&quot;: { # Labels with user defined metadata.
+            &quot;a_key&quot;: &quot;A String&quot;,
+          },
+          &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+            &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+            &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+            &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                # hostURI/project.
+            &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+              &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+              &quot;name&quot;: &quot;A String&quot;, # The alias name.
+            },
+          },
+          &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+              # repository (e.g., GitHub).
+            &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+            &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+          },
+          &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+              # Source Repo.
+            &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+            &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+              &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+              &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                  # winged-cargo-31) and a repo name within that project.
+                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+              },
+            },
+            &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+              &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+              &quot;name&quot;: &quot;A String&quot;, # The alias name.
+            },
+          },
+        },
+        &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
+            # location.
+        &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
+            # source integrity was maintained in the build.
+            #
+            # The keys to this map are file paths used as build source and the values
+            # contain the hash values for those files.
+            #
+            # If the build source came in a single package such as a gzipped tarfile
+            # (.tar.gz), the FileHash will be for the single path to that file.
+          &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
+              # messages to verify integrity of source input to the build.
+            &quot;fileHash&quot;: [ # Required. Collection of file hashes.
+              { # Container message for hash values.
+                &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+                &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+              },
+            ],
+          },
+        },
+        &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
+            # these locations, in the case where the source repository had multiple
+            # remotes or submodules. This list will not include the context specified in
+            # the context field.
+          { # A SourceContext is a reference to a tree of files. A SourceContext together
+              # with a path point to a unique revision of a single file or directory.
+            &quot;labels&quot;: { # Labels with user defined metadata.
+              &quot;a_key&quot;: &quot;A String&quot;,
+            },
+            &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+              &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+              &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+              &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                  # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                  # hostURI/project.
+              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                &quot;name&quot;: &quot;A String&quot;, # The alias name.
+              },
+            },
+            &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                # repository (e.g., GitHub).
+              &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+              &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+            },
+            &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                # Source Repo.
+              &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+              &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+                &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                    # winged-cargo-31) and a repo name within that project.
+                  &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                  &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+                },
+              },
+              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                &quot;name&quot;: &quot;A String&quot;, # The alias name.
+              },
+            },
+          },
+        ],
+      },
+      &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
+      &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
+    },
+    &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
+        # build signature in the corresponding build note. After verifying the
+        # signature, `provenance_bytes` can be unmarshalled and compared to the
+        # provenance to confirm that it is unchanged. A base64-encoded string
+        # representation of the provenance bytes is used for the signature in order
+        # to interoperate with openssl which expects this format for signature
+        # verification.
+        #
+        # The serialized form is captured both to avoid ambiguity in how the
+        # provenance is marshalled to json as well to prevent incompatibilities with
+        # future changes.
   },
   &quot;derivedImage&quot;: { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
       # note.
     &quot;derivedImage&quot;: { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
         # relationship. This image would be produced from a Dockerfile with FROM
         # &lt;DockerImage.Basis in attached Note&gt;.
-      &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
-        &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
-          &quot;A String&quot;,
-        ],
-        &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
-            # representation.
-        &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
-            #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
-            # Only the name of the final blob is kept.
-      },
+      &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
+          # occurrence.
+      &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
+          # associated image basis.
       &quot;layerInfo&quot;: [ # This contains layer-specific metadata, if populated it has length
           # &quot;distance&quot; and is ordered with [distance] being the layer immediately
           # following the base image and [1] being the final layer.
@@ -1700,12 +1691,21 @@
           &quot;arguments&quot;: &quot;A String&quot;, # The recovered arguments to the Dockerfile directive.
         },
       ],
-      &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
-          # associated image basis.
-      &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
-          # occurrence.
+      &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
+        &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
+            # representation.
+        &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
+          &quot;A String&quot;,
+        ],
+        &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
+            #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
+            # Only the name of the final blob is kept.
+      },
     },
   },
+  &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
+      # specified. This field can be used as a filter in list requests.
+  &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
 }
 
   x__xgafv: string, V1 error format.
@@ -1717,441 +1717,19 @@
   An object of the form:
 
     { # An instance of an analysis type that has been found on a resource.
-    &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
-        # specified. This field can be used as a filter in list requests.
-    &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
-      &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
-          #
-          # The name of the resource. For example, the name of a Docker image -
-          # &quot;Debian&quot;.
-      &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
-          #
-          # The hash of the resource content. For example, the Docker digest.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-        &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-      },
-      &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
-          # `https://gcr.io/project/image@sha256:foo` for a Docker image.
-    },
-    &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
-      &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
-          # attestation can be verified using the attached signature. If the verifier
-          # trusts the public key of the signer, then verifying the signature is
-          # sufficient to establish trust. In this circumstance, the authority to which
-          # this attestation is attached is primarily useful for look-up (how to find
-          # this attestation if you already know the authority and artifact to be
-          # verified) and intent (which authority was this attestation intended to sign
-          # for).
-        &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
-            # supports `ATTACHED` signatures, where the payload that is signed is included
-            # alongside the signature itself in the same file.
-          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-              # The verifier must ensure that the provided type is one that the verifier
-              # supports, and that the attestation payload is a valid instantiation of that
-              # type (for example by validating a JSON schema).
-          &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
-              # (GPG) or equivalent. Since this message only supports attached signatures,
-              # the payload that was signed must be attached. While the signature format
-              # supported is dependent on the verification implementation, currently only
-              # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
-              # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
-              # --output=signature.gpg payload.json` will create the signature content
-              # expected in this field in `signature.gpg` for the `payload.json`
-              # attestation payload.
-          &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
-              # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
-              # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
-              # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
-              # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
-              # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
-              # In gpg, the full fingerprint can be retrieved from the `fpr` field
-              # returned when calling --list-keys with --with-colons.  For example:
-              # ```
-              # gpg --with-colons --with-fingerprint --force-v4-certs \
-              #     --list-keys attester@example.com
-              # tru::1:1513631572:0:3:1:5
-              # pub:...&lt;SNIP&gt;...
-              # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
-              # ```
-              # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
-        },
-        &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
-            # This attestation must define the `serialized_payload` that the `signatures`
-            # verify and any metadata necessary to interpret that plaintext.  The
-            # signatures should always be over the `serialized_payload` bytestring.
-          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-              # The verifier must ensure that the provided type is one that the verifier
-              # supports, and that the attestation payload is a valid instantiation of that
-              # type (for example by validating a JSON schema).
-          &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
-              # should consider this attestation message verified if at least one
-              # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
-              # for more details on signature structure and verification.
-            { # Verifiers (e.g. Kritis implementations) MUST verify signatures
-                # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
-                # Typically this means that the verifier has been configured with a map from
-                # `public_key_id` to public key material (and any required parameters, e.g.
-                # signing algorithm).
-                #
-                # In particular, verification implementations MUST NOT treat the signature
-                # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
-                # DOES NOT validate or authenticate a public key; it only provides a mechanism
-                # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
-                # a trusted channel. Verification implementations MUST reject signatures in any
-                # of the following circumstances:
-                #   * The `public_key_id` is not recognized by the verifier.
-                #   * The public key that `public_key_id` refers to does not verify the
-                #     signature with respect to the payload.
-                #
-                # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
-                # included with the serialized `signature` bytes). Verifiers MUST ignore any
-                # &quot;attached&quot; payload and only verify signatures with respect to explicitly
-                # provided payload (e.g. a `payload` field on the proto message that holds
-                # this Signature, or the canonical serialization of the proto message that
-                # holds this signature).
-              &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
-                  #   * The `public_key_id` is required.
-                  #   * The `public_key_id` MUST be an RFC3986 conformant URI.
-                  #   * When possible, the `public_key_id` SHOULD be an immutable reference,
-                  #     such as a cryptographic digest.
-                  #
-                  # Examples of valid `public_key_id`s:
-                  #
-                  # OpenPGP V4 public key fingerprint:
-                  #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
-                  # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
-                  # details on this scheme.
-                  #
-                  # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
-                  # serialization):
-                  #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
-                  #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
-              &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
-                  # The payload that this signature verifies MUST be unambiguously provided
-                  # with the Signature during verification. A wrapper message might provide
-                  # the payload explicitly. Alternatively, a message might have a canonical
-                  # serialization that can always be unambiguously computed to derive the
-                  # payload.
-            },
-          ],
-          &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
-              # The encoding and semantic meaning of this payload must match what is set in
-              # `content_type`.
-        },
-      },
-    },
+    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
     &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the occurrence in the form of
         # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
-    &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
-      &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
-      &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
-      &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
-          # available, and note provider assigned severity when distro has not yet
-          # assigned a severity for this vulnerability.
-      &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
-      &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
-          # scale of 0-10 where 0 indicates low severity and 10 indicates high
-          # severity.
-      &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
-        { # Metadata for any related URL information.
-          &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
-          &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
-        },
-      ],
-      &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
-          # packages etc)
-      &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
-          # within the associated resource.
-        { # This message wraps a location affected by a vulnerability and its
-            # associated fix (if one is available).
-          &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
-              # The severity (e.g., distro assigned severity) for this vulnerability.
-          &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
-            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                  # name.
-              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                  # versions.
-              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-            },
-            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                # format. Examples include distro or storage location for vulnerable jar.
-          },
-          &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
-            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                  # name.
-              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                  # versions.
-              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-            },
-            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                # format. Examples include distro or storage location for vulnerable jar.
-          },
-        },
-      ],
-    },
-    &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
-      &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
-          # system.
-        &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
-            # have been found.
-          { # An occurrence of a particular package installation found within a system&#x27;s
-              # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
-            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
-                # denoting the package manager version distributing a package.
-            &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
-              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                  # name.
-              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                  # versions.
-              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-            },
-            &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
-          },
-        ],
-        &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
-      },
-    },
-    &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
-      &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
-          # build signature in the corresponding build note. After verifying the
-          # signature, `provenance_bytes` can be unmarshalled and compared to the
-          # provenance to confirm that it is unchanged. A base64-encoded string
-          # representation of the provenance bytes is used for the signature in order
-          # to interoperate with openssl which expects this format for signature
-          # verification.
-          #
-          # The serialized form is captured both to avoid ambiguity in how the
-          # provenance is marshalled to json as well to prevent incompatibilities with
-          # future changes.
-      &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
-          # details about the build from source to completion.
-        &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
-        &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
-        &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
-        &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
-          &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
-              # location.
-          &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
-              # these locations, in the case where the source repository had multiple
-              # remotes or submodules. This list will not include the context specified in
-              # the context field.
-            { # A SourceContext is a reference to a tree of files. A SourceContext together
-                # with a path point to a unique revision of a single file or directory.
-              &quot;labels&quot;: { # Labels with user defined metadata.
-                &quot;a_key&quot;: &quot;A String&quot;,
-              },
-              &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                  # repository (e.g., GitHub).
-                &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-                &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-              },
-              &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-                &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-                &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-                &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                    # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                    # hostURI/project.
-                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-                },
-              },
-              &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                  # Source Repo.
-                &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-                &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                  &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                      # winged-cargo-31) and a repo name within that project.
-                    &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                    &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-                  },
-                  &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-                },
-                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-                },
-              },
-            },
-          ],
-          &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
-              # source integrity was maintained in the build.
-              #
-              # The keys to this map are file paths used as build source and the values
-              # contain the hash values for those files.
-              #
-              # If the build source came in a single package such as a gzipped tarfile
-              # (.tar.gz), the FileHash will be for the single path to that file.
-            &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
-                # messages to verify integrity of source input to the build.
-              &quot;fileHash&quot;: [ # Required. Collection of file hashes.
-                { # Container message for hash values.
-                  &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-                  &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-                },
-              ],
-            },
-          },
-          &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
-              # with a path point to a unique revision of a single file or directory.
-            &quot;labels&quot;: { # Labels with user defined metadata.
-              &quot;a_key&quot;: &quot;A String&quot;,
-            },
-            &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                # repository (e.g., GitHub).
-              &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-              &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-            },
-            &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-              &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-              &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-              &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                  # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                  # hostURI/project.
-              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-              },
-            },
-            &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                # Source Repo.
-              &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-              &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                    # winged-cargo-31) and a repo name within that project.
-                  &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                  &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-                },
-                &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-              },
-              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-              },
-            },
-          },
-        },
-        &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
-        &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
-        &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
-        &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
-            # user&#x27;s e-mail address at the time the build was initiated; this address may
-            # not represent the same end-user for all time.
-        &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
-        &quot;commands&quot;: [ # Commands requested by the build.
-          { # Command describes a step performed as part of the build pipeline.
-            &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
-                # command.
-            &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
-              &quot;A String&quot;,
-            ],
-            &quot;env&quot;: [ # Environment variables set before running this command.
-              &quot;A String&quot;,
-            ],
-            &quot;args&quot;: [ # Command-line arguments used when executing this command.
-              &quot;A String&quot;,
-            ],
-            &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
-                # command is packaged as a Docker container, as presented to `docker pull`.
-            &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
-                # this command as a dependency.
-          },
-        ],
-        &quot;builtArtifacts&quot;: [ # Output of the build.
-          { # Artifact describes a build product.
-            &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
-                # container.
-            &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
-                # like `gcr.io/projectID/imagename@sha256:123456`.
-            &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
-                # the case of a container build, the name used to push the container image to
-                # Google Container Registry, as presented to `docker push`. Note that a
-                # single Artifact ID can have multiple names, for example if two tags are
-                # applied to one image.
-              &quot;A String&quot;,
-            ],
-          },
-        ],
-        &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
-        &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
-            # build providers can enter any desired additional details.
-          &quot;a_key&quot;: &quot;A String&quot;,
-        },
-      },
-    },
-    &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
-      &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
-        &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
-            # details to show to the user. The LocalizedMessage is output only and
-            # populated by the API.
-            # different programming environments, including REST APIs and RPC APIs. It is
-            # used by [gRPC](https://github.com/grpc). Each `Status` message contains
-            # three pieces of data: error code, error message, and error details.
-            #
-            # You can find out more about this error model and how to work with it in the
-            # [API Design Guide](https://cloud.google.com/apis/design/errors).
-          &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
-              # message types for APIs to use.
-            {
-              &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
-            },
-          ],
-          &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
-          &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
-              # user-facing error message should be localized and sent in the
-              # google.rpc.Status.details field, or localized by the client.
-        },
-        &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
-        &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
-        &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
-            # Deprecated, do not use.
-      },
-    },
-    &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
-        # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
-        # used as a filter in list requests.
-    &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
-      &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
-        &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
-        &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
-        &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
-        &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
-        &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
-        &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
-        &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
-            # the deployable field with the same name.
-          &quot;A String&quot;,
-        ],
-      },
-    },
-    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
-    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
-    &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
     &quot;intoto&quot;: { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
         # signatures and the in-toto link itself. This is used for occurrences of a
         # Grafeas in-toto note.
-      &quot;signed&quot;: { # This corresponds to an in-toto link.
-        &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
-            # be empty if links are generated for operations that aren&#x27;t directly mapped
-            # to a specific command. Each term in the command is an independent string
-            # in the list. An example of a command in the in-toto metadata field is:
-            # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
-          &quot;A String&quot;,
-        ],
-        &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
-            # are not the actual result of the step.
-            # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
-          &quot;customValues&quot;: {
-            &quot;a_key&quot;: &quot;A String&quot;,
-          },
+      &quot;signatures&quot;: [
+        { # A signature object consists of the KeyID used and the signature itself.
+          &quot;sig&quot;: &quot;A String&quot;,
+          &quot;keyid&quot;: &quot;A String&quot;,
         },
+      ],
+      &quot;signed&quot;: { # This corresponds to an in-toto link.
         &quot;environment&quot;: { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
             # environment. It is suggested for this field to contain information that
             # details environment variables, filesystem information, and the present
@@ -2197,29 +1775,442 @@
             &quot;resourceUri&quot;: &quot;A String&quot;,
           },
         ],
+        &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
+            # are not the actual result of the step.
+            # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
+          &quot;customValues&quot;: {
+            &quot;a_key&quot;: &quot;A String&quot;,
+          },
+        },
+        &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
+            # be empty if links are generated for operations that aren&#x27;t directly mapped
+            # to a specific command. Each term in the command is an independent string
+            # in the list. An example of a command in the in-toto metadata field is:
+            # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
+          &quot;A String&quot;,
+        ],
       },
-      &quot;signatures&quot;: [
-        { # A signature object consists of the KeyID used and the signature itself.
-          &quot;sig&quot;: &quot;A String&quot;,
-          &quot;keyid&quot;: &quot;A String&quot;,
+    },
+    &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
+      &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
+          #
+          # The hash of the resource content. For example, the Docker digest.
+        &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+        &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+      },
+      &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
+          # `https://gcr.io/project/image@sha256:foo` for a Docker image.
+      &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
+          #
+          # The name of the resource. For example, the name of a Docker image -
+          # &quot;Debian&quot;.
+    },
+    &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
+      &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
+          # attestation can be verified using the attached signature. If the verifier
+          # trusts the public key of the signer, then verifying the signature is
+          # sufficient to establish trust. In this circumstance, the authority to which
+          # this attestation is attached is primarily useful for look-up (how to find
+          # this attestation if you already know the authority and artifact to be
+          # verified) and intent (which authority was this attestation intended to sign
+          # for).
+        &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
+            # This attestation must define the `serialized_payload` that the `signatures`
+            # verify and any metadata necessary to interpret that plaintext.  The
+            # signatures should always be over the `serialized_payload` bytestring.
+          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+              # The verifier must ensure that the provided type is one that the verifier
+              # supports, and that the attestation payload is a valid instantiation of that
+              # type (for example by validating a JSON schema).
+          &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
+              # should consider this attestation message verified if at least one
+              # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
+              # for more details on signature structure and verification.
+            { # Verifiers (e.g. Kritis implementations) MUST verify signatures
+                # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
+                # Typically this means that the verifier has been configured with a map from
+                # `public_key_id` to public key material (and any required parameters, e.g.
+                # signing algorithm).
+                #
+                # In particular, verification implementations MUST NOT treat the signature
+                # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
+                # DOES NOT validate or authenticate a public key; it only provides a mechanism
+                # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
+                # a trusted channel. Verification implementations MUST reject signatures in any
+                # of the following circumstances:
+                #   * The `public_key_id` is not recognized by the verifier.
+                #   * The public key that `public_key_id` refers to does not verify the
+                #     signature with respect to the payload.
+                #
+                # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
+                # included with the serialized `signature` bytes). Verifiers MUST ignore any
+                # &quot;attached&quot; payload and only verify signatures with respect to explicitly
+                # provided payload (e.g. a `payload` field on the proto message that holds
+                # this Signature, or the canonical serialization of the proto message that
+                # holds this signature).
+              &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
+                  #   * The `public_key_id` is required.
+                  #   * The `public_key_id` SHOULD be an RFC3986 conformant URI.
+                  #   * When possible, the `public_key_id` SHOULD be an immutable reference,
+                  #     such as a cryptographic digest.
+                  #
+                  # Examples of valid `public_key_id`s:
+                  #
+                  # OpenPGP V4 public key fingerprint:
+                  #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
+                  # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
+                  # details on this scheme.
+                  #
+                  # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
+                  # serialization):
+                  #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
+                  #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
+              &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
+                  # The payload that this signature verifies MUST be unambiguously provided
+                  # with the Signature during verification. A wrapper message might provide
+                  # the payload explicitly. Alternatively, a message might have a canonical
+                  # serialization that can always be unambiguously computed to derive the
+                  # payload.
+            },
+          ],
+          &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
+              # The encoding and semantic meaning of this payload must match what is set in
+              # `content_type`.
+        },
+        &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
+            # supports `ATTACHED` signatures, where the payload that is signed is included
+            # alongside the signature itself in the same file.
+          &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
+              # (GPG) or equivalent. Since this message only supports attached signatures,
+              # the payload that was signed must be attached. While the signature format
+              # supported is dependent on the verification implementation, currently only
+              # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
+              # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
+              # --output=signature.gpg payload.json` will create the signature content
+              # expected in this field in `signature.gpg` for the `payload.json`
+              # attestation payload.
+          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+              # The verifier must ensure that the provided type is one that the verifier
+              # supports, and that the attestation payload is a valid instantiation of that
+              # type (for example by validating a JSON schema).
+          &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
+              # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
+              # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
+              # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
+              # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
+              # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
+              # In gpg, the full fingerprint can be retrieved from the `fpr` field
+              # returned when calling --list-keys with --with-colons.  For example:
+              # ```
+              # gpg --with-colons --with-fingerprint --force-v4-certs \
+              #     --list-keys attester@example.com
+              # tru::1:1513631572:0:3:1:5
+              # pub:...&lt;SNIP&gt;...
+              # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
+              # ```
+              # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
+        },
+      },
+    },
+    &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
+      &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
+        &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
+        &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
+        &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
+            # the deployable field with the same name.
+          &quot;A String&quot;,
+        ],
+        &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
+        &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
+        &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
+        &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
+      },
+    },
+    &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
+        # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
+        # used as a filter in list requests.
+    &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
+      &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
+          # system.
+        &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
+        &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
+            # have been found.
+          { # An occurrence of a particular package installation found within a system&#x27;s
+              # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
+            &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
+            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
+                # denoting the package manager version distributing a package.
+            &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
+              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                  # versions.
+              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                  # name.
+            },
+          },
+        ],
+      },
+    },
+    &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
+      &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
+      &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
+        { # Metadata for any related URL information.
+          &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
+          &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
         },
       ],
+      &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
+          # available, and note provider assigned severity when distro has not yet
+          # assigned a severity for this vulnerability.
+      &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
+      &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
+          # packages etc)
+      &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
+      &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
+          # scale of 0-10 where 0 indicates low severity and 10 indicates high
+          # severity.
+      &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
+          # within the associated resource.
+        { # This message wraps a location affected by a vulnerability and its
+            # associated fix (if one is available).
+          &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
+            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                # format. Examples include distro or storage location for vulnerable jar.
+            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                  # versions.
+              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                  # name.
+            },
+          },
+          &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
+              # The severity (e.g., distro assigned severity) for this vulnerability.
+          &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
+            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                # format. Examples include distro or storage location for vulnerable jar.
+            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                  # versions.
+              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                  # name.
+            },
+          },
+        },
+      ],
+    },
+    &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
+      &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
+        &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
+            # Deprecated, do not use.
+        &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
+            # details to show to the user. The LocalizedMessage is output only and
+            # populated by the API.
+            # different programming environments, including REST APIs and RPC APIs. It is
+            # used by [gRPC](https://github.com/grpc). Each `Status` message contains
+            # three pieces of data: error code, error message, and error details.
+            #
+            # You can find out more about this error model and how to work with it in the
+            # [API Design Guide](https://cloud.google.com/apis/design/errors).
+          &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
+              # user-facing error message should be localized and sent in the
+              # google.rpc.Status.details field, or localized by the client.
+          &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+          &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
+              # message types for APIs to use.
+            {
+              &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+            },
+          ],
+        },
+        &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
+        &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
+      },
+    },
+    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
+    &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
+      &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
+          # details about the build from source to completion.
+        &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
+        &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
+        &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
+        &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
+            # user&#x27;s e-mail address at the time the build was initiated; this address may
+            # not represent the same end-user for all time.
+        &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
+        &quot;builtArtifacts&quot;: [ # Output of the build.
+          { # Artifact describes a build product.
+            &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
+                # the case of a container build, the name used to push the container image to
+                # Google Container Registry, as presented to `docker push`. Note that a
+                # single Artifact ID can have multiple names, for example if two tags are
+                # applied to one image.
+              &quot;A String&quot;,
+            ],
+            &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
+                # like `gcr.io/projectID/imagename@sha256:123456`.
+            &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
+                # container.
+          },
+        ],
+        &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
+            # build providers can enter any desired additional details.
+          &quot;a_key&quot;: &quot;A String&quot;,
+        },
+        &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
+        &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
+        &quot;commands&quot;: [ # Commands requested by the build.
+          { # Command describes a step performed as part of the build pipeline.
+            &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
+              &quot;A String&quot;,
+            ],
+            &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
+                # this command as a dependency.
+            &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
+                # command.
+            &quot;args&quot;: [ # Command-line arguments used when executing this command.
+              &quot;A String&quot;,
+            ],
+            &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
+                # command is packaged as a Docker container, as presented to `docker pull`.
+            &quot;env&quot;: [ # Environment variables set before running this command.
+              &quot;A String&quot;,
+            ],
+          },
+        ],
+        &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
+          &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
+              # with a path point to a unique revision of a single file or directory.
+            &quot;labels&quot;: { # Labels with user defined metadata.
+              &quot;a_key&quot;: &quot;A String&quot;,
+            },
+            &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+              &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+              &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+              &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                  # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                  # hostURI/project.
+              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                &quot;name&quot;: &quot;A String&quot;, # The alias name.
+              },
+            },
+            &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                # repository (e.g., GitHub).
+              &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+              &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+            },
+            &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                # Source Repo.
+              &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+              &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+                &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                    # winged-cargo-31) and a repo name within that project.
+                  &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                  &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+                },
+              },
+              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                &quot;name&quot;: &quot;A String&quot;, # The alias name.
+              },
+            },
+          },
+          &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
+              # location.
+          &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
+              # source integrity was maintained in the build.
+              #
+              # The keys to this map are file paths used as build source and the values
+              # contain the hash values for those files.
+              #
+              # If the build source came in a single package such as a gzipped tarfile
+              # (.tar.gz), the FileHash will be for the single path to that file.
+            &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
+                # messages to verify integrity of source input to the build.
+              &quot;fileHash&quot;: [ # Required. Collection of file hashes.
+                { # Container message for hash values.
+                  &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+                  &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+                },
+              ],
+            },
+          },
+          &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
+              # these locations, in the case where the source repository had multiple
+              # remotes or submodules. This list will not include the context specified in
+              # the context field.
+            { # A SourceContext is a reference to a tree of files. A SourceContext together
+                # with a path point to a unique revision of a single file or directory.
+              &quot;labels&quot;: { # Labels with user defined metadata.
+                &quot;a_key&quot;: &quot;A String&quot;,
+              },
+              &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+                &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+                &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+                &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                    # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                    # hostURI/project.
+                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
+                },
+              },
+              &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                  # repository (e.g., GitHub).
+                &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+                &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+              },
+              &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                  # Source Repo.
+                &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+                &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                  &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+                  &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                      # winged-cargo-31) and a repo name within that project.
+                    &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                    &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+                  },
+                },
+                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
+                },
+              },
+            },
+          ],
+        },
+        &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
+        &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
+      },
+      &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
+          # build signature in the corresponding build note. After verifying the
+          # signature, `provenance_bytes` can be unmarshalled and compared to the
+          # provenance to confirm that it is unchanged. A base64-encoded string
+          # representation of the provenance bytes is used for the signature in order
+          # to interoperate with openssl which expects this format for signature
+          # verification.
+          #
+          # The serialized form is captured both to avoid ambiguity in how the
+          # provenance is marshalled to json as well to prevent incompatibilities with
+          # future changes.
     },
     &quot;derivedImage&quot;: { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
         # note.
       &quot;derivedImage&quot;: { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
           # relationship. This image would be produced from a Dockerfile with FROM
           # &lt;DockerImage.Basis in attached Note&gt;.
-        &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
-          &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
-            &quot;A String&quot;,
-          ],
-          &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
-              # representation.
-          &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
-              #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
-              # Only the name of the final blob is kept.
-        },
+        &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
+            # occurrence.
+        &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
+            # associated image basis.
         &quot;layerInfo&quot;: [ # This contains layer-specific metadata, if populated it has length
             # &quot;distance&quot; and is ordered with [distance] being the layer immediately
             # following the base image and [1] being the final layer.
@@ -2228,12 +2219,21 @@
             &quot;arguments&quot;: &quot;A String&quot;, # The recovered arguments to the Dockerfile directive.
           },
         ],
-        &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
-            # associated image basis.
-        &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
-            # occurrence.
+        &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
+          &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
+              # representation.
+          &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
+            &quot;A String&quot;,
+          ],
+          &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
+              #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
+              # Only the name of the final blob is kept.
+        },
       },
     },
+    &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
+        # specified. This field can be used as a filter in list requests.
+    &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
   }</pre>
 </div>
 
@@ -2282,441 +2282,19 @@
   An object of the form:
 
     { # An instance of an analysis type that has been found on a resource.
-    &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
-        # specified. This field can be used as a filter in list requests.
-    &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
-      &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
-          #
-          # The name of the resource. For example, the name of a Docker image -
-          # &quot;Debian&quot;.
-      &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
-          #
-          # The hash of the resource content. For example, the Docker digest.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-        &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-      },
-      &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
-          # `https://gcr.io/project/image@sha256:foo` for a Docker image.
-    },
-    &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
-      &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
-          # attestation can be verified using the attached signature. If the verifier
-          # trusts the public key of the signer, then verifying the signature is
-          # sufficient to establish trust. In this circumstance, the authority to which
-          # this attestation is attached is primarily useful for look-up (how to find
-          # this attestation if you already know the authority and artifact to be
-          # verified) and intent (which authority was this attestation intended to sign
-          # for).
-        &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
-            # supports `ATTACHED` signatures, where the payload that is signed is included
-            # alongside the signature itself in the same file.
-          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-              # The verifier must ensure that the provided type is one that the verifier
-              # supports, and that the attestation payload is a valid instantiation of that
-              # type (for example by validating a JSON schema).
-          &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
-              # (GPG) or equivalent. Since this message only supports attached signatures,
-              # the payload that was signed must be attached. While the signature format
-              # supported is dependent on the verification implementation, currently only
-              # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
-              # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
-              # --output=signature.gpg payload.json` will create the signature content
-              # expected in this field in `signature.gpg` for the `payload.json`
-              # attestation payload.
-          &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
-              # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
-              # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
-              # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
-              # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
-              # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
-              # In gpg, the full fingerprint can be retrieved from the `fpr` field
-              # returned when calling --list-keys with --with-colons.  For example:
-              # ```
-              # gpg --with-colons --with-fingerprint --force-v4-certs \
-              #     --list-keys attester@example.com
-              # tru::1:1513631572:0:3:1:5
-              # pub:...&lt;SNIP&gt;...
-              # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
-              # ```
-              # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
-        },
-        &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
-            # This attestation must define the `serialized_payload` that the `signatures`
-            # verify and any metadata necessary to interpret that plaintext.  The
-            # signatures should always be over the `serialized_payload` bytestring.
-          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-              # The verifier must ensure that the provided type is one that the verifier
-              # supports, and that the attestation payload is a valid instantiation of that
-              # type (for example by validating a JSON schema).
-          &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
-              # should consider this attestation message verified if at least one
-              # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
-              # for more details on signature structure and verification.
-            { # Verifiers (e.g. Kritis implementations) MUST verify signatures
-                # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
-                # Typically this means that the verifier has been configured with a map from
-                # `public_key_id` to public key material (and any required parameters, e.g.
-                # signing algorithm).
-                #
-                # In particular, verification implementations MUST NOT treat the signature
-                # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
-                # DOES NOT validate or authenticate a public key; it only provides a mechanism
-                # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
-                # a trusted channel. Verification implementations MUST reject signatures in any
-                # of the following circumstances:
-                #   * The `public_key_id` is not recognized by the verifier.
-                #   * The public key that `public_key_id` refers to does not verify the
-                #     signature with respect to the payload.
-                #
-                # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
-                # included with the serialized `signature` bytes). Verifiers MUST ignore any
-                # &quot;attached&quot; payload and only verify signatures with respect to explicitly
-                # provided payload (e.g. a `payload` field on the proto message that holds
-                # this Signature, or the canonical serialization of the proto message that
-                # holds this signature).
-              &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
-                  #   * The `public_key_id` is required.
-                  #   * The `public_key_id` MUST be an RFC3986 conformant URI.
-                  #   * When possible, the `public_key_id` SHOULD be an immutable reference,
-                  #     such as a cryptographic digest.
-                  #
-                  # Examples of valid `public_key_id`s:
-                  #
-                  # OpenPGP V4 public key fingerprint:
-                  #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
-                  # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
-                  # details on this scheme.
-                  #
-                  # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
-                  # serialization):
-                  #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
-                  #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
-              &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
-                  # The payload that this signature verifies MUST be unambiguously provided
-                  # with the Signature during verification. A wrapper message might provide
-                  # the payload explicitly. Alternatively, a message might have a canonical
-                  # serialization that can always be unambiguously computed to derive the
-                  # payload.
-            },
-          ],
-          &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
-              # The encoding and semantic meaning of this payload must match what is set in
-              # `content_type`.
-        },
-      },
-    },
+    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
     &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the occurrence in the form of
         # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
-    &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
-      &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
-      &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
-      &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
-          # available, and note provider assigned severity when distro has not yet
-          # assigned a severity for this vulnerability.
-      &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
-      &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
-          # scale of 0-10 where 0 indicates low severity and 10 indicates high
-          # severity.
-      &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
-        { # Metadata for any related URL information.
-          &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
-          &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
-        },
-      ],
-      &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
-          # packages etc)
-      &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
-          # within the associated resource.
-        { # This message wraps a location affected by a vulnerability and its
-            # associated fix (if one is available).
-          &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
-              # The severity (e.g., distro assigned severity) for this vulnerability.
-          &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
-            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                  # name.
-              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                  # versions.
-              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-            },
-            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                # format. Examples include distro or storage location for vulnerable jar.
-          },
-          &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
-            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                  # name.
-              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                  # versions.
-              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-            },
-            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                # format. Examples include distro or storage location for vulnerable jar.
-          },
-        },
-      ],
-    },
-    &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
-      &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
-          # system.
-        &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
-            # have been found.
-          { # An occurrence of a particular package installation found within a system&#x27;s
-              # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
-            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
-                # denoting the package manager version distributing a package.
-            &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
-              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                  # name.
-              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                  # versions.
-              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-            },
-            &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
-          },
-        ],
-        &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
-      },
-    },
-    &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
-      &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
-          # build signature in the corresponding build note. After verifying the
-          # signature, `provenance_bytes` can be unmarshalled and compared to the
-          # provenance to confirm that it is unchanged. A base64-encoded string
-          # representation of the provenance bytes is used for the signature in order
-          # to interoperate with openssl which expects this format for signature
-          # verification.
-          #
-          # The serialized form is captured both to avoid ambiguity in how the
-          # provenance is marshalled to json as well to prevent incompatibilities with
-          # future changes.
-      &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
-          # details about the build from source to completion.
-        &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
-        &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
-        &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
-        &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
-          &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
-              # location.
-          &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
-              # these locations, in the case where the source repository had multiple
-              # remotes or submodules. This list will not include the context specified in
-              # the context field.
-            { # A SourceContext is a reference to a tree of files. A SourceContext together
-                # with a path point to a unique revision of a single file or directory.
-              &quot;labels&quot;: { # Labels with user defined metadata.
-                &quot;a_key&quot;: &quot;A String&quot;,
-              },
-              &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                  # repository (e.g., GitHub).
-                &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-                &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-              },
-              &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-                &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-                &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-                &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                    # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                    # hostURI/project.
-                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-                },
-              },
-              &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                  # Source Repo.
-                &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-                &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                  &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                      # winged-cargo-31) and a repo name within that project.
-                    &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                    &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-                  },
-                  &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-                },
-                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-                },
-              },
-            },
-          ],
-          &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
-              # source integrity was maintained in the build.
-              #
-              # The keys to this map are file paths used as build source and the values
-              # contain the hash values for those files.
-              #
-              # If the build source came in a single package such as a gzipped tarfile
-              # (.tar.gz), the FileHash will be for the single path to that file.
-            &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
-                # messages to verify integrity of source input to the build.
-              &quot;fileHash&quot;: [ # Required. Collection of file hashes.
-                { # Container message for hash values.
-                  &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-                  &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-                },
-              ],
-            },
-          },
-          &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
-              # with a path point to a unique revision of a single file or directory.
-            &quot;labels&quot;: { # Labels with user defined metadata.
-              &quot;a_key&quot;: &quot;A String&quot;,
-            },
-            &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                # repository (e.g., GitHub).
-              &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-              &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-            },
-            &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-              &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-              &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-              &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                  # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                  # hostURI/project.
-              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-              },
-            },
-            &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                # Source Repo.
-              &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-              &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                    # winged-cargo-31) and a repo name within that project.
-                  &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                  &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-                },
-                &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-              },
-              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-              },
-            },
-          },
-        },
-        &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
-        &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
-        &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
-        &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
-            # user&#x27;s e-mail address at the time the build was initiated; this address may
-            # not represent the same end-user for all time.
-        &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
-        &quot;commands&quot;: [ # Commands requested by the build.
-          { # Command describes a step performed as part of the build pipeline.
-            &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
-                # command.
-            &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
-              &quot;A String&quot;,
-            ],
-            &quot;env&quot;: [ # Environment variables set before running this command.
-              &quot;A String&quot;,
-            ],
-            &quot;args&quot;: [ # Command-line arguments used when executing this command.
-              &quot;A String&quot;,
-            ],
-            &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
-                # command is packaged as a Docker container, as presented to `docker pull`.
-            &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
-                # this command as a dependency.
-          },
-        ],
-        &quot;builtArtifacts&quot;: [ # Output of the build.
-          { # Artifact describes a build product.
-            &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
-                # container.
-            &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
-                # like `gcr.io/projectID/imagename@sha256:123456`.
-            &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
-                # the case of a container build, the name used to push the container image to
-                # Google Container Registry, as presented to `docker push`. Note that a
-                # single Artifact ID can have multiple names, for example if two tags are
-                # applied to one image.
-              &quot;A String&quot;,
-            ],
-          },
-        ],
-        &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
-        &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
-            # build providers can enter any desired additional details.
-          &quot;a_key&quot;: &quot;A String&quot;,
-        },
-      },
-    },
-    &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
-      &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
-        &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
-            # details to show to the user. The LocalizedMessage is output only and
-            # populated by the API.
-            # different programming environments, including REST APIs and RPC APIs. It is
-            # used by [gRPC](https://github.com/grpc). Each `Status` message contains
-            # three pieces of data: error code, error message, and error details.
-            #
-            # You can find out more about this error model and how to work with it in the
-            # [API Design Guide](https://cloud.google.com/apis/design/errors).
-          &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
-              # message types for APIs to use.
-            {
-              &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
-            },
-          ],
-          &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
-          &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
-              # user-facing error message should be localized and sent in the
-              # google.rpc.Status.details field, or localized by the client.
-        },
-        &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
-        &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
-        &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
-            # Deprecated, do not use.
-      },
-    },
-    &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
-        # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
-        # used as a filter in list requests.
-    &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
-      &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
-        &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
-        &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
-        &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
-        &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
-        &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
-        &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
-        &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
-            # the deployable field with the same name.
-          &quot;A String&quot;,
-        ],
-      },
-    },
-    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
-    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
-    &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
     &quot;intoto&quot;: { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
         # signatures and the in-toto link itself. This is used for occurrences of a
         # Grafeas in-toto note.
-      &quot;signed&quot;: { # This corresponds to an in-toto link.
-        &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
-            # be empty if links are generated for operations that aren&#x27;t directly mapped
-            # to a specific command. Each term in the command is an independent string
-            # in the list. An example of a command in the in-toto metadata field is:
-            # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
-          &quot;A String&quot;,
-        ],
-        &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
-            # are not the actual result of the step.
-            # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
-          &quot;customValues&quot;: {
-            &quot;a_key&quot;: &quot;A String&quot;,
-          },
+      &quot;signatures&quot;: [
+        { # A signature object consists of the KeyID used and the signature itself.
+          &quot;sig&quot;: &quot;A String&quot;,
+          &quot;keyid&quot;: &quot;A String&quot;,
         },
+      ],
+      &quot;signed&quot;: { # This corresponds to an in-toto link.
         &quot;environment&quot;: { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
             # environment. It is suggested for this field to contain information that
             # details environment variables, filesystem information, and the present
@@ -2762,29 +2340,442 @@
             &quot;resourceUri&quot;: &quot;A String&quot;,
           },
         ],
+        &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
+            # are not the actual result of the step.
+            # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
+          &quot;customValues&quot;: {
+            &quot;a_key&quot;: &quot;A String&quot;,
+          },
+        },
+        &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
+            # be empty if links are generated for operations that aren&#x27;t directly mapped
+            # to a specific command. Each term in the command is an independent string
+            # in the list. An example of a command in the in-toto metadata field is:
+            # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
+          &quot;A String&quot;,
+        ],
       },
-      &quot;signatures&quot;: [
-        { # A signature object consists of the KeyID used and the signature itself.
-          &quot;sig&quot;: &quot;A String&quot;,
-          &quot;keyid&quot;: &quot;A String&quot;,
+    },
+    &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
+      &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
+          #
+          # The hash of the resource content. For example, the Docker digest.
+        &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+        &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+      },
+      &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
+          # `https://gcr.io/project/image@sha256:foo` for a Docker image.
+      &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
+          #
+          # The name of the resource. For example, the name of a Docker image -
+          # &quot;Debian&quot;.
+    },
+    &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
+      &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
+          # attestation can be verified using the attached signature. If the verifier
+          # trusts the public key of the signer, then verifying the signature is
+          # sufficient to establish trust. In this circumstance, the authority to which
+          # this attestation is attached is primarily useful for look-up (how to find
+          # this attestation if you already know the authority and artifact to be
+          # verified) and intent (which authority was this attestation intended to sign
+          # for).
+        &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
+            # This attestation must define the `serialized_payload` that the `signatures`
+            # verify and any metadata necessary to interpret that plaintext.  The
+            # signatures should always be over the `serialized_payload` bytestring.
+          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+              # The verifier must ensure that the provided type is one that the verifier
+              # supports, and that the attestation payload is a valid instantiation of that
+              # type (for example by validating a JSON schema).
+          &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
+              # should consider this attestation message verified if at least one
+              # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
+              # for more details on signature structure and verification.
+            { # Verifiers (e.g. Kritis implementations) MUST verify signatures
+                # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
+                # Typically this means that the verifier has been configured with a map from
+                # `public_key_id` to public key material (and any required parameters, e.g.
+                # signing algorithm).
+                #
+                # In particular, verification implementations MUST NOT treat the signature
+                # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
+                # DOES NOT validate or authenticate a public key; it only provides a mechanism
+                # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
+                # a trusted channel. Verification implementations MUST reject signatures in any
+                # of the following circumstances:
+                #   * The `public_key_id` is not recognized by the verifier.
+                #   * The public key that `public_key_id` refers to does not verify the
+                #     signature with respect to the payload.
+                #
+                # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
+                # included with the serialized `signature` bytes). Verifiers MUST ignore any
+                # &quot;attached&quot; payload and only verify signatures with respect to explicitly
+                # provided payload (e.g. a `payload` field on the proto message that holds
+                # this Signature, or the canonical serialization of the proto message that
+                # holds this signature).
+              &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
+                  #   * The `public_key_id` is required.
+                  #   * The `public_key_id` SHOULD be an RFC3986 conformant URI.
+                  #   * When possible, the `public_key_id` SHOULD be an immutable reference,
+                  #     such as a cryptographic digest.
+                  #
+                  # Examples of valid `public_key_id`s:
+                  #
+                  # OpenPGP V4 public key fingerprint:
+                  #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
+                  # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
+                  # details on this scheme.
+                  #
+                  # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
+                  # serialization):
+                  #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
+                  #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
+              &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
+                  # The payload that this signature verifies MUST be unambiguously provided
+                  # with the Signature during verification. A wrapper message might provide
+                  # the payload explicitly. Alternatively, a message might have a canonical
+                  # serialization that can always be unambiguously computed to derive the
+                  # payload.
+            },
+          ],
+          &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
+              # The encoding and semantic meaning of this payload must match what is set in
+              # `content_type`.
+        },
+        &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
+            # supports `ATTACHED` signatures, where the payload that is signed is included
+            # alongside the signature itself in the same file.
+          &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
+              # (GPG) or equivalent. Since this message only supports attached signatures,
+              # the payload that was signed must be attached. While the signature format
+              # supported is dependent on the verification implementation, currently only
+              # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
+              # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
+              # --output=signature.gpg payload.json` will create the signature content
+              # expected in this field in `signature.gpg` for the `payload.json`
+              # attestation payload.
+          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+              # The verifier must ensure that the provided type is one that the verifier
+              # supports, and that the attestation payload is a valid instantiation of that
+              # type (for example by validating a JSON schema).
+          &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
+              # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
+              # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
+              # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
+              # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
+              # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
+              # In gpg, the full fingerprint can be retrieved from the `fpr` field
+              # returned when calling --list-keys with --with-colons.  For example:
+              # ```
+              # gpg --with-colons --with-fingerprint --force-v4-certs \
+              #     --list-keys attester@example.com
+              # tru::1:1513631572:0:3:1:5
+              # pub:...&lt;SNIP&gt;...
+              # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
+              # ```
+              # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
+        },
+      },
+    },
+    &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
+      &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
+        &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
+        &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
+        &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
+            # the deployable field with the same name.
+          &quot;A String&quot;,
+        ],
+        &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
+        &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
+        &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
+        &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
+      },
+    },
+    &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
+        # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
+        # used as a filter in list requests.
+    &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
+      &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
+          # system.
+        &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
+        &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
+            # have been found.
+          { # An occurrence of a particular package installation found within a system&#x27;s
+              # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
+            &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
+            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
+                # denoting the package manager version distributing a package.
+            &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
+              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                  # versions.
+              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                  # name.
+            },
+          },
+        ],
+      },
+    },
+    &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
+      &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
+      &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
+        { # Metadata for any related URL information.
+          &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
+          &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
         },
       ],
+      &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
+          # available, and note provider assigned severity when distro has not yet
+          # assigned a severity for this vulnerability.
+      &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
+      &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
+          # packages etc)
+      &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
+      &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
+          # scale of 0-10 where 0 indicates low severity and 10 indicates high
+          # severity.
+      &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
+          # within the associated resource.
+        { # This message wraps a location affected by a vulnerability and its
+            # associated fix (if one is available).
+          &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
+            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                # format. Examples include distro or storage location for vulnerable jar.
+            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                  # versions.
+              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                  # name.
+            },
+          },
+          &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
+              # The severity (e.g., distro assigned severity) for this vulnerability.
+          &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
+            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                # format. Examples include distro or storage location for vulnerable jar.
+            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                  # versions.
+              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                  # name.
+            },
+          },
+        },
+      ],
+    },
+    &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
+      &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
+        &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
+            # Deprecated, do not use.
+        &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
+            # details to show to the user. The LocalizedMessage is output only and
+            # populated by the API.
+            # different programming environments, including REST APIs and RPC APIs. It is
+            # used by [gRPC](https://github.com/grpc). Each `Status` message contains
+            # three pieces of data: error code, error message, and error details.
+            #
+            # You can find out more about this error model and how to work with it in the
+            # [API Design Guide](https://cloud.google.com/apis/design/errors).
+          &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
+              # user-facing error message should be localized and sent in the
+              # google.rpc.Status.details field, or localized by the client.
+          &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+          &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
+              # message types for APIs to use.
+            {
+              &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+            },
+          ],
+        },
+        &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
+        &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
+      },
+    },
+    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
+    &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
+      &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
+          # details about the build from source to completion.
+        &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
+        &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
+        &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
+        &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
+            # user&#x27;s e-mail address at the time the build was initiated; this address may
+            # not represent the same end-user for all time.
+        &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
+        &quot;builtArtifacts&quot;: [ # Output of the build.
+          { # Artifact describes a build product.
+            &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
+                # the case of a container build, the name used to push the container image to
+                # Google Container Registry, as presented to `docker push`. Note that a
+                # single Artifact ID can have multiple names, for example if two tags are
+                # applied to one image.
+              &quot;A String&quot;,
+            ],
+            &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
+                # like `gcr.io/projectID/imagename@sha256:123456`.
+            &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
+                # container.
+          },
+        ],
+        &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
+            # build providers can enter any desired additional details.
+          &quot;a_key&quot;: &quot;A String&quot;,
+        },
+        &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
+        &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
+        &quot;commands&quot;: [ # Commands requested by the build.
+          { # Command describes a step performed as part of the build pipeline.
+            &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
+              &quot;A String&quot;,
+            ],
+            &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
+                # this command as a dependency.
+            &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
+                # command.
+            &quot;args&quot;: [ # Command-line arguments used when executing this command.
+              &quot;A String&quot;,
+            ],
+            &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
+                # command is packaged as a Docker container, as presented to `docker pull`.
+            &quot;env&quot;: [ # Environment variables set before running this command.
+              &quot;A String&quot;,
+            ],
+          },
+        ],
+        &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
+          &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
+              # with a path point to a unique revision of a single file or directory.
+            &quot;labels&quot;: { # Labels with user defined metadata.
+              &quot;a_key&quot;: &quot;A String&quot;,
+            },
+            &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+              &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+              &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+              &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                  # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                  # hostURI/project.
+              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                &quot;name&quot;: &quot;A String&quot;, # The alias name.
+              },
+            },
+            &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                # repository (e.g., GitHub).
+              &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+              &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+            },
+            &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                # Source Repo.
+              &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+              &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+                &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                    # winged-cargo-31) and a repo name within that project.
+                  &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                  &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+                },
+              },
+              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                &quot;name&quot;: &quot;A String&quot;, # The alias name.
+              },
+            },
+          },
+          &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
+              # location.
+          &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
+              # source integrity was maintained in the build.
+              #
+              # The keys to this map are file paths used as build source and the values
+              # contain the hash values for those files.
+              #
+              # If the build source came in a single package such as a gzipped tarfile
+              # (.tar.gz), the FileHash will be for the single path to that file.
+            &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
+                # messages to verify integrity of source input to the build.
+              &quot;fileHash&quot;: [ # Required. Collection of file hashes.
+                { # Container message for hash values.
+                  &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+                  &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+                },
+              ],
+            },
+          },
+          &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
+              # these locations, in the case where the source repository had multiple
+              # remotes or submodules. This list will not include the context specified in
+              # the context field.
+            { # A SourceContext is a reference to a tree of files. A SourceContext together
+                # with a path point to a unique revision of a single file or directory.
+              &quot;labels&quot;: { # Labels with user defined metadata.
+                &quot;a_key&quot;: &quot;A String&quot;,
+              },
+              &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+                &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+                &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+                &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                    # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                    # hostURI/project.
+                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
+                },
+              },
+              &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                  # repository (e.g., GitHub).
+                &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+                &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+              },
+              &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                  # Source Repo.
+                &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+                &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                  &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+                  &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                      # winged-cargo-31) and a repo name within that project.
+                    &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                    &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+                  },
+                },
+                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
+                },
+              },
+            },
+          ],
+        },
+        &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
+        &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
+      },
+      &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
+          # build signature in the corresponding build note. After verifying the
+          # signature, `provenance_bytes` can be unmarshalled and compared to the
+          # provenance to confirm that it is unchanged. A base64-encoded string
+          # representation of the provenance bytes is used for the signature in order
+          # to interoperate with openssl which expects this format for signature
+          # verification.
+          #
+          # The serialized form is captured both to avoid ambiguity in how the
+          # provenance is marshalled to json as well to prevent incompatibilities with
+          # future changes.
     },
     &quot;derivedImage&quot;: { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
         # note.
       &quot;derivedImage&quot;: { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
           # relationship. This image would be produced from a Dockerfile with FROM
           # &lt;DockerImage.Basis in attached Note&gt;.
-        &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
-          &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
-            &quot;A String&quot;,
-          ],
-          &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
-              # representation.
-          &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
-              #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
-              # Only the name of the final blob is kept.
-        },
+        &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
+            # occurrence.
+        &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
+            # associated image basis.
         &quot;layerInfo&quot;: [ # This contains layer-specific metadata, if populated it has length
             # &quot;distance&quot; and is ordered with [distance] being the layer immediately
             # following the base image and [1] being the final layer.
@@ -2793,12 +2784,21 @@
             &quot;arguments&quot;: &quot;A String&quot;, # The recovered arguments to the Dockerfile directive.
           },
         ],
-        &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
-            # associated image basis.
-        &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
-            # occurrence.
+        &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
+          &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
+              # representation.
+          &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
+            &quot;A String&quot;,
+          ],
+          &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
+              #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
+              # Only the name of the final blob is kept.
+        },
       },
     },
+    &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
+        # specified. This field can be used as a filter in list requests.
+    &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
   }</pre>
 </div>
 
@@ -2952,6 +2952,51 @@
         # `condition` that determines how and when the `bindings` are applied. Each
         # of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
+            # `members` can have the following values:
+            #
+            # * `allUsers`: A special identifier that represents anyone who is
+            #    on the internet; with or without a Google account.
+            #
+            # * `allAuthenticatedUsers`: A special identifier that represents anyone
+            #    who is authenticated with a Google account or a service account.
+            #
+            # * `user:{emailid}`: An email address that represents a specific Google
+            #    account. For example, `alice@example.com` .
+            #
+            #
+            # * `serviceAccount:{emailid}`: An email address that represents a service
+            #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
+            #
+            # * `group:{emailid}`: An email address that represents a Google group.
+            #    For example, `admins@example.com`.
+            #
+            # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
+            #    identifier) representing a user that has been recently deleted. For
+            #    example, `alice@example.com?uid=123456789012345678901`. If the user is
+            #    recovered, this value reverts to `user:{emailid}` and the recovered user
+            #    retains the role in the binding.
+            #
+            # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
+            #    unique identifier) representing a service account that has been recently
+            #    deleted. For example,
+            #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
+            #    If the service account is undeleted, this value reverts to
+            #    `serviceAccount:{emailid}` and the undeleted service account retains the
+            #    role in the binding.
+            #
+            # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
+            #    identifier) representing a Google group that has been recently
+            #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
+            #    the group is recovered, this value reverts to `group:{emailid}` and the
+            #    recovered group retains the role in the binding.
+            #
+            #
+            # * `domain:{domain}`: The G Suite domain (primary) that represents all the
+            #    users of that domain. For example, `google.com` or `example.com`.
+            #
+          &quot;A String&quot;,
+        ],
         &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
             #
             # If the condition evaluates to `true`, then this binding applies to the
@@ -2998,57 +3043,12 @@
               # describes the expression, e.g. when hovered over it in a UI.
           &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
               # syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
+              # reporting, e.g. a file name and a position in the file.
           &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
               # its purpose. This can be used e.g. in UIs which allow to enter the
               # expression.
-          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
-              # reporting, e.g. a file name and a position in the file.
         },
-        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
-            # `members` can have the following values:
-            #
-            # * `allUsers`: A special identifier that represents anyone who is
-            #    on the internet; with or without a Google account.
-            #
-            # * `allAuthenticatedUsers`: A special identifier that represents anyone
-            #    who is authenticated with a Google account or a service account.
-            #
-            # * `user:{emailid}`: An email address that represents a specific Google
-            #    account. For example, `alice@example.com` .
-            #
-            #
-            # * `serviceAccount:{emailid}`: An email address that represents a service
-            #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
-            #
-            # * `group:{emailid}`: An email address that represents a Google group.
-            #    For example, `admins@example.com`.
-            #
-            # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
-            #    identifier) representing a user that has been recently deleted. For
-            #    example, `alice@example.com?uid=123456789012345678901`. If the user is
-            #    recovered, this value reverts to `user:{emailid}` and the recovered user
-            #    retains the role in the binding.
-            #
-            # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
-            #    unique identifier) representing a service account that has been recently
-            #    deleted. For example,
-            #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
-            #    If the service account is undeleted, this value reverts to
-            #    `serviceAccount:{emailid}` and the undeleted service account retains the
-            #    role in the binding.
-            #
-            # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
-            #    identifier) representing a Google group that has been recently
-            #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
-            #    the group is recovered, this value reverts to `group:{emailid}` and the
-            #    recovered group retains the role in the binding.
-            #
-            #
-            # * `domain:{domain}`: The G Suite domain (primary) that represents all the
-            #    users of that domain. For example, `google.com` or `example.com`.
-            #
-          &quot;A String&quot;,
-        ],
         &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
             # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
       },
@@ -3073,6 +3073,14 @@
   An object of the form:
 
     { # A type of analysis that can be done for a resource.
+    &quot;discovery&quot;: { # A note that indicates a type of analysis a provider would perform. This note # A note describing the initial analysis of a resource.
+        # exists in a provider&#x27;s project. A `Discovery` occurrence is created in a
+        # consumer&#x27;s project at the start of analysis.
+      &quot;analysisKind&quot;: &quot;A String&quot;, # Required. Immutable. The kind of analysis that is handled by this
+          # discovery.
+    },
+    &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the note in the form of
+        # `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
     &quot;attestationAuthority&quot;: { # Note kind that represents a logical attestation &quot;role&quot; or &quot;authority&quot;. For # A note describing an attestation role.
         # example, an organization might have one `Authority` for &quot;QA&quot; and one for
         # &quot;build&quot;. This note is intended to act strictly as a grouping mechanism for
@@ -3092,173 +3100,17 @@
             # example &quot;qa&quot;.
       },
     },
-    &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the note in the form of
-        # `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
-    &quot;vulnerability&quot;: { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
-      &quot;cvssV3&quot;: { # Common Vulnerability Scoring System version 3. # The full description of the CVSSv3.
-          # For details, see https://www.first.org/cvss/specification-document
-        &quot;baseScore&quot;: 3.14, # The base score is a function of the base metric scores.
-        &quot;scope&quot;: &quot;A String&quot;,
-        &quot;integrityImpact&quot;: &quot;A String&quot;,
-        &quot;exploitabilityScore&quot;: 3.14,
-        &quot;impactScore&quot;: 3.14,
-        &quot;attackComplexity&quot;: &quot;A String&quot;,
-        &quot;availabilityImpact&quot;: &quot;A String&quot;,
-        &quot;privilegesRequired&quot;: &quot;A String&quot;,
-        &quot;userInteraction&quot;: &quot;A String&quot;,
-        &quot;attackVector&quot;: &quot;A String&quot;, # Base Metrics
-            # Represents the intrinsic characteristics of a vulnerability that are
-            # constant over time and across user environments.
-        &quot;confidentialityImpact&quot;: &quot;A String&quot;,
-      },
-      &quot;sourceUpdateTime&quot;: &quot;A String&quot;, # The time this information was last changed at the source. This is an
-          # upstream timestamp from the underlying information source - e.g. Ubuntu
-          # security tracker.
-      &quot;windowsDetails&quot;: [ # Windows details get their own format because the information format and
-          # model don&#x27;t match a normal detail. Specifically Windows updates are done as
-          # patches, thus Windows vulnerabilities really are a missing package, rather
-          # than a package being at an incorrect version.
-        {
-          &quot;name&quot;: &quot;A String&quot;, # Required. The name of the vulnerability.
-          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in
-              # [cpe format](https://cpe.mitre.org/specification/) in which the
-              # vulnerability manifests. Examples include distro or storage location for
-              # vulnerable jar.
-          &quot;description&quot;: &quot;A String&quot;, # The description of the vulnerability.
-          &quot;fixingKbs&quot;: [ # Required. The names of the KBs which have hotfixes to mitigate this
-              # vulnerability. Note that there may be multiple hotfixes (and thus
-              # multiple KBs) that mitigate a given vulnerability. Currently any listed
-              # kb&#x27;s presence is considered a fix.
-            {
-              &quot;name&quot;: &quot;A String&quot;, # The KB name (generally of the form KB[0-9]+ i.e. KB123456).
-              &quot;url&quot;: &quot;A String&quot;, # A link to the KB in the Windows update catalog -
-                  # https://www.catalog.update.microsoft.com/
-            },
+    &quot;intoto&quot;: { # This contains the fields corresponding to the definition of a software supply # A note describing an in-toto link.
+        # chain step in an in-toto layout. This information goes into a Grafeas note.
+      &quot;expectedMaterials&quot;: [ # The following fields contain in-toto artifact rules identifying the
+          # artifacts that enter this supply chain step, and exit the supply chain
+          # step, i.e. materials and products of the step.
+        { # Defines an object to declare an in-toto artifact rule
+          &quot;artifactRule&quot;: [
+            &quot;A String&quot;,
           ],
         },
       ],
-      &quot;details&quot;: [ # All information about the package to specifically identify this
-          # vulnerability. One entry per (version range and cpe_uri) the package
-          # vulnerability has manifested in.
-        { # Identifies all appearances of this vulnerability in the package for a
-            # specific distro/location. For example: glibc in
-            # cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2
-          &quot;isObsolete&quot;: True or False, # Whether this detail is obsolete. Occurrences are expected not to point to
-              # obsolete details.
-          &quot;sourceUpdateTime&quot;: &quot;A String&quot;, # The time this information was last changed at the source. This is an
-              # upstream timestamp from the underlying information source - e.g. Ubuntu
-              # security tracker.
-          &quot;packageType&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
-              # packages etc).
-          &quot;fixedLocation&quot;: { # The location of the vulnerability. # The fix for this specific package version.
-            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                  # name.
-              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                  # versions.
-              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-            },
-            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                # format. Examples include distro or storage location for vulnerable jar.
-          },
-          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in
-              # [cpe format](https://cpe.mitre.org/specification/) in which the
-              # vulnerability manifests. Examples include distro or storage location for
-              # vulnerable jar.
-          &quot;description&quot;: &quot;A String&quot;, # A vendor-specific description of this note.
-          &quot;severityName&quot;: &quot;A String&quot;, # The severity (eg: distro assigned severity) for this vulnerability.
-          &quot;minAffectedVersion&quot;: { # Version contains structured information about the version of a package. # The min version of the package in which the vulnerability exists.
-            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                # name.
-            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                # versions.
-            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-          },
-          &quot;maxAffectedVersion&quot;: { # Version contains structured information about the version of a package. # The max version of the package in which the vulnerability exists.
-            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                # name.
-            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                # versions.
-            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-          },
-          &quot;package&quot;: &quot;A String&quot;, # Required. The name of the package where the vulnerability was found.
-        },
-      ],
-      &quot;severity&quot;: &quot;A String&quot;, # Note provider assigned impact of the vulnerability.
-      &quot;cvssScore&quot;: 3.14, # The CVSS score for this vulnerability.
-    },
-    &quot;relatedNoteNames&quot;: [ # Other notes related to this note.
-      &quot;A String&quot;,
-    ],
-    &quot;build&quot;: { # Note holding the version of the provider&#x27;s builder and the signature of the # A note describing build provenance for a verifiable build.
-        # provenance message in the build details occurrence.
-      &quot;signature&quot;: { # Message encapsulating the signature of the verified build. # Signature of the build in occurrences pointing to this build note
-          # containing build details.
-        &quot;keyType&quot;: &quot;A String&quot;, # The type of the key, either stored in `public_key` or referenced in
-            # `key_id`.
-        &quot;signature&quot;: &quot;A String&quot;, # Required. Signature of the related `BuildProvenance`. In JSON, this is
-            # base-64 encoded.
-        &quot;publicKey&quot;: &quot;A String&quot;, # Public key of the builder which can be used to verify that the related
-            # findings are valid and unchanged. If `key_type` is empty, this defaults
-            # to PEM encoded public keys.
-            #
-            # This field may be empty if `key_id` references an external key.
-            #
-            # For Cloud Build based signatures, this is a PEM encoded public
-            # key. To verify the Cloud Build signature, place the contents of
-            # this field into a file (public.pem). The signature field is base64-decoded
-            # into its binary representation in signature.bin, and the provenance bytes
-            # from `BuildDetails` are base64-decoded into a binary representation in
-            # signed.bin. OpenSSL can then verify the signature:
-            # `openssl sha256 -verify public.pem -signature signature.bin signed.bin`
-        &quot;keyId&quot;: &quot;A String&quot;, # An ID for the key used to sign. This could be either an ID for the key
-            # stored in `public_key` (such as the ID or fingerprint for a PGP key, or the
-            # CN for a cert), or a reference to an external key (such as a reference to a
-            # key in Cloud Key Management Service).
-      },
-      &quot;builderVersion&quot;: &quot;A String&quot;, # Required. Immutable. Version of the builder which produced this build.
-    },
-    &quot;package&quot;: { # This represents a particular package that is distributed over various # A note describing a package hosted by various package managers.
-        # channels. E.g., glibc (aka libc6) is distributed by many, at various
-        # versions.
-      &quot;name&quot;: &quot;A String&quot;, # Required. Immutable. The name of the package.
-      &quot;distribution&quot;: [ # The various channels by which a package is distributed.
-        { # This represents a particular channel of distribution for a given package.
-            # E.g., Debian&#x27;s jessie-backports dpkg mirror.
-          &quot;maintainer&quot;: &quot;A String&quot;, # A freeform string denoting the maintainer of this package.
-          &quot;latestVersion&quot;: { # Version contains structured information about the version of a package. # The latest available version of this package in this distribution channel.
-            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                # name.
-            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                # versions.
-            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-          },
-          &quot;description&quot;: &quot;A String&quot;, # The distribution channel-specific description of this package.
-          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The cpe_uri in [CPE format](https://cpe.mitre.org/specification/)
-              # denoting the package manager version distributing a package.
-          &quot;url&quot;: &quot;A String&quot;, # The distribution channel-specific homepage for this package.
-          &quot;architecture&quot;: &quot;A String&quot;, # The CPU architecture for which packages in this distribution channel were
-              # built.
-        },
-      ],
-    },
-    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this note was created. This field can be used as a
-        # filter in list requests.
-    &quot;discovery&quot;: { # A note that indicates a type of analysis a provider would perform. This note # A note describing the initial analysis of a resource.
-        # exists in a provider&#x27;s project. A `Discovery` occurrence is created in a
-        # consumer&#x27;s project at the start of analysis.
-      &quot;analysisKind&quot;: &quot;A String&quot;, # Required. Immutable. The kind of analysis that is handled by this
-          # discovery.
-    },
-    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as
-        # a filter in list requests.
-    &quot;intoto&quot;: { # This contains the fields corresponding to the definition of a software supply # A note describing an in-toto link.
-        # chain step in an in-toto layout. This information goes into a Grafeas note.
       &quot;expectedProducts&quot;: [
         { # Defines an object to declare an in-toto artifact rule
           &quot;artifactRule&quot;: [
@@ -3266,7 +3118,6 @@
           ],
         },
       ],
-      &quot;stepName&quot;: &quot;A String&quot;, # This field identifies the name of the step in the supply chain.
       &quot;signingKeys&quot;: [ # This field contains the public keys that can be used to verify the
           # signatures on the step metadata.
         { # This defines the format used to record keys used in the software supply
@@ -3280,47 +3131,35 @@
             # }
             # The format for in-toto&#x27;s key definition can be found in section 4.2 of the
             # in-toto specification.
-          &quot;keyId&quot;: &quot;A String&quot;, # key_id is an identifier for the signing key.
-          &quot;publicKeyValue&quot;: &quot;A String&quot;, # This field contains the actual public key.
-          &quot;keyType&quot;: &quot;A String&quot;, # This field identifies the specific signing method. Eg: &quot;rsa&quot;, &quot;ed25519&quot;,
-              # and &quot;ecdsa&quot;.
           &quot;keyScheme&quot;: &quot;A String&quot;, # This field contains the corresponding signature scheme.
               # Eg: &quot;rsassa-pss-sha256&quot;.
+          &quot;keyType&quot;: &quot;A String&quot;, # This field identifies the specific signing method. Eg: &quot;rsa&quot;, &quot;ed25519&quot;,
+              # and &quot;ecdsa&quot;.
+          &quot;keyId&quot;: &quot;A String&quot;, # key_id is an identifier for the signing key.
+          &quot;publicKeyValue&quot;: &quot;A String&quot;, # This field contains the actual public key.
         },
       ],
       &quot;threshold&quot;: &quot;A String&quot;, # This field contains a value that indicates the minimum number of keys that
           # need to be used to sign the step&#x27;s in-toto link.
-      &quot;expectedMaterials&quot;: [ # The following fields contain in-toto artifact rules identifying the
-          # artifacts that enter this supply chain step, and exit the supply chain
-          # step, i.e. materials and products of the step.
-        { # Defines an object to declare an in-toto artifact rule
-          &quot;artifactRule&quot;: [
-            &quot;A String&quot;,
-          ],
-        },
-      ],
+      &quot;stepName&quot;: &quot;A String&quot;, # This field identifies the name of the step in the supply chain.
       &quot;expectedCommand&quot;: [ # This field contains the expected command used to perform the step.
         &quot;A String&quot;,
       ],
     },
-    &quot;relatedUrl&quot;: [ # URLs associated with this note.
-      { # Metadata for any related URL information.
-        &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
-        &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
-      },
-    ],
-    &quot;expirationTime&quot;: &quot;A String&quot;, # Time of expiration for this note. Empty if note does not expire.
+    &quot;kind&quot;: &quot;A String&quot;, # Output only. The type of analysis. This field can be used as a filter in
+        # list requests.
+    &quot;longDescription&quot;: &quot;A String&quot;, # A detailed description of this note.
     &quot;baseImage&quot;: { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.
         # relationship. Linked occurrences are derived from this or an
         # equivalent image via:
         #   FROM &lt;Basis.resource_url&gt;
         # Or an equivalent reference, e.g. a tag of the resource_url.
       &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. Immutable. The fingerprint of the base image.
+        &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
+            # representation.
         &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
           &quot;A String&quot;,
         ],
-        &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
-            # representation.
         &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
             #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
             # Only the name of the final blob is kept.
@@ -3328,15 +3167,176 @@
       &quot;resourceUrl&quot;: &quot;A String&quot;, # Required. Immutable. The resource_url for the resource representing the
           # basis of associated occurrence images.
     },
-    &quot;kind&quot;: &quot;A String&quot;, # Output only. The type of analysis. This field can be used as a filter in
-        # list requests.
-    &quot;longDescription&quot;: &quot;A String&quot;, # A detailed description of this note.
+    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as
+        # a filter in list requests.
+    &quot;build&quot;: { # Note holding the version of the provider&#x27;s builder and the signature of the # A note describing build provenance for a verifiable build.
+        # provenance message in the build details occurrence.
+      &quot;builderVersion&quot;: &quot;A String&quot;, # Required. Immutable. Version of the builder which produced this build.
+      &quot;signature&quot;: { # Message encapsulating the signature of the verified build. # Signature of the build in occurrences pointing to this build note
+          # containing build details.
+        &quot;publicKey&quot;: &quot;A String&quot;, # Public key of the builder which can be used to verify that the related
+            # findings are valid and unchanged. If `key_type` is empty, this defaults
+            # to PEM encoded public keys.
+            #
+            # This field may be empty if `key_id` references an external key.
+            #
+            # For Cloud Build based signatures, this is a PEM encoded public
+            # key. To verify the Cloud Build signature, place the contents of
+            # this field into a file (public.pem). The signature field is base64-decoded
+            # into its binary representation in signature.bin, and the provenance bytes
+            # from `BuildDetails` are base64-decoded into a binary representation in
+            # signed.bin. OpenSSL can then verify the signature:
+            # `openssl sha256 -verify public.pem -signature signature.bin signed.bin`
+        &quot;keyType&quot;: &quot;A String&quot;, # The type of the key, either stored in `public_key` or referenced in
+            # `key_id`.
+        &quot;signature&quot;: &quot;A String&quot;, # Required. Signature of the related `BuildProvenance`. In JSON, this is
+            # base-64 encoded.
+        &quot;keyId&quot;: &quot;A String&quot;, # An ID for the key used to sign. This could be either an ID for the key
+            # stored in `public_key` (such as the ID or fingerprint for a PGP key, or the
+            # CN for a cert), or a reference to an external key (such as a reference to a
+            # key in Cloud Key Management Service).
+      },
+    },
+    &quot;expirationTime&quot;: &quot;A String&quot;, # Time of expiration for this note. Empty if note does not expire.
+    &quot;relatedUrl&quot;: [ # URLs associated with this note.
+      { # Metadata for any related URL information.
+        &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
+        &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
+      },
+    ],
+    &quot;vulnerability&quot;: { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
+      &quot;cvssScore&quot;: 3.14, # The CVSS score for this vulnerability.
+      &quot;windowsDetails&quot;: [ # Windows details get their own format because the information format and
+          # model don&#x27;t match a normal detail. Specifically Windows updates are done as
+          # patches, thus Windows vulnerabilities really are a missing package, rather
+          # than a package being at an incorrect version.
+        {
+          &quot;name&quot;: &quot;A String&quot;, # Required. The name of the vulnerability.
+          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in
+              # [cpe format](https://cpe.mitre.org/specification/) in which the
+              # vulnerability manifests. Examples include distro or storage location for
+              # vulnerable jar.
+          &quot;fixingKbs&quot;: [ # Required. The names of the KBs which have hotfixes to mitigate this
+              # vulnerability. Note that there may be multiple hotfixes (and thus
+              # multiple KBs) that mitigate a given vulnerability. Currently any listed
+              # kb&#x27;s presence is considered a fix.
+            {
+              &quot;name&quot;: &quot;A String&quot;, # The KB name (generally of the form KB[0-9]+ i.e. KB123456).
+              &quot;url&quot;: &quot;A String&quot;, # A link to the KB in the Windows update catalog -
+                  # https://www.catalog.update.microsoft.com/
+            },
+          ],
+          &quot;description&quot;: &quot;A String&quot;, # The description of the vulnerability.
+        },
+      ],
+      &quot;sourceUpdateTime&quot;: &quot;A String&quot;, # The time this information was last changed at the source. This is an
+          # upstream timestamp from the underlying information source - e.g. Ubuntu
+          # security tracker.
+      &quot;severity&quot;: &quot;A String&quot;, # Note provider assigned impact of the vulnerability.
+      &quot;details&quot;: [ # All information about the package to specifically identify this
+          # vulnerability. One entry per (version range and cpe_uri) the package
+          # vulnerability has manifested in.
+        { # Identifies all appearances of this vulnerability in the package for a
+            # specific distro/location. For example: glibc in
+            # cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2
+          &quot;sourceUpdateTime&quot;: &quot;A String&quot;, # The time this information was last changed at the source. This is an
+              # upstream timestamp from the underlying information source - e.g. Ubuntu
+              # security tracker.
+          &quot;packageType&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
+              # packages etc).
+          &quot;fixedLocation&quot;: { # The location of the vulnerability. # The fix for this specific package version.
+            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                # format. Examples include distro or storage location for vulnerable jar.
+            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                  # versions.
+              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                  # name.
+            },
+          },
+          &quot;minAffectedVersion&quot;: { # Version contains structured information about the version of a package. # The min version of the package in which the vulnerability exists.
+            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                # versions.
+            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                # name.
+          },
+          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in
+              # [cpe format](https://cpe.mitre.org/specification/) in which the
+              # vulnerability manifests. Examples include distro or storage location for
+              # vulnerable jar.
+          &quot;isObsolete&quot;: True or False, # Whether this detail is obsolete. Occurrences are expected not to point to
+              # obsolete details.
+          &quot;description&quot;: &quot;A String&quot;, # A vendor-specific description of this note.
+          &quot;maxAffectedVersion&quot;: { # Version contains structured information about the version of a package. # The max version of the package in which the vulnerability exists.
+            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                # versions.
+            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                # name.
+          },
+          &quot;package&quot;: &quot;A String&quot;, # Required. The name of the package where the vulnerability was found.
+          &quot;severityName&quot;: &quot;A String&quot;, # The severity (eg: distro assigned severity) for this vulnerability.
+        },
+      ],
+      &quot;cvssV3&quot;: { # Common Vulnerability Scoring System version 3. # The full description of the CVSSv3.
+          # For details, see https://www.first.org/cvss/specification-document
+        &quot;baseScore&quot;: 3.14, # The base score is a function of the base metric scores.
+        &quot;confidentialityImpact&quot;: &quot;A String&quot;,
+        &quot;availabilityImpact&quot;: &quot;A String&quot;,
+        &quot;attackVector&quot;: &quot;A String&quot;, # Base Metrics
+            # Represents the intrinsic characteristics of a vulnerability that are
+            # constant over time and across user environments.
+        &quot;privilegesRequired&quot;: &quot;A String&quot;,
+        &quot;impactScore&quot;: 3.14,
+        &quot;attackComplexity&quot;: &quot;A String&quot;,
+        &quot;scope&quot;: &quot;A String&quot;,
+        &quot;exploitabilityScore&quot;: 3.14,
+        &quot;userInteraction&quot;: &quot;A String&quot;,
+        &quot;integrityImpact&quot;: &quot;A String&quot;,
+      },
+    },
+    &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this note.
+    &quot;relatedNoteNames&quot;: [ # Other notes related to this note.
+      &quot;A String&quot;,
+    ],
+    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this note was created. This field can be used as a
+        # filter in list requests.
     &quot;deployable&quot;: { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.
       &quot;resourceUri&quot;: [ # Required. Resource URI for the artifact being deployed.
         &quot;A String&quot;,
       ],
     },
-    &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this note.
+    &quot;package&quot;: { # This represents a particular package that is distributed over various # A note describing a package hosted by various package managers.
+        # channels. E.g., glibc (aka libc6) is distributed by many, at various
+        # versions.
+      &quot;distribution&quot;: [ # The various channels by which a package is distributed.
+        { # This represents a particular channel of distribution for a given package.
+            # E.g., Debian&#x27;s jessie-backports dpkg mirror.
+          &quot;latestVersion&quot;: { # Version contains structured information about the version of a package. # The latest available version of this package in this distribution channel.
+            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                # versions.
+            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                # name.
+          },
+          &quot;url&quot;: &quot;A String&quot;, # The distribution channel-specific homepage for this package.
+          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The cpe_uri in [CPE format](https://cpe.mitre.org/specification/)
+              # denoting the package manager version distributing a package.
+          &quot;description&quot;: &quot;A String&quot;, # The distribution channel-specific description of this package.
+          &quot;architecture&quot;: &quot;A String&quot;, # The CPU architecture for which packages in this distribution channel were
+              # built.
+          &quot;maintainer&quot;: &quot;A String&quot;, # A freeform string denoting the maintainer of this package.
+        },
+      ],
+      &quot;name&quot;: &quot;A String&quot;, # Required. Immutable. The name of the package.
+    },
   }</pre>
 </div>
 
@@ -3360,11 +3360,10 @@
       # severity type.
     &quot;counts&quot;: [ # A listing by resource of the number of fixable and total vulnerabilities.
       { # Per resource and severity counts of fixable and total vulnerabilities.
+        &quot;severity&quot;: &quot;A String&quot;, # The severity for this count. SEVERITY_UNSPECIFIED indicates total across
+            # all severities.
+        &quot;fixableCount&quot;: &quot;A String&quot;, # The number of fixable vulnerabilities associated with this resource.
         &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # The affected resource.
-          &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
-              #
-              # The name of the resource. For example, the name of a Docker image -
-              # &quot;Debian&quot;.
           &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
               #
               # The hash of the resource content. For example, the Docker digest.
@@ -3373,11 +3372,12 @@
           },
           &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
               # `https://gcr.io/project/image@sha256:foo` for a Docker image.
+          &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
+              #
+              # The name of the resource. For example, the name of a Docker image -
+              # &quot;Debian&quot;.
         },
-        &quot;severity&quot;: &quot;A String&quot;, # The severity for this count. SEVERITY_UNSPECIFIED indicates total across
-            # all severities.
         &quot;totalCount&quot;: &quot;A String&quot;, # The total number of vulnerabilities associated with this resource.
-        &quot;fixableCount&quot;: &quot;A String&quot;, # The number of fixable vulnerabilities associated with this resource.
       },
     ],
   }</pre>
@@ -3403,443 +3403,24 @@
   An object of the form:
 
     { # Response for listing occurrences.
+    &quot;nextPageToken&quot;: &quot;A String&quot;, # The next pagination token in the list response. It should be used as
+        # `page_token` for the following request. An empty value means no more
+        # results.
     &quot;occurrences&quot;: [ # The occurrences requested.
       { # An instance of an analysis type that has been found on a resource.
-        &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
-            # specified. This field can be used as a filter in list requests.
-        &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
-          &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
-              #
-              # The name of the resource. For example, the name of a Docker image -
-              # &quot;Debian&quot;.
-          &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
-              #
-              # The hash of the resource content. For example, the Docker digest.
-            &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-            &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-          },
-          &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
-              # `https://gcr.io/project/image@sha256:foo` for a Docker image.
-        },
-        &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
-          &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
-              # attestation can be verified using the attached signature. If the verifier
-              # trusts the public key of the signer, then verifying the signature is
-              # sufficient to establish trust. In this circumstance, the authority to which
-              # this attestation is attached is primarily useful for look-up (how to find
-              # this attestation if you already know the authority and artifact to be
-              # verified) and intent (which authority was this attestation intended to sign
-              # for).
-            &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
-                # supports `ATTACHED` signatures, where the payload that is signed is included
-                # alongside the signature itself in the same file.
-              &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-                  # The verifier must ensure that the provided type is one that the verifier
-                  # supports, and that the attestation payload is a valid instantiation of that
-                  # type (for example by validating a JSON schema).
-              &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
-                  # (GPG) or equivalent. Since this message only supports attached signatures,
-                  # the payload that was signed must be attached. While the signature format
-                  # supported is dependent on the verification implementation, currently only
-                  # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
-                  # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
-                  # --output=signature.gpg payload.json` will create the signature content
-                  # expected in this field in `signature.gpg` for the `payload.json`
-                  # attestation payload.
-              &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
-                  # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
-                  # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
-                  # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
-                  # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
-                  # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
-                  # In gpg, the full fingerprint can be retrieved from the `fpr` field
-                  # returned when calling --list-keys with --with-colons.  For example:
-                  # ```
-                  # gpg --with-colons --with-fingerprint --force-v4-certs \
-                  #     --list-keys attester@example.com
-                  # tru::1:1513631572:0:3:1:5
-                  # pub:...&lt;SNIP&gt;...
-                  # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
-                  # ```
-                  # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
-            },
-            &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
-                # This attestation must define the `serialized_payload` that the `signatures`
-                # verify and any metadata necessary to interpret that plaintext.  The
-                # signatures should always be over the `serialized_payload` bytestring.
-              &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-                  # The verifier must ensure that the provided type is one that the verifier
-                  # supports, and that the attestation payload is a valid instantiation of that
-                  # type (for example by validating a JSON schema).
-              &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
-                  # should consider this attestation message verified if at least one
-                  # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
-                  # for more details on signature structure and verification.
-                { # Verifiers (e.g. Kritis implementations) MUST verify signatures
-                    # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
-                    # Typically this means that the verifier has been configured with a map from
-                    # `public_key_id` to public key material (and any required parameters, e.g.
-                    # signing algorithm).
-                    #
-                    # In particular, verification implementations MUST NOT treat the signature
-                    # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
-                    # DOES NOT validate or authenticate a public key; it only provides a mechanism
-                    # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
-                    # a trusted channel. Verification implementations MUST reject signatures in any
-                    # of the following circumstances:
-                    #   * The `public_key_id` is not recognized by the verifier.
-                    #   * The public key that `public_key_id` refers to does not verify the
-                    #     signature with respect to the payload.
-                    #
-                    # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
-                    # included with the serialized `signature` bytes). Verifiers MUST ignore any
-                    # &quot;attached&quot; payload and only verify signatures with respect to explicitly
-                    # provided payload (e.g. a `payload` field on the proto message that holds
-                    # this Signature, or the canonical serialization of the proto message that
-                    # holds this signature).
-                  &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
-                      #   * The `public_key_id` is required.
-                      #   * The `public_key_id` MUST be an RFC3986 conformant URI.
-                      #   * When possible, the `public_key_id` SHOULD be an immutable reference,
-                      #     such as a cryptographic digest.
-                      #
-                      # Examples of valid `public_key_id`s:
-                      #
-                      # OpenPGP V4 public key fingerprint:
-                      #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
-                      # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
-                      # details on this scheme.
-                      #
-                      # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
-                      # serialization):
-                      #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
-                      #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
-                  &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
-                      # The payload that this signature verifies MUST be unambiguously provided
-                      # with the Signature during verification. A wrapper message might provide
-                      # the payload explicitly. Alternatively, a message might have a canonical
-                      # serialization that can always be unambiguously computed to derive the
-                      # payload.
-                },
-              ],
-              &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
-                  # The encoding and semantic meaning of this payload must match what is set in
-                  # `content_type`.
-            },
-          },
-        },
+        &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
         &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the occurrence in the form of
             # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
-        &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
-          &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
-          &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
-          &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
-              # available, and note provider assigned severity when distro has not yet
-              # assigned a severity for this vulnerability.
-          &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
-          &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
-              # scale of 0-10 where 0 indicates low severity and 10 indicates high
-              # severity.
-          &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
-            { # Metadata for any related URL information.
-              &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
-              &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
-            },
-          ],
-          &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
-              # packages etc)
-          &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
-              # within the associated resource.
-            { # This message wraps a location affected by a vulnerability and its
-                # associated fix (if one is available).
-              &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
-                  # The severity (e.g., distro assigned severity) for this vulnerability.
-              &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
-                &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-                &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-                  &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-                  &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                      # name.
-                  &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                      # versions.
-                  &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-                },
-                &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                    # format. Examples include distro or storage location for vulnerable jar.
-              },
-              &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
-                &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-                &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-                  &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-                  &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                      # name.
-                  &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                      # versions.
-                  &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-                },
-                &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                    # format. Examples include distro or storage location for vulnerable jar.
-              },
-            },
-          ],
-        },
-        &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
-          &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
-              # system.
-            &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
-                # have been found.
-              { # An occurrence of a particular package installation found within a system&#x27;s
-                  # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
-                &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
-                    # denoting the package manager version distributing a package.
-                &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
-                  &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-                  &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                      # name.
-                  &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                      # versions.
-                  &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-                },
-                &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
-              },
-            ],
-            &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
-          },
-        },
-        &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
-          &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
-              # build signature in the corresponding build note. After verifying the
-              # signature, `provenance_bytes` can be unmarshalled and compared to the
-              # provenance to confirm that it is unchanged. A base64-encoded string
-              # representation of the provenance bytes is used for the signature in order
-              # to interoperate with openssl which expects this format for signature
-              # verification.
-              #
-              # The serialized form is captured both to avoid ambiguity in how the
-              # provenance is marshalled to json as well to prevent incompatibilities with
-              # future changes.
-          &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
-              # details about the build from source to completion.
-            &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
-            &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
-            &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
-            &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
-              &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
-                  # location.
-              &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
-                  # these locations, in the case where the source repository had multiple
-                  # remotes or submodules. This list will not include the context specified in
-                  # the context field.
-                { # A SourceContext is a reference to a tree of files. A SourceContext together
-                    # with a path point to a unique revision of a single file or directory.
-                  &quot;labels&quot;: { # Labels with user defined metadata.
-                    &quot;a_key&quot;: &quot;A String&quot;,
-                  },
-                  &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                      # repository (e.g., GitHub).
-                    &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-                    &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-                  },
-                  &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-                    &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-                    &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-                    &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                        # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                        # hostURI/project.
-                    &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                      &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                      &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-                    },
-                  },
-                  &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                      # Source Repo.
-                    &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-                    &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                      &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                          # winged-cargo-31) and a repo name within that project.
-                        &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                        &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-                      },
-                      &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-                    },
-                    &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                      &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                      &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-                    },
-                  },
-                },
-              ],
-              &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
-                  # source integrity was maintained in the build.
-                  #
-                  # The keys to this map are file paths used as build source and the values
-                  # contain the hash values for those files.
-                  #
-                  # If the build source came in a single package such as a gzipped tarfile
-                  # (.tar.gz), the FileHash will be for the single path to that file.
-                &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
-                    # messages to verify integrity of source input to the build.
-                  &quot;fileHash&quot;: [ # Required. Collection of file hashes.
-                    { # Container message for hash values.
-                      &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-                      &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-                    },
-                  ],
-                },
-              },
-              &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
-                  # with a path point to a unique revision of a single file or directory.
-                &quot;labels&quot;: { # Labels with user defined metadata.
-                  &quot;a_key&quot;: &quot;A String&quot;,
-                },
-                &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                    # repository (e.g., GitHub).
-                  &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-                  &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-                },
-                &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-                  &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-                  &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-                  &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                      # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                      # hostURI/project.
-                  &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                    &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                    &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-                  },
-                },
-                &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                    # Source Repo.
-                  &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-                  &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                    &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                        # winged-cargo-31) and a repo name within that project.
-                      &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                      &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-                    },
-                    &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-                  },
-                  &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                    &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                    &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-                  },
-                },
-              },
-            },
-            &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
-            &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
-            &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
-            &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
-                # user&#x27;s e-mail address at the time the build was initiated; this address may
-                # not represent the same end-user for all time.
-            &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
-            &quot;commands&quot;: [ # Commands requested by the build.
-              { # Command describes a step performed as part of the build pipeline.
-                &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
-                    # command.
-                &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
-                  &quot;A String&quot;,
-                ],
-                &quot;env&quot;: [ # Environment variables set before running this command.
-                  &quot;A String&quot;,
-                ],
-                &quot;args&quot;: [ # Command-line arguments used when executing this command.
-                  &quot;A String&quot;,
-                ],
-                &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
-                    # command is packaged as a Docker container, as presented to `docker pull`.
-                &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
-                    # this command as a dependency.
-              },
-            ],
-            &quot;builtArtifacts&quot;: [ # Output of the build.
-              { # Artifact describes a build product.
-                &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
-                    # container.
-                &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
-                    # like `gcr.io/projectID/imagename@sha256:123456`.
-                &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
-                    # the case of a container build, the name used to push the container image to
-                    # Google Container Registry, as presented to `docker push`. Note that a
-                    # single Artifact ID can have multiple names, for example if two tags are
-                    # applied to one image.
-                  &quot;A String&quot;,
-                ],
-              },
-            ],
-            &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
-            &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
-                # build providers can enter any desired additional details.
-              &quot;a_key&quot;: &quot;A String&quot;,
-            },
-          },
-        },
-        &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
-          &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
-            &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
-                # details to show to the user. The LocalizedMessage is output only and
-                # populated by the API.
-                # different programming environments, including REST APIs and RPC APIs. It is
-                # used by [gRPC](https://github.com/grpc). Each `Status` message contains
-                # three pieces of data: error code, error message, and error details.
-                #
-                # You can find out more about this error model and how to work with it in the
-                # [API Design Guide](https://cloud.google.com/apis/design/errors).
-              &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
-                  # message types for APIs to use.
-                {
-                  &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
-                },
-              ],
-              &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
-              &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
-                  # user-facing error message should be localized and sent in the
-                  # google.rpc.Status.details field, or localized by the client.
-            },
-            &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
-            &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
-            &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
-                # Deprecated, do not use.
-          },
-        },
-        &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
-            # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
-            # used as a filter in list requests.
-        &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
-          &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
-            &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
-            &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
-            &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
-            &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
-            &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
-            &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
-            &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
-                # the deployable field with the same name.
-              &quot;A String&quot;,
-            ],
-          },
-        },
-        &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
-        &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
-        &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
         &quot;intoto&quot;: { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
             # signatures and the in-toto link itself. This is used for occurrences of a
             # Grafeas in-toto note.
-          &quot;signed&quot;: { # This corresponds to an in-toto link.
-            &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
-                # be empty if links are generated for operations that aren&#x27;t directly mapped
-                # to a specific command. Each term in the command is an independent string
-                # in the list. An example of a command in the in-toto metadata field is:
-                # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
-              &quot;A String&quot;,
-            ],
-            &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
-                # are not the actual result of the step.
-                # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
-              &quot;customValues&quot;: {
-                &quot;a_key&quot;: &quot;A String&quot;,
-              },
+          &quot;signatures&quot;: [
+            { # A signature object consists of the KeyID used and the signature itself.
+              &quot;sig&quot;: &quot;A String&quot;,
+              &quot;keyid&quot;: &quot;A String&quot;,
             },
+          ],
+          &quot;signed&quot;: { # This corresponds to an in-toto link.
             &quot;environment&quot;: { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
                 # environment. It is suggested for this field to contain information that
                 # details environment variables, filesystem information, and the present
@@ -3885,29 +3466,442 @@
                 &quot;resourceUri&quot;: &quot;A String&quot;,
               },
             ],
+            &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
+                # are not the actual result of the step.
+                # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
+              &quot;customValues&quot;: {
+                &quot;a_key&quot;: &quot;A String&quot;,
+              },
+            },
+            &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
+                # be empty if links are generated for operations that aren&#x27;t directly mapped
+                # to a specific command. Each term in the command is an independent string
+                # in the list. An example of a command in the in-toto metadata field is:
+                # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
+              &quot;A String&quot;,
+            ],
           },
-          &quot;signatures&quot;: [
-            { # A signature object consists of the KeyID used and the signature itself.
-              &quot;sig&quot;: &quot;A String&quot;,
-              &quot;keyid&quot;: &quot;A String&quot;,
+        },
+        &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
+          &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
+              #
+              # The hash of the resource content. For example, the Docker digest.
+            &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+            &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+          },
+          &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
+              # `https://gcr.io/project/image@sha256:foo` for a Docker image.
+          &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
+              #
+              # The name of the resource. For example, the name of a Docker image -
+              # &quot;Debian&quot;.
+        },
+        &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
+          &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
+              # attestation can be verified using the attached signature. If the verifier
+              # trusts the public key of the signer, then verifying the signature is
+              # sufficient to establish trust. In this circumstance, the authority to which
+              # this attestation is attached is primarily useful for look-up (how to find
+              # this attestation if you already know the authority and artifact to be
+              # verified) and intent (which authority was this attestation intended to sign
+              # for).
+            &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
+                # This attestation must define the `serialized_payload` that the `signatures`
+                # verify and any metadata necessary to interpret that plaintext.  The
+                # signatures should always be over the `serialized_payload` bytestring.
+              &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+                  # The verifier must ensure that the provided type is one that the verifier
+                  # supports, and that the attestation payload is a valid instantiation of that
+                  # type (for example by validating a JSON schema).
+              &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
+                  # should consider this attestation message verified if at least one
+                  # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
+                  # for more details on signature structure and verification.
+                { # Verifiers (e.g. Kritis implementations) MUST verify signatures
+                    # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
+                    # Typically this means that the verifier has been configured with a map from
+                    # `public_key_id` to public key material (and any required parameters, e.g.
+                    # signing algorithm).
+                    #
+                    # In particular, verification implementations MUST NOT treat the signature
+                    # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
+                    # DOES NOT validate or authenticate a public key; it only provides a mechanism
+                    # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
+                    # a trusted channel. Verification implementations MUST reject signatures in any
+                    # of the following circumstances:
+                    #   * The `public_key_id` is not recognized by the verifier.
+                    #   * The public key that `public_key_id` refers to does not verify the
+                    #     signature with respect to the payload.
+                    #
+                    # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
+                    # included with the serialized `signature` bytes). Verifiers MUST ignore any
+                    # &quot;attached&quot; payload and only verify signatures with respect to explicitly
+                    # provided payload (e.g. a `payload` field on the proto message that holds
+                    # this Signature, or the canonical serialization of the proto message that
+                    # holds this signature).
+                  &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
+                      #   * The `public_key_id` is required.
+                      #   * The `public_key_id` SHOULD be an RFC3986 conformant URI.
+                      #   * When possible, the `public_key_id` SHOULD be an immutable reference,
+                      #     such as a cryptographic digest.
+                      #
+                      # Examples of valid `public_key_id`s:
+                      #
+                      # OpenPGP V4 public key fingerprint:
+                      #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
+                      # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
+                      # details on this scheme.
+                      #
+                      # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
+                      # serialization):
+                      #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
+                      #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
+                  &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
+                      # The payload that this signature verifies MUST be unambiguously provided
+                      # with the Signature during verification. A wrapper message might provide
+                      # the payload explicitly. Alternatively, a message might have a canonical
+                      # serialization that can always be unambiguously computed to derive the
+                      # payload.
+                },
+              ],
+              &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
+                  # The encoding and semantic meaning of this payload must match what is set in
+                  # `content_type`.
+            },
+            &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
+                # supports `ATTACHED` signatures, where the payload that is signed is included
+                # alongside the signature itself in the same file.
+              &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
+                  # (GPG) or equivalent. Since this message only supports attached signatures,
+                  # the payload that was signed must be attached. While the signature format
+                  # supported is dependent on the verification implementation, currently only
+                  # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
+                  # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
+                  # --output=signature.gpg payload.json` will create the signature content
+                  # expected in this field in `signature.gpg` for the `payload.json`
+                  # attestation payload.
+              &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+                  # The verifier must ensure that the provided type is one that the verifier
+                  # supports, and that the attestation payload is a valid instantiation of that
+                  # type (for example by validating a JSON schema).
+              &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
+                  # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
+                  # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
+                  # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
+                  # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
+                  # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
+                  # In gpg, the full fingerprint can be retrieved from the `fpr` field
+                  # returned when calling --list-keys with --with-colons.  For example:
+                  # ```
+                  # gpg --with-colons --with-fingerprint --force-v4-certs \
+                  #     --list-keys attester@example.com
+                  # tru::1:1513631572:0:3:1:5
+                  # pub:...&lt;SNIP&gt;...
+                  # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
+                  # ```
+                  # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
+            },
+          },
+        },
+        &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
+          &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
+            &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
+            &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
+            &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
+                # the deployable field with the same name.
+              &quot;A String&quot;,
+            ],
+            &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
+            &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
+            &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
+            &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
+          },
+        },
+        &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
+            # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
+            # used as a filter in list requests.
+        &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
+          &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
+              # system.
+            &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
+            &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
+                # have been found.
+              { # An occurrence of a particular package installation found within a system&#x27;s
+                  # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
+                &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
+                &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
+                    # denoting the package manager version distributing a package.
+                &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
+                  &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                      # versions.
+                  &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+                  &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+                  &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                      # name.
+                },
+              },
+            ],
+          },
+        },
+        &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
+          &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
+          &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
+            { # Metadata for any related URL information.
+              &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
+              &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
             },
           ],
+          &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
+              # available, and note provider assigned severity when distro has not yet
+              # assigned a severity for this vulnerability.
+          &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
+          &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
+              # packages etc)
+          &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
+          &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
+              # scale of 0-10 where 0 indicates low severity and 10 indicates high
+              # severity.
+          &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
+              # within the associated resource.
+            { # This message wraps a location affected by a vulnerability and its
+                # associated fix (if one is available).
+              &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
+                &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+                &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                    # format. Examples include distro or storage location for vulnerable jar.
+                &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+                  &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                      # versions.
+                  &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+                  &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+                  &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                      # name.
+                },
+              },
+              &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
+                  # The severity (e.g., distro assigned severity) for this vulnerability.
+              &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
+                &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+                &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                    # format. Examples include distro or storage location for vulnerable jar.
+                &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+                  &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                      # versions.
+                  &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+                  &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+                  &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                      # name.
+                },
+              },
+            },
+          ],
+        },
+        &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
+          &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
+            &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
+                # Deprecated, do not use.
+            &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
+                # details to show to the user. The LocalizedMessage is output only and
+                # populated by the API.
+                # different programming environments, including REST APIs and RPC APIs. It is
+                # used by [gRPC](https://github.com/grpc). Each `Status` message contains
+                # three pieces of data: error code, error message, and error details.
+                #
+                # You can find out more about this error model and how to work with it in the
+                # [API Design Guide](https://cloud.google.com/apis/design/errors).
+              &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
+                  # user-facing error message should be localized and sent in the
+                  # google.rpc.Status.details field, or localized by the client.
+              &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+              &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
+                  # message types for APIs to use.
+                {
+                  &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+                },
+              ],
+            },
+            &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
+            &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
+          },
+        },
+        &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
+        &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
+          &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
+              # details about the build from source to completion.
+            &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
+            &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
+            &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
+            &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
+                # user&#x27;s e-mail address at the time the build was initiated; this address may
+                # not represent the same end-user for all time.
+            &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
+            &quot;builtArtifacts&quot;: [ # Output of the build.
+              { # Artifact describes a build product.
+                &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
+                    # the case of a container build, the name used to push the container image to
+                    # Google Container Registry, as presented to `docker push`. Note that a
+                    # single Artifact ID can have multiple names, for example if two tags are
+                    # applied to one image.
+                  &quot;A String&quot;,
+                ],
+                &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
+                    # like `gcr.io/projectID/imagename@sha256:123456`.
+                &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
+                    # container.
+              },
+            ],
+            &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
+                # build providers can enter any desired additional details.
+              &quot;a_key&quot;: &quot;A String&quot;,
+            },
+            &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
+            &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
+            &quot;commands&quot;: [ # Commands requested by the build.
+              { # Command describes a step performed as part of the build pipeline.
+                &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
+                  &quot;A String&quot;,
+                ],
+                &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
+                    # this command as a dependency.
+                &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
+                    # command.
+                &quot;args&quot;: [ # Command-line arguments used when executing this command.
+                  &quot;A String&quot;,
+                ],
+                &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
+                    # command is packaged as a Docker container, as presented to `docker pull`.
+                &quot;env&quot;: [ # Environment variables set before running this command.
+                  &quot;A String&quot;,
+                ],
+              },
+            ],
+            &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
+              &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
+                  # with a path point to a unique revision of a single file or directory.
+                &quot;labels&quot;: { # Labels with user defined metadata.
+                  &quot;a_key&quot;: &quot;A String&quot;,
+                },
+                &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+                  &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+                  &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+                  &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                      # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                      # hostURI/project.
+                  &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                    &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                    &quot;name&quot;: &quot;A String&quot;, # The alias name.
+                  },
+                },
+                &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                    # repository (e.g., GitHub).
+                  &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+                  &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+                },
+                &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                    # Source Repo.
+                  &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+                  &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                    &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+                    &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                        # winged-cargo-31) and a repo name within that project.
+                      &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                      &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+                    },
+                  },
+                  &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                    &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                    &quot;name&quot;: &quot;A String&quot;, # The alias name.
+                  },
+                },
+              },
+              &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
+                  # location.
+              &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
+                  # source integrity was maintained in the build.
+                  #
+                  # The keys to this map are file paths used as build source and the values
+                  # contain the hash values for those files.
+                  #
+                  # If the build source came in a single package such as a gzipped tarfile
+                  # (.tar.gz), the FileHash will be for the single path to that file.
+                &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
+                    # messages to verify integrity of source input to the build.
+                  &quot;fileHash&quot;: [ # Required. Collection of file hashes.
+                    { # Container message for hash values.
+                      &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+                      &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+                    },
+                  ],
+                },
+              },
+              &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
+                  # these locations, in the case where the source repository had multiple
+                  # remotes or submodules. This list will not include the context specified in
+                  # the context field.
+                { # A SourceContext is a reference to a tree of files. A SourceContext together
+                    # with a path point to a unique revision of a single file or directory.
+                  &quot;labels&quot;: { # Labels with user defined metadata.
+                    &quot;a_key&quot;: &quot;A String&quot;,
+                  },
+                  &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+                    &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+                    &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+                    &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                        # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                        # hostURI/project.
+                    &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                      &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                      &quot;name&quot;: &quot;A String&quot;, # The alias name.
+                    },
+                  },
+                  &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                      # repository (e.g., GitHub).
+                    &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+                    &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+                  },
+                  &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                      # Source Repo.
+                    &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+                    &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                      &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+                      &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                          # winged-cargo-31) and a repo name within that project.
+                        &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                        &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+                      },
+                    },
+                    &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                      &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                      &quot;name&quot;: &quot;A String&quot;, # The alias name.
+                    },
+                  },
+                },
+              ],
+            },
+            &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
+            &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
+          },
+          &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
+              # build signature in the corresponding build note. After verifying the
+              # signature, `provenance_bytes` can be unmarshalled and compared to the
+              # provenance to confirm that it is unchanged. A base64-encoded string
+              # representation of the provenance bytes is used for the signature in order
+              # to interoperate with openssl which expects this format for signature
+              # verification.
+              #
+              # The serialized form is captured both to avoid ambiguity in how the
+              # provenance is marshalled to json as well to prevent incompatibilities with
+              # future changes.
         },
         &quot;derivedImage&quot;: { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
             # note.
           &quot;derivedImage&quot;: { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
               # relationship. This image would be produced from a Dockerfile with FROM
               # &lt;DockerImage.Basis in attached Note&gt;.
-            &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
-              &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
-                &quot;A String&quot;,
-              ],
-              &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
-                  # representation.
-              &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
-                  #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
-                  # Only the name of the final blob is kept.
-            },
+            &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
+                # occurrence.
+            &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
+                # associated image basis.
             &quot;layerInfo&quot;: [ # This contains layer-specific metadata, if populated it has length
                 # &quot;distance&quot; and is ordered with [distance] being the layer immediately
                 # following the base image and [1] being the final layer.
@@ -3916,17 +3910,23 @@
                 &quot;arguments&quot;: &quot;A String&quot;, # The recovered arguments to the Dockerfile directive.
               },
             ],
-            &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
-                # associated image basis.
-            &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
-                # occurrence.
+            &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
+              &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
+                  # representation.
+              &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
+                &quot;A String&quot;,
+              ],
+              &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
+                  #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
+                  # Only the name of the final blob is kept.
+            },
           },
         },
+        &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
+            # specified. This field can be used as a filter in list requests.
+        &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
       },
     ],
-    &quot;nextPageToken&quot;: &quot;A String&quot;, # The next pagination token in the list response. It should be used as
-        # `page_token` for the following request. An empty value means no more
-        # results.
   }</pre>
 </div>
 
@@ -3955,441 +3955,19 @@
     The object takes the form of:
 
 { # An instance of an analysis type that has been found on a resource.
-  &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
-      # specified. This field can be used as a filter in list requests.
-  &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
-    &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
-        #
-        # The name of the resource. For example, the name of a Docker image -
-        # &quot;Debian&quot;.
-    &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
-        #
-        # The hash of the resource content. For example, the Docker digest.
-      &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-      &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-    },
-    &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
-        # `https://gcr.io/project/image@sha256:foo` for a Docker image.
-  },
-  &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
-    &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
-        # attestation can be verified using the attached signature. If the verifier
-        # trusts the public key of the signer, then verifying the signature is
-        # sufficient to establish trust. In this circumstance, the authority to which
-        # this attestation is attached is primarily useful for look-up (how to find
-        # this attestation if you already know the authority and artifact to be
-        # verified) and intent (which authority was this attestation intended to sign
-        # for).
-      &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
-          # supports `ATTACHED` signatures, where the payload that is signed is included
-          # alongside the signature itself in the same file.
-        &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-            # The verifier must ensure that the provided type is one that the verifier
-            # supports, and that the attestation payload is a valid instantiation of that
-            # type (for example by validating a JSON schema).
-        &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
-            # (GPG) or equivalent. Since this message only supports attached signatures,
-            # the payload that was signed must be attached. While the signature format
-            # supported is dependent on the verification implementation, currently only
-            # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
-            # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
-            # --output=signature.gpg payload.json` will create the signature content
-            # expected in this field in `signature.gpg` for the `payload.json`
-            # attestation payload.
-        &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
-            # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
-            # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
-            # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
-            # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
-            # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
-            # In gpg, the full fingerprint can be retrieved from the `fpr` field
-            # returned when calling --list-keys with --with-colons.  For example:
-            # ```
-            # gpg --with-colons --with-fingerprint --force-v4-certs \
-            #     --list-keys attester@example.com
-            # tru::1:1513631572:0:3:1:5
-            # pub:...&lt;SNIP&gt;...
-            # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
-            # ```
-            # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
-      },
-      &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
-          # This attestation must define the `serialized_payload` that the `signatures`
-          # verify and any metadata necessary to interpret that plaintext.  The
-          # signatures should always be over the `serialized_payload` bytestring.
-        &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-            # The verifier must ensure that the provided type is one that the verifier
-            # supports, and that the attestation payload is a valid instantiation of that
-            # type (for example by validating a JSON schema).
-        &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
-            # should consider this attestation message verified if at least one
-            # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
-            # for more details on signature structure and verification.
-          { # Verifiers (e.g. Kritis implementations) MUST verify signatures
-              # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
-              # Typically this means that the verifier has been configured with a map from
-              # `public_key_id` to public key material (and any required parameters, e.g.
-              # signing algorithm).
-              #
-              # In particular, verification implementations MUST NOT treat the signature
-              # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
-              # DOES NOT validate or authenticate a public key; it only provides a mechanism
-              # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
-              # a trusted channel. Verification implementations MUST reject signatures in any
-              # of the following circumstances:
-              #   * The `public_key_id` is not recognized by the verifier.
-              #   * The public key that `public_key_id` refers to does not verify the
-              #     signature with respect to the payload.
-              #
-              # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
-              # included with the serialized `signature` bytes). Verifiers MUST ignore any
-              # &quot;attached&quot; payload and only verify signatures with respect to explicitly
-              # provided payload (e.g. a `payload` field on the proto message that holds
-              # this Signature, or the canonical serialization of the proto message that
-              # holds this signature).
-            &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
-                #   * The `public_key_id` is required.
-                #   * The `public_key_id` MUST be an RFC3986 conformant URI.
-                #   * When possible, the `public_key_id` SHOULD be an immutable reference,
-                #     such as a cryptographic digest.
-                #
-                # Examples of valid `public_key_id`s:
-                #
-                # OpenPGP V4 public key fingerprint:
-                #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
-                # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
-                # details on this scheme.
-                #
-                # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
-                # serialization):
-                #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
-                #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
-            &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
-                # The payload that this signature verifies MUST be unambiguously provided
-                # with the Signature during verification. A wrapper message might provide
-                # the payload explicitly. Alternatively, a message might have a canonical
-                # serialization that can always be unambiguously computed to derive the
-                # payload.
-          },
-        ],
-        &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
-            # The encoding and semantic meaning of this payload must match what is set in
-            # `content_type`.
-      },
-    },
-  },
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the occurrence in the form of
       # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
-  &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
-    &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
-    &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
-    &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
-        # available, and note provider assigned severity when distro has not yet
-        # assigned a severity for this vulnerability.
-    &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
-    &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
-        # scale of 0-10 where 0 indicates low severity and 10 indicates high
-        # severity.
-    &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
-      { # Metadata for any related URL information.
-        &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
-        &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
-      },
-    ],
-    &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
-        # packages etc)
-    &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
-        # within the associated resource.
-      { # This message wraps a location affected by a vulnerability and its
-          # associated fix (if one is available).
-        &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
-            # The severity (e.g., distro assigned severity) for this vulnerability.
-        &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
-          &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-          &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                # name.
-            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                # versions.
-            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-          },
-          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-              # format. Examples include distro or storage location for vulnerable jar.
-        },
-        &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
-          &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-          &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                # name.
-            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                # versions.
-            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-          },
-          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-              # format. Examples include distro or storage location for vulnerable jar.
-        },
-      },
-    ],
-  },
-  &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
-    &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
-        # system.
-      &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
-          # have been found.
-        { # An occurrence of a particular package installation found within a system&#x27;s
-            # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
-          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
-              # denoting the package manager version distributing a package.
-          &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
-            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                # name.
-            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                # versions.
-            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-          },
-          &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
-        },
-      ],
-      &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
-    },
-  },
-  &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
-    &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
-        # build signature in the corresponding build note. After verifying the
-        # signature, `provenance_bytes` can be unmarshalled and compared to the
-        # provenance to confirm that it is unchanged. A base64-encoded string
-        # representation of the provenance bytes is used for the signature in order
-        # to interoperate with openssl which expects this format for signature
-        # verification.
-        #
-        # The serialized form is captured both to avoid ambiguity in how the
-        # provenance is marshalled to json as well to prevent incompatibilities with
-        # future changes.
-    &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
-        # details about the build from source to completion.
-      &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
-      &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
-      &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
-      &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
-        &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
-            # location.
-        &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
-            # these locations, in the case where the source repository had multiple
-            # remotes or submodules. This list will not include the context specified in
-            # the context field.
-          { # A SourceContext is a reference to a tree of files. A SourceContext together
-              # with a path point to a unique revision of a single file or directory.
-            &quot;labels&quot;: { # Labels with user defined metadata.
-              &quot;a_key&quot;: &quot;A String&quot;,
-            },
-            &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                # repository (e.g., GitHub).
-              &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-              &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-            },
-            &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-              &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-              &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-              &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                  # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                  # hostURI/project.
-              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-              },
-            },
-            &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                # Source Repo.
-              &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-              &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                    # winged-cargo-31) and a repo name within that project.
-                  &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                  &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-                },
-                &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-              },
-              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-              },
-            },
-          },
-        ],
-        &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
-            # source integrity was maintained in the build.
-            #
-            # The keys to this map are file paths used as build source and the values
-            # contain the hash values for those files.
-            #
-            # If the build source came in a single package such as a gzipped tarfile
-            # (.tar.gz), the FileHash will be for the single path to that file.
-          &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
-              # messages to verify integrity of source input to the build.
-            &quot;fileHash&quot;: [ # Required. Collection of file hashes.
-              { # Container message for hash values.
-                &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-                &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-              },
-            ],
-          },
-        },
-        &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
-            # with a path point to a unique revision of a single file or directory.
-          &quot;labels&quot;: { # Labels with user defined metadata.
-            &quot;a_key&quot;: &quot;A String&quot;,
-          },
-          &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-              # repository (e.g., GitHub).
-            &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-            &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-          },
-          &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-            &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-            &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-            &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                # hostURI/project.
-            &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-              &quot;name&quot;: &quot;A String&quot;, # The alias name.
-              &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-            },
-          },
-          &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-              # Source Repo.
-            &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-            &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-              &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                  # winged-cargo-31) and a repo name within that project.
-                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-              },
-              &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-            },
-            &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-              &quot;name&quot;: &quot;A String&quot;, # The alias name.
-              &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-            },
-          },
-        },
-      },
-      &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
-      &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
-      &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
-      &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
-          # user&#x27;s e-mail address at the time the build was initiated; this address may
-          # not represent the same end-user for all time.
-      &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
-      &quot;commands&quot;: [ # Commands requested by the build.
-        { # Command describes a step performed as part of the build pipeline.
-          &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
-              # command.
-          &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
-            &quot;A String&quot;,
-          ],
-          &quot;env&quot;: [ # Environment variables set before running this command.
-            &quot;A String&quot;,
-          ],
-          &quot;args&quot;: [ # Command-line arguments used when executing this command.
-            &quot;A String&quot;,
-          ],
-          &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
-              # command is packaged as a Docker container, as presented to `docker pull`.
-          &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
-              # this command as a dependency.
-        },
-      ],
-      &quot;builtArtifacts&quot;: [ # Output of the build.
-        { # Artifact describes a build product.
-          &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
-              # container.
-          &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
-              # like `gcr.io/projectID/imagename@sha256:123456`.
-          &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
-              # the case of a container build, the name used to push the container image to
-              # Google Container Registry, as presented to `docker push`. Note that a
-              # single Artifact ID can have multiple names, for example if two tags are
-              # applied to one image.
-            &quot;A String&quot;,
-          ],
-        },
-      ],
-      &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
-      &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
-          # build providers can enter any desired additional details.
-        &quot;a_key&quot;: &quot;A String&quot;,
-      },
-    },
-  },
-  &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
-    &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
-      &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
-          # details to show to the user. The LocalizedMessage is output only and
-          # populated by the API.
-          # different programming environments, including REST APIs and RPC APIs. It is
-          # used by [gRPC](https://github.com/grpc). Each `Status` message contains
-          # three pieces of data: error code, error message, and error details.
-          #
-          # You can find out more about this error model and how to work with it in the
-          # [API Design Guide](https://cloud.google.com/apis/design/errors).
-        &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
-            # message types for APIs to use.
-          {
-            &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
-          },
-        ],
-        &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
-        &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
-            # user-facing error message should be localized and sent in the
-            # google.rpc.Status.details field, or localized by the client.
-      },
-      &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
-      &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
-      &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
-          # Deprecated, do not use.
-    },
-  },
-  &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
-      # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
-      # used as a filter in list requests.
-  &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
-    &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
-      &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
-      &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
-      &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
-      &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
-      &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
-      &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
-      &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
-          # the deployable field with the same name.
-        &quot;A String&quot;,
-      ],
-    },
-  },
-  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
-  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
-  &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
   &quot;intoto&quot;: { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
       # signatures and the in-toto link itself. This is used for occurrences of a
       # Grafeas in-toto note.
-    &quot;signed&quot;: { # This corresponds to an in-toto link.
-      &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
-          # be empty if links are generated for operations that aren&#x27;t directly mapped
-          # to a specific command. Each term in the command is an independent string
-          # in the list. An example of a command in the in-toto metadata field is:
-          # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
-        &quot;A String&quot;,
-      ],
-      &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
-          # are not the actual result of the step.
-          # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
-        &quot;customValues&quot;: {
-          &quot;a_key&quot;: &quot;A String&quot;,
-        },
+    &quot;signatures&quot;: [
+      { # A signature object consists of the KeyID used and the signature itself.
+        &quot;sig&quot;: &quot;A String&quot;,
+        &quot;keyid&quot;: &quot;A String&quot;,
       },
+    ],
+    &quot;signed&quot;: { # This corresponds to an in-toto link.
       &quot;environment&quot;: { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
           # environment. It is suggested for this field to contain information that
           # details environment variables, filesystem information, and the present
@@ -4435,29 +4013,442 @@
           &quot;resourceUri&quot;: &quot;A String&quot;,
         },
       ],
+      &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
+          # are not the actual result of the step.
+          # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
+        &quot;customValues&quot;: {
+          &quot;a_key&quot;: &quot;A String&quot;,
+        },
+      },
+      &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
+          # be empty if links are generated for operations that aren&#x27;t directly mapped
+          # to a specific command. Each term in the command is an independent string
+          # in the list. An example of a command in the in-toto metadata field is:
+          # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
+        &quot;A String&quot;,
+      ],
     },
-    &quot;signatures&quot;: [
-      { # A signature object consists of the KeyID used and the signature itself.
-        &quot;sig&quot;: &quot;A String&quot;,
-        &quot;keyid&quot;: &quot;A String&quot;,
+  },
+  &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
+    &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
+        #
+        # The hash of the resource content. For example, the Docker digest.
+      &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+      &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+    },
+    &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
+        # `https://gcr.io/project/image@sha256:foo` for a Docker image.
+    &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
+        #
+        # The name of the resource. For example, the name of a Docker image -
+        # &quot;Debian&quot;.
+  },
+  &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
+    &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
+        # attestation can be verified using the attached signature. If the verifier
+        # trusts the public key of the signer, then verifying the signature is
+        # sufficient to establish trust. In this circumstance, the authority to which
+        # this attestation is attached is primarily useful for look-up (how to find
+        # this attestation if you already know the authority and artifact to be
+        # verified) and intent (which authority was this attestation intended to sign
+        # for).
+      &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
+          # This attestation must define the `serialized_payload` that the `signatures`
+          # verify and any metadata necessary to interpret that plaintext.  The
+          # signatures should always be over the `serialized_payload` bytestring.
+        &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+            # The verifier must ensure that the provided type is one that the verifier
+            # supports, and that the attestation payload is a valid instantiation of that
+            # type (for example by validating a JSON schema).
+        &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
+            # should consider this attestation message verified if at least one
+            # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
+            # for more details on signature structure and verification.
+          { # Verifiers (e.g. Kritis implementations) MUST verify signatures
+              # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
+              # Typically this means that the verifier has been configured with a map from
+              # `public_key_id` to public key material (and any required parameters, e.g.
+              # signing algorithm).
+              #
+              # In particular, verification implementations MUST NOT treat the signature
+              # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
+              # DOES NOT validate or authenticate a public key; it only provides a mechanism
+              # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
+              # a trusted channel. Verification implementations MUST reject signatures in any
+              # of the following circumstances:
+              #   * The `public_key_id` is not recognized by the verifier.
+              #   * The public key that `public_key_id` refers to does not verify the
+              #     signature with respect to the payload.
+              #
+              # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
+              # included with the serialized `signature` bytes). Verifiers MUST ignore any
+              # &quot;attached&quot; payload and only verify signatures with respect to explicitly
+              # provided payload (e.g. a `payload` field on the proto message that holds
+              # this Signature, or the canonical serialization of the proto message that
+              # holds this signature).
+            &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
+                #   * The `public_key_id` is required.
+                #   * The `public_key_id` SHOULD be an RFC3986 conformant URI.
+                #   * When possible, the `public_key_id` SHOULD be an immutable reference,
+                #     such as a cryptographic digest.
+                #
+                # Examples of valid `public_key_id`s:
+                #
+                # OpenPGP V4 public key fingerprint:
+                #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
+                # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
+                # details on this scheme.
+                #
+                # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
+                # serialization):
+                #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
+                #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
+            &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
+                # The payload that this signature verifies MUST be unambiguously provided
+                # with the Signature during verification. A wrapper message might provide
+                # the payload explicitly. Alternatively, a message might have a canonical
+                # serialization that can always be unambiguously computed to derive the
+                # payload.
+          },
+        ],
+        &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
+            # The encoding and semantic meaning of this payload must match what is set in
+            # `content_type`.
+      },
+      &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
+          # supports `ATTACHED` signatures, where the payload that is signed is included
+          # alongside the signature itself in the same file.
+        &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
+            # (GPG) or equivalent. Since this message only supports attached signatures,
+            # the payload that was signed must be attached. While the signature format
+            # supported is dependent on the verification implementation, currently only
+            # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
+            # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
+            # --output=signature.gpg payload.json` will create the signature content
+            # expected in this field in `signature.gpg` for the `payload.json`
+            # attestation payload.
+        &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+            # The verifier must ensure that the provided type is one that the verifier
+            # supports, and that the attestation payload is a valid instantiation of that
+            # type (for example by validating a JSON schema).
+        &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
+            # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
+            # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
+            # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
+            # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
+            # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
+            # In gpg, the full fingerprint can be retrieved from the `fpr` field
+            # returned when calling --list-keys with --with-colons.  For example:
+            # ```
+            # gpg --with-colons --with-fingerprint --force-v4-certs \
+            #     --list-keys attester@example.com
+            # tru::1:1513631572:0:3:1:5
+            # pub:...&lt;SNIP&gt;...
+            # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
+            # ```
+            # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
+      },
+    },
+  },
+  &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
+    &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
+      &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
+      &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
+      &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
+          # the deployable field with the same name.
+        &quot;A String&quot;,
+      ],
+      &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
+      &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
+      &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
+      &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
+    },
+  },
+  &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
+      # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
+      # used as a filter in list requests.
+  &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
+    &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
+        # system.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
+      &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
+          # have been found.
+        { # An occurrence of a particular package installation found within a system&#x27;s
+            # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
+          &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
+          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
+              # denoting the package manager version distributing a package.
+          &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
+            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                # versions.
+            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                # name.
+          },
+        },
+      ],
+    },
+  },
+  &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
+    &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
+    &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
+      { # Metadata for any related URL information.
+        &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
+        &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
       },
     ],
+    &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
+        # available, and note provider assigned severity when distro has not yet
+        # assigned a severity for this vulnerability.
+    &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
+    &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
+        # packages etc)
+    &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
+    &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
+        # scale of 0-10 where 0 indicates low severity and 10 indicates high
+        # severity.
+    &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
+        # within the associated resource.
+      { # This message wraps a location affected by a vulnerability and its
+          # associated fix (if one is available).
+        &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
+          &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+              # format. Examples include distro or storage location for vulnerable jar.
+          &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                # versions.
+            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                # name.
+          },
+        },
+        &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
+            # The severity (e.g., distro assigned severity) for this vulnerability.
+        &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
+          &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+          &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+              # format. Examples include distro or storage location for vulnerable jar.
+          &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+            &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                # versions.
+            &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+            &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+            &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                # name.
+          },
+        },
+      },
+    ],
+  },
+  &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
+    &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
+      &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
+          # Deprecated, do not use.
+      &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
+          # details to show to the user. The LocalizedMessage is output only and
+          # populated by the API.
+          # different programming environments, including REST APIs and RPC APIs. It is
+          # used by [gRPC](https://github.com/grpc). Each `Status` message contains
+          # three pieces of data: error code, error message, and error details.
+          #
+          # You can find out more about this error model and how to work with it in the
+          # [API Design Guide](https://cloud.google.com/apis/design/errors).
+        &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
+            # user-facing error message should be localized and sent in the
+            # google.rpc.Status.details field, or localized by the client.
+        &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+        &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
+            # message types for APIs to use.
+          {
+            &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+          },
+        ],
+      },
+      &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
+      &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
+    },
+  },
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
+  &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
+    &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
+        # details about the build from source to completion.
+      &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
+      &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
+      &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
+      &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
+          # user&#x27;s e-mail address at the time the build was initiated; this address may
+          # not represent the same end-user for all time.
+      &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
+      &quot;builtArtifacts&quot;: [ # Output of the build.
+        { # Artifact describes a build product.
+          &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
+              # the case of a container build, the name used to push the container image to
+              # Google Container Registry, as presented to `docker push`. Note that a
+              # single Artifact ID can have multiple names, for example if two tags are
+              # applied to one image.
+            &quot;A String&quot;,
+          ],
+          &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
+              # like `gcr.io/projectID/imagename@sha256:123456`.
+          &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
+              # container.
+        },
+      ],
+      &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
+          # build providers can enter any desired additional details.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
+      &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
+      &quot;commands&quot;: [ # Commands requested by the build.
+        { # Command describes a step performed as part of the build pipeline.
+          &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
+            &quot;A String&quot;,
+          ],
+          &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
+              # this command as a dependency.
+          &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
+              # command.
+          &quot;args&quot;: [ # Command-line arguments used when executing this command.
+            &quot;A String&quot;,
+          ],
+          &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
+              # command is packaged as a Docker container, as presented to `docker pull`.
+          &quot;env&quot;: [ # Environment variables set before running this command.
+            &quot;A String&quot;,
+          ],
+        },
+      ],
+      &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
+        &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
+            # with a path point to a unique revision of a single file or directory.
+          &quot;labels&quot;: { # Labels with user defined metadata.
+            &quot;a_key&quot;: &quot;A String&quot;,
+          },
+          &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+            &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+            &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+            &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                # hostURI/project.
+            &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+              &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+              &quot;name&quot;: &quot;A String&quot;, # The alias name.
+            },
+          },
+          &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+              # repository (e.g., GitHub).
+            &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+            &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+          },
+          &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+              # Source Repo.
+            &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+            &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+              &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+              &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                  # winged-cargo-31) and a repo name within that project.
+                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+              },
+            },
+            &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+              &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+              &quot;name&quot;: &quot;A String&quot;, # The alias name.
+            },
+          },
+        },
+        &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
+            # location.
+        &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
+            # source integrity was maintained in the build.
+            #
+            # The keys to this map are file paths used as build source and the values
+            # contain the hash values for those files.
+            #
+            # If the build source came in a single package such as a gzipped tarfile
+            # (.tar.gz), the FileHash will be for the single path to that file.
+          &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
+              # messages to verify integrity of source input to the build.
+            &quot;fileHash&quot;: [ # Required. Collection of file hashes.
+              { # Container message for hash values.
+                &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+                &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+              },
+            ],
+          },
+        },
+        &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
+            # these locations, in the case where the source repository had multiple
+            # remotes or submodules. This list will not include the context specified in
+            # the context field.
+          { # A SourceContext is a reference to a tree of files. A SourceContext together
+              # with a path point to a unique revision of a single file or directory.
+            &quot;labels&quot;: { # Labels with user defined metadata.
+              &quot;a_key&quot;: &quot;A String&quot;,
+            },
+            &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+              &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+              &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+              &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                  # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                  # hostURI/project.
+              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                &quot;name&quot;: &quot;A String&quot;, # The alias name.
+              },
+            },
+            &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                # repository (e.g., GitHub).
+              &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+              &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+            },
+            &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                # Source Repo.
+              &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+              &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+                &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                    # winged-cargo-31) and a repo name within that project.
+                  &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                  &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+                },
+              },
+              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                &quot;name&quot;: &quot;A String&quot;, # The alias name.
+              },
+            },
+          },
+        ],
+      },
+      &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
+      &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
+    },
+    &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
+        # build signature in the corresponding build note. After verifying the
+        # signature, `provenance_bytes` can be unmarshalled and compared to the
+        # provenance to confirm that it is unchanged. A base64-encoded string
+        # representation of the provenance bytes is used for the signature in order
+        # to interoperate with openssl which expects this format for signature
+        # verification.
+        #
+        # The serialized form is captured both to avoid ambiguity in how the
+        # provenance is marshalled to json as well to prevent incompatibilities with
+        # future changes.
   },
   &quot;derivedImage&quot;: { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
       # note.
     &quot;derivedImage&quot;: { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
         # relationship. This image would be produced from a Dockerfile with FROM
         # &lt;DockerImage.Basis in attached Note&gt;.
-      &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
-        &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
-          &quot;A String&quot;,
-        ],
-        &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
-            # representation.
-        &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
-            #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
-            # Only the name of the final blob is kept.
-      },
+      &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
+          # occurrence.
+      &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
+          # associated image basis.
       &quot;layerInfo&quot;: [ # This contains layer-specific metadata, if populated it has length
           # &quot;distance&quot; and is ordered with [distance] being the layer immediately
           # following the base image and [1] being the final layer.
@@ -4466,12 +4457,21 @@
           &quot;arguments&quot;: &quot;A String&quot;, # The recovered arguments to the Dockerfile directive.
         },
       ],
-      &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
-          # associated image basis.
-      &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
-          # occurrence.
+      &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
+        &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
+            # representation.
+        &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
+          &quot;A String&quot;,
+        ],
+        &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
+            #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
+            # Only the name of the final blob is kept.
+      },
     },
   },
+  &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
+      # specified. This field can be used as a filter in list requests.
+  &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
 }
 
   updateMask: string, The fields to update.
@@ -4484,441 +4484,19 @@
   An object of the form:
 
     { # An instance of an analysis type that has been found on a resource.
-    &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
-        # specified. This field can be used as a filter in list requests.
-    &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
-      &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
-          #
-          # The name of the resource. For example, the name of a Docker image -
-          # &quot;Debian&quot;.
-      &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
-          #
-          # The hash of the resource content. For example, the Docker digest.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-        &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-      },
-      &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
-          # `https://gcr.io/project/image@sha256:foo` for a Docker image.
-    },
-    &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
-      &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
-          # attestation can be verified using the attached signature. If the verifier
-          # trusts the public key of the signer, then verifying the signature is
-          # sufficient to establish trust. In this circumstance, the authority to which
-          # this attestation is attached is primarily useful for look-up (how to find
-          # this attestation if you already know the authority and artifact to be
-          # verified) and intent (which authority was this attestation intended to sign
-          # for).
-        &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
-            # supports `ATTACHED` signatures, where the payload that is signed is included
-            # alongside the signature itself in the same file.
-          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-              # The verifier must ensure that the provided type is one that the verifier
-              # supports, and that the attestation payload is a valid instantiation of that
-              # type (for example by validating a JSON schema).
-          &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
-              # (GPG) or equivalent. Since this message only supports attached signatures,
-              # the payload that was signed must be attached. While the signature format
-              # supported is dependent on the verification implementation, currently only
-              # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
-              # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
-              # --output=signature.gpg payload.json` will create the signature content
-              # expected in this field in `signature.gpg` for the `payload.json`
-              # attestation payload.
-          &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
-              # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
-              # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
-              # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
-              # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
-              # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
-              # In gpg, the full fingerprint can be retrieved from the `fpr` field
-              # returned when calling --list-keys with --with-colons.  For example:
-              # ```
-              # gpg --with-colons --with-fingerprint --force-v4-certs \
-              #     --list-keys attester@example.com
-              # tru::1:1513631572:0:3:1:5
-              # pub:...&lt;SNIP&gt;...
-              # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
-              # ```
-              # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
-        },
-        &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
-            # This attestation must define the `serialized_payload` that the `signatures`
-            # verify and any metadata necessary to interpret that plaintext.  The
-            # signatures should always be over the `serialized_payload` bytestring.
-          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
-              # The verifier must ensure that the provided type is one that the verifier
-              # supports, and that the attestation payload is a valid instantiation of that
-              # type (for example by validating a JSON schema).
-          &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
-              # should consider this attestation message verified if at least one
-              # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
-              # for more details on signature structure and verification.
-            { # Verifiers (e.g. Kritis implementations) MUST verify signatures
-                # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
-                # Typically this means that the verifier has been configured with a map from
-                # `public_key_id` to public key material (and any required parameters, e.g.
-                # signing algorithm).
-                #
-                # In particular, verification implementations MUST NOT treat the signature
-                # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
-                # DOES NOT validate or authenticate a public key; it only provides a mechanism
-                # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
-                # a trusted channel. Verification implementations MUST reject signatures in any
-                # of the following circumstances:
-                #   * The `public_key_id` is not recognized by the verifier.
-                #   * The public key that `public_key_id` refers to does not verify the
-                #     signature with respect to the payload.
-                #
-                # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
-                # included with the serialized `signature` bytes). Verifiers MUST ignore any
-                # &quot;attached&quot; payload and only verify signatures with respect to explicitly
-                # provided payload (e.g. a `payload` field on the proto message that holds
-                # this Signature, or the canonical serialization of the proto message that
-                # holds this signature).
-              &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
-                  #   * The `public_key_id` is required.
-                  #   * The `public_key_id` MUST be an RFC3986 conformant URI.
-                  #   * When possible, the `public_key_id` SHOULD be an immutable reference,
-                  #     such as a cryptographic digest.
-                  #
-                  # Examples of valid `public_key_id`s:
-                  #
-                  # OpenPGP V4 public key fingerprint:
-                  #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
-                  # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
-                  # details on this scheme.
-                  #
-                  # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
-                  # serialization):
-                  #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
-                  #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
-              &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
-                  # The payload that this signature verifies MUST be unambiguously provided
-                  # with the Signature during verification. A wrapper message might provide
-                  # the payload explicitly. Alternatively, a message might have a canonical
-                  # serialization that can always be unambiguously computed to derive the
-                  # payload.
-            },
-          ],
-          &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
-              # The encoding and semantic meaning of this payload must match what is set in
-              # `content_type`.
-        },
-      },
-    },
+    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
     &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the occurrence in the form of
         # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
-    &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
-      &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
-      &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
-      &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
-          # available, and note provider assigned severity when distro has not yet
-          # assigned a severity for this vulnerability.
-      &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
-      &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
-          # scale of 0-10 where 0 indicates low severity and 10 indicates high
-          # severity.
-      &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
-        { # Metadata for any related URL information.
-          &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
-          &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
-        },
-      ],
-      &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
-          # packages etc)
-      &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
-          # within the associated resource.
-        { # This message wraps a location affected by a vulnerability and its
-            # associated fix (if one is available).
-          &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
-              # The severity (e.g., distro assigned severity) for this vulnerability.
-          &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
-            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                  # name.
-              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                  # versions.
-              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-            },
-            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                # format. Examples include distro or storage location for vulnerable jar.
-          },
-          &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
-            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
-            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
-              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                  # name.
-              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                  # versions.
-              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-            },
-            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
-                # format. Examples include distro or storage location for vulnerable jar.
-          },
-        },
-      ],
-    },
-    &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
-      &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
-          # system.
-        &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
-            # have been found.
-          { # An occurrence of a particular package installation found within a system&#x27;s
-              # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
-            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
-                # denoting the package manager version distributing a package.
-            &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
-              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
-              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
-                  # name.
-              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
-                  # versions.
-              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
-            },
-            &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
-          },
-        ],
-        &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
-      },
-    },
-    &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
-      &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
-          # build signature in the corresponding build note. After verifying the
-          # signature, `provenance_bytes` can be unmarshalled and compared to the
-          # provenance to confirm that it is unchanged. A base64-encoded string
-          # representation of the provenance bytes is used for the signature in order
-          # to interoperate with openssl which expects this format for signature
-          # verification.
-          #
-          # The serialized form is captured both to avoid ambiguity in how the
-          # provenance is marshalled to json as well to prevent incompatibilities with
-          # future changes.
-      &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
-          # details about the build from source to completion.
-        &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
-        &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
-        &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
-        &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
-          &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
-              # location.
-          &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
-              # these locations, in the case where the source repository had multiple
-              # remotes or submodules. This list will not include the context specified in
-              # the context field.
-            { # A SourceContext is a reference to a tree of files. A SourceContext together
-                # with a path point to a unique revision of a single file or directory.
-              &quot;labels&quot;: { # Labels with user defined metadata.
-                &quot;a_key&quot;: &quot;A String&quot;,
-              },
-              &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                  # repository (e.g., GitHub).
-                &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-                &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-              },
-              &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-                &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-                &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-                &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                    # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                    # hostURI/project.
-                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-                },
-              },
-              &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                  # Source Repo.
-                &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-                &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                  &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                      # winged-cargo-31) and a repo name within that project.
-                    &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                    &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-                  },
-                  &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-                },
-                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-                },
-              },
-            },
-          ],
-          &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
-              # source integrity was maintained in the build.
-              #
-              # The keys to this map are file paths used as build source and the values
-              # contain the hash values for those files.
-              #
-              # If the build source came in a single package such as a gzipped tarfile
-              # (.tar.gz), the FileHash will be for the single path to that file.
-            &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
-                # messages to verify integrity of source input to the build.
-              &quot;fileHash&quot;: [ # Required. Collection of file hashes.
-                { # Container message for hash values.
-                  &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
-                  &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
-                },
-              ],
-            },
-          },
-          &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
-              # with a path point to a unique revision of a single file or directory.
-            &quot;labels&quot;: { # Labels with user defined metadata.
-              &quot;a_key&quot;: &quot;A String&quot;,
-            },
-            &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
-                # repository (e.g., GitHub).
-              &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
-              &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
-            },
-            &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
-              &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
-              &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
-              &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
-                  # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
-                  # hostURI/project.
-              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-              },
-            },
-            &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
-                # Source Repo.
-              &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
-              &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
-                &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
-                    # winged-cargo-31) and a repo name within that project.
-                  &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
-                  &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
-                },
-                &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
-              },
-              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
-                &quot;name&quot;: &quot;A String&quot;, # The alias name.
-                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
-              },
-            },
-          },
-        },
-        &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
-        &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
-        &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
-        &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
-            # user&#x27;s e-mail address at the time the build was initiated; this address may
-            # not represent the same end-user for all time.
-        &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
-        &quot;commands&quot;: [ # Commands requested by the build.
-          { # Command describes a step performed as part of the build pipeline.
-            &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
-                # command.
-            &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
-              &quot;A String&quot;,
-            ],
-            &quot;env&quot;: [ # Environment variables set before running this command.
-              &quot;A String&quot;,
-            ],
-            &quot;args&quot;: [ # Command-line arguments used when executing this command.
-              &quot;A String&quot;,
-            ],
-            &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
-                # command is packaged as a Docker container, as presented to `docker pull`.
-            &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
-                # this command as a dependency.
-          },
-        ],
-        &quot;builtArtifacts&quot;: [ # Output of the build.
-          { # Artifact describes a build product.
-            &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
-                # container.
-            &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
-                # like `gcr.io/projectID/imagename@sha256:123456`.
-            &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
-                # the case of a container build, the name used to push the container image to
-                # Google Container Registry, as presented to `docker push`. Note that a
-                # single Artifact ID can have multiple names, for example if two tags are
-                # applied to one image.
-              &quot;A String&quot;,
-            ],
-          },
-        ],
-        &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
-        &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
-            # build providers can enter any desired additional details.
-          &quot;a_key&quot;: &quot;A String&quot;,
-        },
-      },
-    },
-    &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
-      &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
-        &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
-            # details to show to the user. The LocalizedMessage is output only and
-            # populated by the API.
-            # different programming environments, including REST APIs and RPC APIs. It is
-            # used by [gRPC](https://github.com/grpc). Each `Status` message contains
-            # three pieces of data: error code, error message, and error details.
-            #
-            # You can find out more about this error model and how to work with it in the
-            # [API Design Guide](https://cloud.google.com/apis/design/errors).
-          &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
-              # message types for APIs to use.
-            {
-              &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
-            },
-          ],
-          &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
-          &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
-              # user-facing error message should be localized and sent in the
-              # google.rpc.Status.details field, or localized by the client.
-        },
-        &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
-        &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
-        &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
-            # Deprecated, do not use.
-      },
-    },
-    &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
-        # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
-        # used as a filter in list requests.
-    &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
-      &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
-        &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
-        &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
-        &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
-        &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
-        &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
-        &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
-        &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
-            # the deployable field with the same name.
-          &quot;A String&quot;,
-        ],
-      },
-    },
-    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was created.
-    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
-    &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
     &quot;intoto&quot;: { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
         # signatures and the in-toto link itself. This is used for occurrences of a
         # Grafeas in-toto note.
-      &quot;signed&quot;: { # This corresponds to an in-toto link.
-        &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
-            # be empty if links are generated for operations that aren&#x27;t directly mapped
-            # to a specific command. Each term in the command is an independent string
-            # in the list. An example of a command in the in-toto metadata field is:
-            # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
-          &quot;A String&quot;,
-        ],
-        &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
-            # are not the actual result of the step.
-            # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
-          &quot;customValues&quot;: {
-            &quot;a_key&quot;: &quot;A String&quot;,
-          },
+      &quot;signatures&quot;: [
+        { # A signature object consists of the KeyID used and the signature itself.
+          &quot;sig&quot;: &quot;A String&quot;,
+          &quot;keyid&quot;: &quot;A String&quot;,
         },
+      ],
+      &quot;signed&quot;: { # This corresponds to an in-toto link.
         &quot;environment&quot;: { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
             # environment. It is suggested for this field to contain information that
             # details environment variables, filesystem information, and the present
@@ -4964,29 +4542,442 @@
             &quot;resourceUri&quot;: &quot;A String&quot;,
           },
         ],
+        &quot;byproducts&quot;: { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
+            # are not the actual result of the step.
+            # fields are &quot;stderr&quot;, &quot;stdout&quot;, and &quot;return-value&quot;.
+          &quot;customValues&quot;: {
+            &quot;a_key&quot;: &quot;A String&quot;,
+          },
+        },
+        &quot;command&quot;: [ # This field contains the full command executed for the step. This can also
+            # be empty if links are generated for operations that aren&#x27;t directly mapped
+            # to a specific command. Each term in the command is an independent string
+            # in the list. An example of a command in the in-toto metadata field is:
+            # &quot;command&quot;: [&quot;git&quot;, &quot;clone&quot;, &quot;https://github.com/in-toto/demo-project.git&quot;]
+          &quot;A String&quot;,
+        ],
       },
-      &quot;signatures&quot;: [
-        { # A signature object consists of the KeyID used and the signature itself.
-          &quot;sig&quot;: &quot;A String&quot;,
-          &quot;keyid&quot;: &quot;A String&quot;,
+    },
+    &quot;resource&quot;: { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
+      &quot;contentHash&quot;: { # Container message for hash values. # Deprecated, do not use. Use uri instead.
+          #
+          # The hash of the resource content. For example, the Docker digest.
+        &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+        &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+      },
+      &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example,
+          # `https://gcr.io/project/image@sha256:foo` for a Docker image.
+      &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead.
+          #
+          # The name of the resource. For example, the name of a Docker image -
+          # &quot;Debian&quot;.
+    },
+    &quot;attestation&quot;: { # Details of an attestation occurrence. # Describes an attestation of an artifact.
+      &quot;attestation&quot;: { # Occurrence that represents a single &quot;attestation&quot;. The authenticity of an # Required. Attestation for the resource.
+          # attestation can be verified using the attached signature. If the verifier
+          # trusts the public key of the signer, then verifying the signature is
+          # sufficient to establish trust. In this circumstance, the authority to which
+          # this attestation is attached is primarily useful for look-up (how to find
+          # this attestation if you already know the authority and artifact to be
+          # verified) and intent (which authority was this attestation intended to sign
+          # for).
+        &quot;genericSignedAttestation&quot;: { # An attestation wrapper that uses the Grafeas `Signature` message.
+            # This attestation must define the `serialized_payload` that the `signatures`
+            # verify and any metadata necessary to interpret that plaintext.  The
+            # signatures should always be over the `serialized_payload` bytestring.
+          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+              # The verifier must ensure that the provided type is one that the verifier
+              # supports, and that the attestation payload is a valid instantiation of that
+              # type (for example by validating a JSON schema).
+          &quot;signatures&quot;: [ # One or more signatures over `serialized_payload`.  Verifier implementations
+              # should consider this attestation message verified if at least one
+              # `signature` verifies `serialized_payload`.  See `Signature` in common.proto
+              # for more details on signature structure and verification.
+            { # Verifiers (e.g. Kritis implementations) MUST verify signatures
+                # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
+                # Typically this means that the verifier has been configured with a map from
+                # `public_key_id` to public key material (and any required parameters, e.g.
+                # signing algorithm).
+                #
+                # In particular, verification implementations MUST NOT treat the signature
+                # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
+                # DOES NOT validate or authenticate a public key; it only provides a mechanism
+                # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
+                # a trusted channel. Verification implementations MUST reject signatures in any
+                # of the following circumstances:
+                #   * The `public_key_id` is not recognized by the verifier.
+                #   * The public key that `public_key_id` refers to does not verify the
+                #     signature with respect to the payload.
+                #
+                # The `signature` contents SHOULD NOT be &quot;attached&quot; (where the payload is
+                # included with the serialized `signature` bytes). Verifiers MUST ignore any
+                # &quot;attached&quot; payload and only verify signatures with respect to explicitly
+                # provided payload (e.g. a `payload` field on the proto message that holds
+                # this Signature, or the canonical serialization of the proto message that
+                # holds this signature).
+              &quot;publicKeyId&quot;: &quot;A String&quot;, # The identifier for the public key that verifies this signature.
+                  #   * The `public_key_id` is required.
+                  #   * The `public_key_id` SHOULD be an RFC3986 conformant URI.
+                  #   * When possible, the `public_key_id` SHOULD be an immutable reference,
+                  #     such as a cryptographic digest.
+                  #
+                  # Examples of valid `public_key_id`s:
+                  #
+                  # OpenPGP V4 public key fingerprint:
+                  #   * &quot;openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA&quot;
+                  # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
+                  # details on this scheme.
+                  #
+                  # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
+                  # serialization):
+                  #   * &quot;ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU&quot;
+                  #   * &quot;nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5&quot;
+              &quot;signature&quot;: &quot;A String&quot;, # The content of the signature, an opaque bytestring.
+                  # The payload that this signature verifies MUST be unambiguously provided
+                  # with the Signature during verification. A wrapper message might provide
+                  # the payload explicitly. Alternatively, a message might have a canonical
+                  # serialization that can always be unambiguously computed to derive the
+                  # payload.
+            },
+          ],
+          &quot;serializedPayload&quot;: &quot;A String&quot;, # The serialized payload that is verified by one or more `signatures`.
+              # The encoding and semantic meaning of this payload must match what is set in
+              # `content_type`.
+        },
+        &quot;pgpSignedAttestation&quot;: { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
+            # supports `ATTACHED` signatures, where the payload that is signed is included
+            # alongside the signature itself in the same file.
+          &quot;signature&quot;: &quot;A String&quot;, # Required. The raw content of the signature, as output by GNU Privacy Guard
+              # (GPG) or equivalent. Since this message only supports attached signatures,
+              # the payload that was signed must be attached. While the signature format
+              # supported is dependent on the verification implementation, currently only
+              # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
+              # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
+              # --output=signature.gpg payload.json` will create the signature content
+              # expected in this field in `signature.gpg` for the `payload.json`
+              # attestation payload.
+          &quot;contentType&quot;: &quot;A String&quot;, # Type (for example schema) of the attestation payload that was signed.
+              # The verifier must ensure that the provided type is one that the verifier
+              # supports, and that the attestation payload is a valid instantiation of that
+              # type (for example by validating a JSON schema).
+          &quot;pgpKeyId&quot;: &quot;A String&quot;, # The cryptographic fingerprint of the key used to generate the signature,
+              # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
+              # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
+              # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
+              # Implementations may choose to acknowledge &quot;LONG&quot;, &quot;SHORT&quot;, or other
+              # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
+              # In gpg, the full fingerprint can be retrieved from the `fpr` field
+              # returned when calling --list-keys with --with-colons.  For example:
+              # ```
+              # gpg --with-colons --with-fingerprint --force-v4-certs \
+              #     --list-keys attester@example.com
+              # tru::1:1513631572:0:3:1:5
+              # pub:...&lt;SNIP&gt;...
+              # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
+              # ```
+              # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
+        },
+      },
+    },
+    &quot;deployment&quot;: { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
+      &quot;deployment&quot;: { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
+        &quot;undeployTime&quot;: &quot;A String&quot;, # End of the lifetime of this deployment.
+        &quot;userEmail&quot;: &quot;A String&quot;, # Identity of the user that triggered this deployment.
+        &quot;resourceUri&quot;: [ # Output only. Resource URI for the artifact being deployed taken from
+            # the deployable field with the same name.
+          &quot;A String&quot;,
+        ],
+        &quot;platform&quot;: &quot;A String&quot;, # Platform hosting this deployment.
+        &quot;config&quot;: &quot;A String&quot;, # Configuration used to create this deployment.
+        &quot;deployTime&quot;: &quot;A String&quot;, # Required. Beginning of the lifetime of this deployment.
+        &quot;address&quot;: &quot;A String&quot;, # Address of the runtime element hosting this deployment.
+      },
+    },
+    &quot;noteName&quot;: &quot;A String&quot;, # Required. Immutable. The analysis note associated with this occurrence, in
+        # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
+        # used as a filter in list requests.
+    &quot;installation&quot;: { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
+      &quot;installation&quot;: { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
+          # system.
+        &quot;name&quot;: &quot;A String&quot;, # Output only. The name of the installed package.
+        &quot;location&quot;: [ # Required. All of the places within the filesystem versions of this package
+            # have been found.
+          { # An occurrence of a particular package installation found within a system&#x27;s
+              # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
+            &quot;path&quot;: &quot;A String&quot;, # The path from which we gathered that this package/version is installed.
+            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
+                # denoting the package manager version distributing a package.
+            &quot;version&quot;: { # Version contains structured information about the version of a package. # The version installed at this location.
+              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                  # versions.
+              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                  # name.
+            },
+          },
+        ],
+      },
+    },
+    &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
+      &quot;shortDescription&quot;: &quot;A String&quot;, # Output only. A one sentence description of this vulnerability.
+      &quot;relatedUrls&quot;: [ # Output only. URLs related to this vulnerability.
+        { # Metadata for any related URL information.
+          &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
+          &quot;label&quot;: &quot;A String&quot;, # Label to describe usage of the URL.
         },
       ],
+      &quot;effectiveSeverity&quot;: &quot;A String&quot;, # The distro assigned severity for this vulnerability when it is
+          # available, and note provider assigned severity when distro has not yet
+          # assigned a severity for this vulnerability.
+      &quot;severity&quot;: &quot;A String&quot;, # Output only. The note provider assigned Severity of the vulnerability.
+      &quot;type&quot;: &quot;A String&quot;, # The type of package; whether native or non native(ruby gems, node.js
+          # packages etc)
+      &quot;longDescription&quot;: &quot;A String&quot;, # Output only. A detailed description of this vulnerability.
+      &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
+          # scale of 0-10 where 0 indicates low severity and 10 indicates high
+          # severity.
+      &quot;packageIssue&quot;: [ # Required. The set of affected locations and their fixes (if available)
+          # within the associated resource.
+        { # This message wraps a location affected by a vulnerability and its
+            # associated fix (if one is available).
+          &quot;fixedLocation&quot;: { # The location of the vulnerability. # The location of the available fix for vulnerability.
+            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                # format. Examples include distro or storage location for vulnerable jar.
+            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                  # versions.
+              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                  # name.
+            },
+          },
+          &quot;severityName&quot;: &quot;A String&quot;, # Deprecated, use Details.effective_severity instead
+              # The severity (e.g., distro assigned severity) for this vulnerability.
+          &quot;affectedLocation&quot;: { # The location of the vulnerability. # Required. The location of the vulnerability.
+            &quot;package&quot;: &quot;A String&quot;, # Required. The package being described.
+            &quot;cpeUri&quot;: &quot;A String&quot;, # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
+                # format. Examples include distro or storage location for vulnerable jar.
+            &quot;version&quot;: { # Version contains structured information about the version of a package. # Required. The version of the package being described.
+              &quot;kind&quot;: &quot;A String&quot;, # Required. Distinguishes between sentinel MIN/MAX versions and normal
+                  # versions.
+              &quot;revision&quot;: &quot;A String&quot;, # The iteration of the package build from the above version.
+              &quot;epoch&quot;: 42, # Used to correct mistakes in the version numbering scheme.
+              &quot;name&quot;: &quot;A String&quot;, # Required only when version kind is NORMAL. The main part of the version
+                  # name.
+            },
+          },
+        },
+      ],
+    },
+    &quot;discovered&quot;: { # Details of a discovery occurrence. # Describes when a resource was discovered.
+      &quot;discovered&quot;: { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
+        &quot;lastAnalysisTime&quot;: &quot;A String&quot;, # The last time continuous analysis was done for this resource.
+            # Deprecated, do not use.
+        &quot;analysisStatusError&quot;: { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
+            # details to show to the user. The LocalizedMessage is output only and
+            # populated by the API.
+            # different programming environments, including REST APIs and RPC APIs. It is
+            # used by [gRPC](https://github.com/grpc). Each `Status` message contains
+            # three pieces of data: error code, error message, and error details.
+            #
+            # You can find out more about this error model and how to work with it in the
+            # [API Design Guide](https://cloud.google.com/apis/design/errors).
+          &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
+              # user-facing error message should be localized and sent in the
+              # google.rpc.Status.details field, or localized by the client.
+          &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+          &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
+              # message types for APIs to use.
+            {
+              &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+            },
+          ],
+        },
+        &quot;continuousAnalysis&quot;: &quot;A String&quot;, # Whether the resource is continuously analyzed.
+        &quot;analysisStatus&quot;: &quot;A String&quot;, # The status of discovery for the resource.
+      },
+    },
+    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
+    &quot;build&quot;: { # Details of a build occurrence. # Describes a verifiable build.
+      &quot;provenance&quot;: { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
+          # details about the build from source to completion.
+        &quot;endTime&quot;: &quot;A String&quot;, # Time at which execution of the build was finished.
+        &quot;builderVersion&quot;: &quot;A String&quot;, # Version string of the builder at the time this build was executed.
+        &quot;startTime&quot;: &quot;A String&quot;, # Time at which execution of the build was started.
+        &quot;creator&quot;: &quot;A String&quot;, # E-mail address of the user who initiated this build. Note that this was the
+            # user&#x27;s e-mail address at the time the build was initiated; this address may
+            # not represent the same end-user for all time.
+        &quot;logsUri&quot;: &quot;A String&quot;, # URI where any logs for this provenance were written.
+        &quot;builtArtifacts&quot;: [ # Output of the build.
+          { # Artifact describes a build product.
+            &quot;names&quot;: [ # Related artifact names. This may be the path to a binary or jar file, or in
+                # the case of a container build, the name used to push the container image to
+                # Google Container Registry, as presented to `docker push`. Note that a
+                # single Artifact ID can have multiple names, for example if two tags are
+                # applied to one image.
+              &quot;A String&quot;,
+            ],
+            &quot;id&quot;: &quot;A String&quot;, # Artifact ID, if any; for container images, this will be a URL by digest
+                # like `gcr.io/projectID/imagename@sha256:123456`.
+            &quot;checksum&quot;: &quot;A String&quot;, # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
+                # container.
+          },
+        ],
+        &quot;buildOptions&quot;: { # Special options applied to this build. This is a catch-all field where
+            # build providers can enter any desired additional details.
+          &quot;a_key&quot;: &quot;A String&quot;,
+        },
+        &quot;id&quot;: &quot;A String&quot;, # Required. Unique identifier of the build.
+        &quot;projectId&quot;: &quot;A String&quot;, # ID of the project.
+        &quot;commands&quot;: [ # Commands requested by the build.
+          { # Command describes a step performed as part of the build pipeline.
+            &quot;waitFor&quot;: [ # The ID(s) of the command(s) that this command depends on.
+              &quot;A String&quot;,
+            ],
+            &quot;id&quot;: &quot;A String&quot;, # Optional unique identifier for this command, used in wait_for to reference
+                # this command as a dependency.
+            &quot;dir&quot;: &quot;A String&quot;, # Working directory (relative to project source root) used when running this
+                # command.
+            &quot;args&quot;: [ # Command-line arguments used when executing this command.
+              &quot;A String&quot;,
+            ],
+            &quot;name&quot;: &quot;A String&quot;, # Required. Name of the command, as presented on the command line, or if the
+                # command is packaged as a Docker container, as presented to `docker pull`.
+            &quot;env&quot;: [ # Environment variables set before running this command.
+              &quot;A String&quot;,
+            ],
+          },
+        ],
+        &quot;sourceProvenance&quot;: { # Source describes the location of the source used for the build. # Details of the Source input to the build.
+          &quot;context&quot;: { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
+              # with a path point to a unique revision of a single file or directory.
+            &quot;labels&quot;: { # Labels with user defined metadata.
+              &quot;a_key&quot;: &quot;A String&quot;,
+            },
+            &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+              &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+              &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+              &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                  # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                  # hostURI/project.
+              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                &quot;name&quot;: &quot;A String&quot;, # The alias name.
+              },
+            },
+            &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                # repository (e.g., GitHub).
+              &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+              &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+            },
+            &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                # Source Repo.
+              &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+              &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+                &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                    # winged-cargo-31) and a repo name within that project.
+                  &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                  &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+                },
+              },
+              &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                &quot;name&quot;: &quot;A String&quot;, # The alias name.
+              },
+            },
+          },
+          &quot;artifactStorageSourceUri&quot;: &quot;A String&quot;, # If provided, the input binary artifacts for the build came from this
+              # location.
+          &quot;fileHashes&quot;: { # Hash(es) of the build source, which can be used to verify that the original
+              # source integrity was maintained in the build.
+              #
+              # The keys to this map are file paths used as build source and the values
+              # contain the hash values for those files.
+              #
+              # If the build source came in a single package such as a gzipped tarfile
+              # (.tar.gz), the FileHash will be for the single path to that file.
+            &quot;a_key&quot;: { # Container message for hashes of byte content of files, used in source
+                # messages to verify integrity of source input to the build.
+              &quot;fileHash&quot;: [ # Required. Collection of file hashes.
+                { # Container message for hash values.
+                  &quot;type&quot;: &quot;A String&quot;, # Required. The type of hash that was performed.
+                  &quot;value&quot;: &quot;A String&quot;, # Required. The hash value.
+                },
+              ],
+            },
+          },
+          &quot;additionalContexts&quot;: [ # If provided, some of the source code used for the build may be found in
+              # these locations, in the case where the source repository had multiple
+              # remotes or submodules. This list will not include the context specified in
+              # the context field.
+            { # A SourceContext is a reference to a tree of files. A SourceContext together
+                # with a path point to a unique revision of a single file or directory.
+              &quot;labels&quot;: { # Labels with user defined metadata.
+                &quot;a_key&quot;: &quot;A String&quot;,
+              },
+              &quot;gerrit&quot;: { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
+                &quot;hostUri&quot;: &quot;A String&quot;, # The URI of a running Gerrit instance.
+                &quot;revisionId&quot;: &quot;A String&quot;, # A revision (commit) ID.
+                &quot;gerritProject&quot;: &quot;A String&quot;, # The full project name within the host. Projects may be nested, so
+                    # &quot;project/subproject&quot; is a valid project name. The &quot;repo name&quot; is the
+                    # hostURI/project.
+                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
+                },
+              },
+              &quot;git&quot;: { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
+                  # repository (e.g., GitHub).
+                &quot;revisionId&quot;: &quot;A String&quot;, # Git commit hash.
+                &quot;url&quot;: &quot;A String&quot;, # Git repository URL.
+              },
+              &quot;cloudRepo&quot;: { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
+                  # Source Repo.
+                &quot;revisionId&quot;: &quot;A String&quot;, # A revision ID.
+                &quot;repoId&quot;: { # A unique identifier for a Cloud Repo. # The ID of the repo.
+                  &quot;uid&quot;: &quot;A String&quot;, # A server-assigned, globally unique identifier.
+                  &quot;projectRepoId&quot;: { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
+                      # winged-cargo-31) and a repo name within that project.
+                    &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project.
+                    &quot;repoName&quot;: &quot;A String&quot;, # The name of the repo. Leave empty for the default repo.
+                  },
+                },
+                &quot;aliasContext&quot;: { # An alias to a repo revision. # An alias, which may be a branch or tag.
+                  &quot;kind&quot;: &quot;A String&quot;, # The alias kind.
+                  &quot;name&quot;: &quot;A String&quot;, # The alias name.
+                },
+              },
+            },
+          ],
+        },
+        &quot;triggerId&quot;: &quot;A String&quot;, # Trigger identifier if the build was triggered automatically; empty if not.
+        &quot;createTime&quot;: &quot;A String&quot;, # Time at which the build was created.
+      },
+      &quot;provenanceBytes&quot;: &quot;A String&quot;, # Serialized JSON representation of the provenance, used in generating the
+          # build signature in the corresponding build note. After verifying the
+          # signature, `provenance_bytes` can be unmarshalled and compared to the
+          # provenance to confirm that it is unchanged. A base64-encoded string
+          # representation of the provenance bytes is used for the signature in order
+          # to interoperate with openssl which expects this format for signature
+          # verification.
+          #
+          # The serialized form is captured both to avoid ambiguity in how the
+          # provenance is marshalled to json as well to prevent incompatibilities with
+          # future changes.
     },
     &quot;derivedImage&quot;: { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
         # note.
       &quot;derivedImage&quot;: { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
           # relationship. This image would be produced from a Dockerfile with FROM
           # &lt;DockerImage.Basis in attached Note&gt;.
-        &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
-          &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
-            &quot;A String&quot;,
-          ],
-          &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
-              # representation.
-          &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
-              #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
-              # Only the name of the final blob is kept.
-        },
+        &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
+            # occurrence.
+        &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
+            # associated image basis.
         &quot;layerInfo&quot;: [ # This contains layer-specific metadata, if populated it has length
             # &quot;distance&quot; and is ordered with [distance] being the layer immediately
             # following the base image and [1] being the final layer.
@@ -4995,12 +4986,21 @@
             &quot;arguments&quot;: &quot;A String&quot;, # The recovered arguments to the Dockerfile directive.
           },
         ],
-        &quot;distance&quot;: 42, # Output only. The number of layers by which this image differs from the
-            # associated image basis.
-        &quot;baseResourceUrl&quot;: &quot;A String&quot;, # Output only. This contains the base image URL for the derived image
-            # occurrence.
+        &quot;fingerprint&quot;: { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
+          &quot;v1Name&quot;: &quot;A String&quot;, # Required. The layer ID of the final layer in the Docker image&#x27;s v1
+              # representation.
+          &quot;v2Blob&quot;: [ # Required. The ordered list of v2 blobs that represent a given image.
+            &quot;A String&quot;,
+          ],
+          &quot;v2Name&quot;: &quot;A String&quot;, # Output only. The name of the image&#x27;s v2 blobs computed via:
+              #   [bottom] := v2_blobbottom := sha256(v2_blob[N] + &quot; &quot; + v2_name[N+1])
+              # Only the name of the final blob is kept.
+        },
       },
     },
+    &quot;kind&quot;: &quot;A String&quot;, # Output only. This explicitly denotes which of the occurrence details are
+        # specified. This field can be used as a filter in list requests.
+    &quot;remediation&quot;: &quot;A String&quot;, # A description of actions that can be taken to remedy the note.
   }</pre>
 </div>
 
@@ -5132,6 +5132,51 @@
           # `condition` that determines how and when the `bindings` are applied. Each
           # of the `bindings` must contain at least one member.
         { # Associates `members` with a `role`.
+          &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
+              # `members` can have the following values:
+              #
+              # * `allUsers`: A special identifier that represents anyone who is
+              #    on the internet; with or without a Google account.
+              #
+              # * `allAuthenticatedUsers`: A special identifier that represents anyone
+              #    who is authenticated with a Google account or a service account.
+              #
+              # * `user:{emailid}`: An email address that represents a specific Google
+              #    account. For example, `alice@example.com` .
+              #
+              #
+              # * `serviceAccount:{emailid}`: An email address that represents a service
+              #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
+              #
+              # * `group:{emailid}`: An email address that represents a Google group.
+              #    For example, `admins@example.com`.
+              #
+              # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
+              #    identifier) representing a user that has been recently deleted. For
+              #    example, `alice@example.com?uid=123456789012345678901`. If the user is
+              #    recovered, this value reverts to `user:{emailid}` and the recovered user
+              #    retains the role in the binding.
+              #
+              # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
+              #    unique identifier) representing a service account that has been recently
+              #    deleted. For example,
+              #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
+              #    If the service account is undeleted, this value reverts to
+              #    `serviceAccount:{emailid}` and the undeleted service account retains the
+              #    role in the binding.
+              #
+              # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
+              #    identifier) representing a Google group that has been recently
+              #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
+              #    the group is recovered, this value reverts to `group:{emailid}` and the
+              #    recovered group retains the role in the binding.
+              #
+              #
+              # * `domain:{domain}`: The G Suite domain (primary) that represents all the
+              #    users of that domain. For example, `google.com` or `example.com`.
+              #
+            &quot;A String&quot;,
+          ],
           &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
               #
               # If the condition evaluates to `true`, then this binding applies to the
@@ -5178,57 +5223,12 @@
                 # describes the expression, e.g. when hovered over it in a UI.
             &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
                 # syntax.
+            &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
+                # reporting, e.g. a file name and a position in the file.
             &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
                 # its purpose. This can be used e.g. in UIs which allow to enter the
                 # expression.
-            &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
-                # reporting, e.g. a file name and a position in the file.
           },
-          &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
-              # `members` can have the following values:
-              #
-              # * `allUsers`: A special identifier that represents anyone who is
-              #    on the internet; with or without a Google account.
-              #
-              # * `allAuthenticatedUsers`: A special identifier that represents anyone
-              #    who is authenticated with a Google account or a service account.
-              #
-              # * `user:{emailid}`: An email address that represents a specific Google
-              #    account. For example, `alice@example.com` .
-              #
-              #
-              # * `serviceAccount:{emailid}`: An email address that represents a service
-              #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
-              #
-              # * `group:{emailid}`: An email address that represents a Google group.
-              #    For example, `admins@example.com`.
-              #
-              # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
-              #    identifier) representing a user that has been recently deleted. For
-              #    example, `alice@example.com?uid=123456789012345678901`. If the user is
-              #    recovered, this value reverts to `user:{emailid}` and the recovered user
-              #    retains the role in the binding.
-              #
-              # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
-              #    unique identifier) representing a service account that has been recently
-              #    deleted. For example,
-              #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
-              #    If the service account is undeleted, this value reverts to
-              #    `serviceAccount:{emailid}` and the undeleted service account retains the
-              #    role in the binding.
-              #
-              # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
-              #    identifier) representing a Google group that has been recently
-              #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
-              #    the group is recovered, this value reverts to `group:{emailid}` and the
-              #    recovered group retains the role in the binding.
-              #
-              #
-              # * `domain:{domain}`: The G Suite domain (primary) that represents all the
-              #    users of that domain. For example, `google.com` or `example.com`.
-              #
-            &quot;A String&quot;,
-          ],
           &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
               # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
         },
@@ -5351,6 +5351,51 @@
         # `condition` that determines how and when the `bindings` are applied. Each
         # of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
+            # `members` can have the following values:
+            #
+            # * `allUsers`: A special identifier that represents anyone who is
+            #    on the internet; with or without a Google account.
+            #
+            # * `allAuthenticatedUsers`: A special identifier that represents anyone
+            #    who is authenticated with a Google account or a service account.
+            #
+            # * `user:{emailid}`: An email address that represents a specific Google
+            #    account. For example, `alice@example.com` .
+            #
+            #
+            # * `serviceAccount:{emailid}`: An email address that represents a service
+            #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
+            #
+            # * `group:{emailid}`: An email address that represents a Google group.
+            #    For example, `admins@example.com`.
+            #
+            # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
+            #    identifier) representing a user that has been recently deleted. For
+            #    example, `alice@example.com?uid=123456789012345678901`. If the user is
+            #    recovered, this value reverts to `user:{emailid}` and the recovered user
+            #    retains the role in the binding.
+            #
+            # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
+            #    unique identifier) representing a service account that has been recently
+            #    deleted. For example,
+            #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
+            #    If the service account is undeleted, this value reverts to
+            #    `serviceAccount:{emailid}` and the undeleted service account retains the
+            #    role in the binding.
+            #
+            # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
+            #    identifier) representing a Google group that has been recently
+            #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
+            #    the group is recovered, this value reverts to `group:{emailid}` and the
+            #    recovered group retains the role in the binding.
+            #
+            #
+            # * `domain:{domain}`: The G Suite domain (primary) that represents all the
+            #    users of that domain. For example, `google.com` or `example.com`.
+            #
+          &quot;A String&quot;,
+        ],
         &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
             #
             # If the condition evaluates to `true`, then this binding applies to the
@@ -5397,57 +5442,12 @@
               # describes the expression, e.g. when hovered over it in a UI.
           &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
               # syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
+              # reporting, e.g. a file name and a position in the file.
           &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
               # its purpose. This can be used e.g. in UIs which allow to enter the
               # expression.
-          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
-              # reporting, e.g. a file name and a position in the file.
         },
-        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
-            # `members` can have the following values:
-            #
-            # * `allUsers`: A special identifier that represents anyone who is
-            #    on the internet; with or without a Google account.
-            #
-            # * `allAuthenticatedUsers`: A special identifier that represents anyone
-            #    who is authenticated with a Google account or a service account.
-            #
-            # * `user:{emailid}`: An email address that represents a specific Google
-            #    account. For example, `alice@example.com` .
-            #
-            #
-            # * `serviceAccount:{emailid}`: An email address that represents a service
-            #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
-            #
-            # * `group:{emailid}`: An email address that represents a Google group.
-            #    For example, `admins@example.com`.
-            #
-            # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
-            #    identifier) representing a user that has been recently deleted. For
-            #    example, `alice@example.com?uid=123456789012345678901`. If the user is
-            #    recovered, this value reverts to `user:{emailid}` and the recovered user
-            #    retains the role in the binding.
-            #
-            # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
-            #    unique identifier) representing a service account that has been recently
-            #    deleted. For example,
-            #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
-            #    If the service account is undeleted, this value reverts to
-            #    `serviceAccount:{emailid}` and the undeleted service account retains the
-            #    role in the binding.
-            #
-            # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
-            #    identifier) representing a Google group that has been recently
-            #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
-            #    the group is recovered, this value reverts to `group:{emailid}` and the
-            #    recovered group retains the role in the binding.
-            #
-            #
-            # * `domain:{domain}`: The G Suite domain (primary) that represents all the
-            #    users of that domain. For example, `google.com` or `example.com`.
-            #
-          &quot;A String&quot;,
-        ],
         &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
             # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
       },