Blame - docs/dyn/containeranalysis_v1alpha1.projects.occurrences.html - platform/external/python/google-api-python-client

2020-05-01 07:42:23 -0700

[diff] [blame]

78

<code><a href="#create">create(parent, body=None, name=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

79

<p class="firstline">Creates a new `Occurrence`. Use this method to create `Occurrences`</p>

80

81

<code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>

82

<p class="firstline">Deletes the given `Occurrence` from the system. Use this when</p>

83

84

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

85

<p class="firstline">Returns the requested `Occurrence`.</p>

86

87

<code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

88

<p class="firstline">Gets the access control policy for a note or an `Occurrence` resource.</p>

89

90

<code><a href="#getNotes">getNotes(name, x__xgafv=None)</a></code></p>

91

<p class="firstline">Gets the `Note` attached to the given `Occurrence`.</p>

92

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

93

<code><a href="#getVulnerabilitySummary">getVulnerabilitySummary(parent, filter=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

94

<p class="firstline">Gets a summary of the number and severity of occurrences.</p>

95

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

96

<code><a href="#list">list(parent, pageSize=None, kind=None, name=None, filter=None, pageToken=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

97

<p class="firstline">Lists active `Occurrences` for a given project matching the filters.</p>

98

99

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

100

<p class="firstline">Retrieves the next page of results.</p>

101

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

102

<code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

103

<p class="firstline">Updates an existing occurrence.</p>

104

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

105

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

106

<p class="firstline">Sets the access control policy on the specified `Note` or `Occurrence`.</p>

107

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

108

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

109

<p class="firstline">Returns the permissions that a caller has on the specified note or</p>

110

<h3>Method Details</h3>

111

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

112

<code class="details" id="create">create(parent, body=None, name=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

113

<pre>Creates a new `Occurrence`. Use this method to create `Occurrences`

114

for a resource.

115

116

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

117

parent: string, This field contains the project Id for example: "projects/{project_id}" (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

118

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

119

The object takes the form of:

120

121

{ # `Occurrence` includes information about analysis occurrences for an image.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

122

"resource": { # #

123

# The resource for which the `Occurrence` applies.

124

# Resource is an entity that can have metadata. E.g., a Docker image.

125

"uri": "A String", # The unique URI of the resource. E.g.,

126

# "https://gcr.io/project/image@sha256:foo" for a Docker image.

127

"name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".

128

"contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.

129

"type": "A String", # The type of hash that was performed.

130

"value": "A String", # The hash value.

131

},

132

},

133

"vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.

134

# to fix it.

135

"packageIssue": [ # The set of affected locations and their fixes (if available) within

136

# the associated resource.

137

{ # This message wraps a location affected by a vulnerability and its

138

# associated fix (if one is available).

139

"affectedLocation": { # The location of the vulnerability # The location of the vulnerability.

140

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

141

# filter in list requests.

142

# For a discussion of this in Debian/Ubuntu:

143

# http://serverfault.com/questions/604541/debian-packages-version-convention

144

# For a discussion of this in Redhat/Fedora/Centos:

145

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

146

"name": "A String", # The main part of the version name.

147

"revision": "A String", # The iteration of the package build from the above version.

148

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

149

# If kind is not NORMAL, then the other fields are ignored.

150

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

151

},

152

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

153

# format. Examples include distro or storage location for vulnerable jar.

154

# This field can be used as a filter in list requests.

155

"package": "A String", # The package being described.

156

},

157

"fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.

158

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

159

# filter in list requests.

160

# For a discussion of this in Debian/Ubuntu:

161

# http://serverfault.com/questions/604541/debian-packages-version-convention

162

# For a discussion of this in Redhat/Fedora/Centos:

163

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

164

"name": "A String", # The main part of the version name.

165

"revision": "A String", # The iteration of the package build from the above version.

166

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

167

# If kind is not NORMAL, then the other fields are ignored.

168

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

169

},

170

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

171

# format. Examples include distro or storage location for vulnerable jar.

172

# This field can be used as a filter in list requests.

173

"package": "A String", # The package being described.

174

},

175

"severityName": "A String",

176

},

177

],

178

"effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is

179

# available and note provider assigned severity when distro has not yet

180

# assigned a severity for this vulnerability.

181

"type": "A String", # The type of package; whether native or non native(ruby gems,

182

# node.js packages etc)

183

"severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.

184

"cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a

185

# scale of 0-10 where 0 indicates low severity and 10 indicates high

186

# severity.

187

},

188

"attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.

189

# Attestation can be verified using the attached signature. If the verifier

190

# trusts the public key of the signer, then verifying the signature is

191

# sufficient to establish trust. In this circumstance, the

192

# AttestationAuthority to which this Attestation is attached is primarily

193

# useful for look-up (how to find this Attestation if you already know the

194

# Authority and artifact to be verified) and intent (which authority was this

195

# attestation intended to sign for).

196

"pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.

197

# This message only supports `ATTACHED` signatures, where the payload that is

198

# signed is included alongside the signature itself in the same file.

199

"pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,

200

# as output by, e.g. `gpg --list-keys`. This should be the version 4, full

201

# 160-bit fingerprint, expressed as a 40 character hexadecimal string. See

202

# https://tools.ietf.org/html/rfc4880#section-12.2 for details.

203

# Implementations may choose to acknowledge "LONG", "SHORT", or other

204

# abbreviated key IDs, but only the full fingerprint is guaranteed to work.

205

# In gpg, the full fingerprint can be retrieved from the `fpr` field

206

# returned when calling --list-keys with --with-colons. For example:

207

# ```

208

# gpg --with-colons --with-fingerprint --force-v4-certs \

209

# --list-keys attester@example.com

210

# tru::1:1513631572:0:3:1:5

211

# pub:...<SNIP>...

212

# fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:

213

# ```

214

# Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.

215

"signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or

216

# equivalent. Since this message only supports attached signatures, the

217

# payload that was signed must be attached. While the signature format

218

# supported is dependent on the verification implementation, currently only

219

# ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than

220

# `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor

221

# --output=signature.gpg payload.json` will create the signature content

222

# expected in this field in `signature.gpg` for the `payload.json`

223

# attestation payload.

224

"contentType": "A String", # Type (for example schema) of the attestation payload that was signed.

225

# The verifier must ensure that the provided type is one that the verifier

226

# supports, and that the attestation payload is a valid instantiation of that

227

# type (for example by validating a JSON schema).

228

},

229

},

230

"kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are

231

# specified. This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

232

"buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

233

"provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance

234

# details about the build from source to completion.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

235

"sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

236

"context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.

237

# with a path point to a unique revision of a single file or directory.

238

"labels": { # Labels with user defined metadata.

239

"a_key": "A String",

240

},

241

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

242

# repository (e.g., GitHub).

243

"url": "A String", # Git repository URL.

244

"revisionId": "A String", # Required. Git commit hash.

245

},

246

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

247

# Source Repo.

248

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

249

"kind": "A String", # The alias kind.

250

"name": "A String", # The alias name.

251

},

252

"revisionId": "A String", # A revision ID.

253

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

254

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

255

# winged-cargo-31) and a repo name within that project.

256

"projectId": "A String", # The ID of the project.

257

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

258

},

259

"uid": "A String", # A server-assigned, globally unique identifier.

260

},

261

},

262

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

263

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

264

# "project/subproject" is a valid project name. The "repo name" is

265

# the hostURI/project.

266

"hostUri": "A String", # The URI of a running Gerrit instance.

267

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

268

"kind": "A String", # The alias kind.

269

"name": "A String", # The alias name.

270

},

271

"revisionId": "A String", # A revision (commit) ID.

272

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

273

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

274

"additionalContexts": [ # If provided, some of the source code used for the build may be found in

275

# these locations, in the case where the source repository had multiple

276

# remotes or submodules. This list will not include the context specified in

277

# the context field.

278

{ # A SourceContext is a reference to a tree of files. A SourceContext together

279

# with a path point to a unique revision of a single file or directory.

280

"labels": { # Labels with user defined metadata.

281

"a_key": "A String",

282

},

283

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

284

# repository (e.g., GitHub).

285

"url": "A String", # Git repository URL.

286

"revisionId": "A String", # Required. Git commit hash.

287

},

288

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

289

# Source Repo.

290

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

291

"kind": "A String", # The alias kind.

292

"name": "A String", # The alias name.

293

},

294

"revisionId": "A String", # A revision ID.

295

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

296

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

297

# winged-cargo-31) and a repo name within that project.

298

"projectId": "A String", # The ID of the project.

299

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

300

},

301

"uid": "A String", # A server-assigned, globally unique identifier.

302

},

303

},

304

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

305

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

306

# "project/subproject" is a valid project name. The "repo name" is

307

# the hostURI/project.

308

"hostUri": "A String", # The URI of a running Gerrit instance.

309

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

310

"kind": "A String", # The alias kind.

311

"name": "A String", # The alias name.

312

},

313

"revisionId": "A String", # A revision (commit) ID.

},

},

],

"artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this

318

# location.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

319

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

320

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

321

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

322

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

323

# Requirements]

324

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

325

},

326

"repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.

327

# Repository.

328

"tagName": "A String", # Name of the tag to build.

329

"branchName": "A String", # Name of the branch to build.

330

"projectId": "A String", # ID of the project that owns the repo.

331

"repoName": "A String", # Name of the repo.

332

"commitSha": "A String", # Explicit commit SHA to build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

333

},

334

"fileHashes": { # Hash(es) of the build source, which can be used to verify that the original

335

# source integrity was maintained in the build.

336

#

337

# The keys to this map are file paths used as build source and the values

338

# contain the hash values for those files.

339

#

340

# If the build source came in a single package such as a gzipped tarfile

341

# (.tar.gz), the FileHash will be for the single path to that file.

342

"a_key": { # Container message for hashes of byte content of files, used in Source

343

# messages to verify integrity of source input to the build.

344

"fileHash": [ # Collection of file hashes.

345

{ # Container message for hash values.

346

"type": "A String", # The type of hash that was performed.

347

"value": "A String", # The hash value.

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

352

"storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud

353

# Storage.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

354

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

355

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

356

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

357

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

358

# Requirements]

359

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

360

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

361

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

362

"builtArtifacts": [ # Output of the build.

363

{ # Artifact describes a build product.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

364

"name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in

365

# the case of a container build, the name used to push the container image to

366

# Google Container Registry, as presented to `docker push`.

367

#

368

# This field is deprecated in favor of the plural `names` field; it continues

369

# to exist here to allow existing BuildProvenance serialized to json in

370

# google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to

371

# deserialize back into proto.

372

"checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a

373

# container.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

374

"names": [ # Related artifact names. This may be the path to a binary or jar file, or in

375

# the case of a container build, the name used to push the container image to

376

# Google Container Registry, as presented to `docker push`. Note that a

377

# single Artifact ID can have multiple names, for example if two tags are

378

# applied to one image.

379

"A String",

380

],

381

"id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest

382

# like gcr.io/projectID/imagename@sha256:123456

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

383

},

384

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

385

"id": "A String", # Unique identifier of the build.

386

"createTime": "A String", # Time at which the build was created.

387

"buildOptions": { # Special options applied to this build. This is a catch-all field where

388

# build providers can enter any desired additional details.

389

"a_key": "A String",

390

},

391

"logsBucket": "A String", # Google Cloud Storage bucket where logs were written.

392

"finishTime": "A String", # Time at which execution of the build was finished.

393

"creator": "A String", # E-mail address of the user who initiated this build. Note that this was the

394

# user's e-mail address at the time the build was initiated; this address may

395

# not represent the same end-user for all time.

396

"projectId": "A String", # ID of the project.

397

"startTime": "A String", # Time at which execution of the build was started.

398

"commands": [ # Commands requested by the build.

399

{ # Command describes a step performed as part of the build pipeline.

400

"dir": "A String", # Working directory (relative to project source root) used when running

401

# this Command.

402

"env": [ # Environment variables set before running this Command.

403

"A String",

404

],

405

"args": [ # Command-line arguments used when executing this Command.

406

"A String",

407

],

408

"id": "A String", # Optional unique identifier for this Command, used in wait_for to reference

409

# this Command as a dependency.

410

"name": "A String", # Name of the command, as presented on the command line, or if the command is

411

# packaged as a Docker container, as presented to `docker pull`.

412

"waitFor": [ # The ID(s) of the Command(s) that this Command depends on.

"A String",

],

},

],

"triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.

418

"builderVersion": "A String", # Version string of the builder at the time this build was executed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

419

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

420

"provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the

421

# `BuildSignature` in the corresponding Result. After verifying the

422

# signature, `provenance_bytes` can be unmarshalled and compared to the

423

# provenance to confirm that it is unchanged. A base64-encoded string

424

# representation of the provenance bytes is used for the signature in order

425

# to interoperate with openssl which expects this format for signature

426

# verification.

427

#

428

# The serialized form is captured both to avoid ambiguity in how the

429

# provenance is marshalled to json as well to prevent incompatibilities with

430

# future changes.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

431

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

432

"name": "A String", # Output only. The name of the `Occurrence` in the form

433

# "projects/{project_id}/occurrences/{OCCURRENCE_ID}"

434

"deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.

435

"undeployTime": "A String", # End of the lifetime of this deployment.

436

"address": "A String", # Address of the runtime element hosting this deployment.

437

"platform": "A String", # Platform hosting this deployment.

438

"config": "A String", # Configuration used to create this deployment.

439

"deployTime": "A String", # Beginning of the lifetime of this deployment.

440

"resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the

441

# deployable field with the same name.

442

"A String",

443

],

444

"userEmail": "A String", # Identity of the user that triggered this deployment.

445

},

446

"upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.

447

# specific upgrade. This presence is supplied via local sources (i.e. it is

448

# present in the mirror and the running system has noticed its availability).

449

"package": "A String", # Required - The package this Upgrade is for.

450

"distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system

451

# for the resource_url. This allows efficient filtering, as well as

452

# making it easier to use the occurrence.

453

# operating system (CPE). Some distributions have additional metadata around

454

# updates, classifying them into various categories and severities.

455

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

456

# upstream operating system upgrade feed.

457

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

458

# https://cpe.mitre.org/specification/.

459

"severity": "A String", # The severity as specified by the upstream operating system.

460

"cve": [ # The cve that would be resolved by this upgrade.

461

"A String",

462

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

463

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

464

"parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.

465

# For a discussion of this in Debian/Ubuntu:

466

# http://serverfault.com/questions/604541/debian-packages-version-convention

467

# For a discussion of this in Redhat/Fedora/Centos:

468

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

469

"name": "A String", # The main part of the version name.

470

"revision": "A String", # The iteration of the package build from the above version.

471

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

472

# If kind is not NORMAL, then the other fields are ignored.

473

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

474

},

475

},

476

"derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis

477

# in the associated note.

478

# DockerImage relationship. This image would be produced from a Dockerfile

479

# with FROM <DockerImage.Basis in attached Note>.

480

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.

481

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

482

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

483

# Only the name of the final blob is kept.

484

# This field can be used as a filter in list requests.

485

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

486

"A String",

487

],

488

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

489

# representation.

490

# This field can be used as a filter in list requests.

491

},

492

"layerInfo": [ # This contains layer-specific metadata, if populated it has length

493

# "distance" and is ordered with [distance] being the layer immediately

494

# following the base image and [1] being the final layer.

495

{ # Layer holds metadata specific to a layer of a Docker image.

496

"arguments": "A String", # The recovered arguments to the Dockerfile directive.

497

"directive": "A String", # The recovered Dockerfile directive used to construct this layer.

498

},

499

],

500

"baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image

501

# occurrence.

502

"distance": 42, # Output only. The number of layers by which this image differs from the

503

# associated image basis.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

504

},

505

"resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`

506

# applies. For example, https://gcr.io/project/image@sha256:foo This field

507

# can be used as a filter in list requests.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

508

"remediation": "A String", # A description of actions that can be taken to remedy the `Note`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

509

"installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.

510

# a system.

511

"location": [ # All of the places within the filesystem versions of this package

512

# have been found.

513

{ # An occurrence of a particular package installation found within a

514

# system's filesystem.

515

# e.g. glibc was found in /var/lib/dpkg/status

516

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

517

# denoting the package manager version distributing a package.

518

"version": { # Version contains structured information about the version of the package. # The version installed at this location.

519

# For a discussion of this in Debian/Ubuntu:

520

# http://serverfault.com/questions/604541/debian-packages-version-convention

521

# For a discussion of this in Redhat/Fedora/Centos:

522

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

523

"name": "A String", # The main part of the version name.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

524

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

525

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

526

# If kind is not NORMAL, then the other fields are ignored.

527

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

528

},

529

"path": "A String", # The path from which we gathered that this package/version is installed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

530

},

531

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

532

"name": "A String", # Output only. The name of the installed package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

533

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

534

"noteName": "A String", # An analysis note associated with this image, in the form

535

# "providers/{provider_id}/notes/{NOTE_ID}"

536

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

537

"discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

538

"continuousAnalysis": "A String", # Whether the resource is continuously analyzed.

539

"cpe": "A String", # The CPE of the resource being scanned.

540

"analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under

541

# details to show to the user. The LocalizedMessage output only and

542

# populated by the API.

543

# different programming environments, including REST APIs and RPC APIs. It is

544

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

545

# three pieces of data: error code, error message, and error details.

546

#

547

# You can find out more about this error model and how to work with it in the

548

# [API Design Guide](https://cloud.google.com/apis/design/errors).

549

"message": "A String", # A developer-facing error message, which should be in English. Any

550

# user-facing error message should be localized and sent in the

551

# google.rpc.Status.details field, or localized by the client.

552

"details": [ # A list of messages that carry the error details. There is a common set of

553

# message types for APIs to use.

554

{

555

"a_key": "", # Properties of the object. Contains field @type with type URL.

556

},

557

],

558

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

559

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

560

"operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.

561

# This field is deprecated, do not use.

562

# network API call.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

563

"response": { # The normal response of the operation in case of success. If the original

564

# method returns no data on success, such as `Delete`, the response is

565

# `google.protobuf.Empty`. If the original method is standard

566

# `Get`/`Create`/`Update`, the response should be the resource. For other

567

# methods, the response should have the type `XxxResponse`, where `Xxx`

568

# is the original method name. For example, if the original method name

569

# is `TakeSnapshot()`, the inferred response type is

570

# `TakeSnapshotResponse`.

571

"a_key": "", # Properties of the object. Contains field @type with type URL.

572

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

573

"name": "A String", # The server-assigned name, which is only unique within the same service that

574

# originally returns it. If you use the default HTTP mapping, the

575

# `name` should be a resource name ending with `operations/{unique_id}`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

576

"metadata": { # Service-specific metadata associated with the operation. It typically

577

# contains progress information and common metadata such as create time.

578

# Some services might not provide such metadata. Any method that returns a

579

# long-running operation should document the metadata type, if any.

580

"a_key": "", # Properties of the object. Contains field @type with type URL.

581

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

582

"error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.

583

# different programming environments, including REST APIs and RPC APIs. It is

584

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

585

# three pieces of data: error code, error message, and error details.

586

#

587

# You can find out more about this error model and how to work with it in the

588

# [API Design Guide](https://cloud.google.com/apis/design/errors).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

589

"message": "A String", # A developer-facing error message, which should be in English. Any

590

# user-facing error message should be localized and sent in the

591

# google.rpc.Status.details field, or localized by the client.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

592

"details": [ # A list of messages that carry the error details. There is a common set of

593

# message types for APIs to use.

594

{

595

"a_key": "", # Properties of the object. Contains field @type with type URL.

596

},

597

],

598

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

599

},

600

"done": True or False, # If the value is `false`, it means the operation is still in progress.

601

# If `true`, the operation is completed, and either `error` or `response` is

602

# available.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

603

},

604

"analysisStatus": "A String", # The status of discovery for the resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

605

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

606

"createTime": "A String", # Output only. The time this `Occurrence` was created.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

607

"updateTime": "A String", # Output only. The time this `Occurrence` was last updated.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

608

}

609

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

610

name: string, The name of the project. Should be of the form "projects/{project_id}".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

611

@Deprecated

612

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

619

620

{ # `Occurrence` includes information about analysis occurrences for an image.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

621

"resource": { # #

622

# The resource for which the `Occurrence` applies.

623

# Resource is an entity that can have metadata. E.g., a Docker image.

624

"uri": "A String", # The unique URI of the resource. E.g.,

625

# "https://gcr.io/project/image@sha256:foo" for a Docker image.

626

"name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".

627

"contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.

628

"type": "A String", # The type of hash that was performed.

629

"value": "A String", # The hash value.

630

},

631

},

632

"vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.

633

# to fix it.

634

"packageIssue": [ # The set of affected locations and their fixes (if available) within

635

# the associated resource.

636

{ # This message wraps a location affected by a vulnerability and its

637

# associated fix (if one is available).

638

"affectedLocation": { # The location of the vulnerability # The location of the vulnerability.

639

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

640

# filter in list requests.

641

# For a discussion of this in Debian/Ubuntu:

642

# http://serverfault.com/questions/604541/debian-packages-version-convention

643

# For a discussion of this in Redhat/Fedora/Centos:

644

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

645

"name": "A String", # The main part of the version name.

646

"revision": "A String", # The iteration of the package build from the above version.

647

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

648

# If kind is not NORMAL, then the other fields are ignored.

649

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

650

},

651

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

652

# format. Examples include distro or storage location for vulnerable jar.

653

# This field can be used as a filter in list requests.

654

"package": "A String", # The package being described.

655

},

656

"fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.

657

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

658

# filter in list requests.

659

# For a discussion of this in Debian/Ubuntu:

660

# http://serverfault.com/questions/604541/debian-packages-version-convention

661

# For a discussion of this in Redhat/Fedora/Centos:

662

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

663

"name": "A String", # The main part of the version name.

664

"revision": "A String", # The iteration of the package build from the above version.

665

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

666

# If kind is not NORMAL, then the other fields are ignored.

667

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

668

},

669

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

670

# format. Examples include distro or storage location for vulnerable jar.

671

# This field can be used as a filter in list requests.

672

"package": "A String", # The package being described.

673

},

674

"severityName": "A String",

675

},

676

],

677

"effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is

678

# available and note provider assigned severity when distro has not yet

679

# assigned a severity for this vulnerability.

680

"type": "A String", # The type of package; whether native or non native(ruby gems,

681

# node.js packages etc)

682

"severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.

683

"cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a

684

# scale of 0-10 where 0 indicates low severity and 10 indicates high

685

# severity.

686

},

687

"attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.

688

# Attestation can be verified using the attached signature. If the verifier

689

# trusts the public key of the signer, then verifying the signature is

690

# sufficient to establish trust. In this circumstance, the

691

# AttestationAuthority to which this Attestation is attached is primarily

692

# useful for look-up (how to find this Attestation if you already know the

693

# Authority and artifact to be verified) and intent (which authority was this

694

# attestation intended to sign for).

695

"pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.

696

# This message only supports `ATTACHED` signatures, where the payload that is

697

# signed is included alongside the signature itself in the same file.

698

"pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,

699

# as output by, e.g. `gpg --list-keys`. This should be the version 4, full

700

# 160-bit fingerprint, expressed as a 40 character hexadecimal string. See

701

# https://tools.ietf.org/html/rfc4880#section-12.2 for details.

702

# Implementations may choose to acknowledge "LONG", "SHORT", or other

703

# abbreviated key IDs, but only the full fingerprint is guaranteed to work.

704

# In gpg, the full fingerprint can be retrieved from the `fpr` field

705

# returned when calling --list-keys with --with-colons. For example:

706

# ```

707

# gpg --with-colons --with-fingerprint --force-v4-certs \

708

# --list-keys attester@example.com

709

# tru::1:1513631572:0:3:1:5

710

# pub:...<SNIP>...

711

# fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:

712

# ```

713

# Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.

714

"signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or

715

# equivalent. Since this message only supports attached signatures, the

716

# payload that was signed must be attached. While the signature format

717

# supported is dependent on the verification implementation, currently only

718

# ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than

719

# `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor

720

# --output=signature.gpg payload.json` will create the signature content

721

# expected in this field in `signature.gpg` for the `payload.json`

722

# attestation payload.

723

"contentType": "A String", # Type (for example schema) of the attestation payload that was signed.

724

# The verifier must ensure that the provided type is one that the verifier

725

# supports, and that the attestation payload is a valid instantiation of that

726

# type (for example by validating a JSON schema).

727

},

728

},

729

"kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are

730

# specified. This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

731

"buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

732

"provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance

733

# details about the build from source to completion.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

734

"sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

735

"context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.

736

# with a path point to a unique revision of a single file or directory.

737

"labels": { # Labels with user defined metadata.

738

"a_key": "A String",

739

},

740

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

741

# repository (e.g., GitHub).

742

"url": "A String", # Git repository URL.

743

"revisionId": "A String", # Required. Git commit hash.

744

},

745

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

746

# Source Repo.

747

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

748

"kind": "A String", # The alias kind.

749

"name": "A String", # The alias name.

750

},

751

"revisionId": "A String", # A revision ID.

752

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

753

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

754

# winged-cargo-31) and a repo name within that project.

755

"projectId": "A String", # The ID of the project.

756

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

757

},

758

"uid": "A String", # A server-assigned, globally unique identifier.

759

},

760

},

761

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

762

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

763

# "project/subproject" is a valid project name. The "repo name" is

764

# the hostURI/project.

765

"hostUri": "A String", # The URI of a running Gerrit instance.

766

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

767

"kind": "A String", # The alias kind.

768

"name": "A String", # The alias name.

769

},

770

"revisionId": "A String", # A revision (commit) ID.

771

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

772

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

773

"additionalContexts": [ # If provided, some of the source code used for the build may be found in

774

# these locations, in the case where the source repository had multiple

775

# remotes or submodules. This list will not include the context specified in

776

# the context field.

777

{ # A SourceContext is a reference to a tree of files. A SourceContext together

778

# with a path point to a unique revision of a single file or directory.

779

"labels": { # Labels with user defined metadata.

780

"a_key": "A String",

781

},

782

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

783

# repository (e.g., GitHub).

784

"url": "A String", # Git repository URL.

785

"revisionId": "A String", # Required. Git commit hash.

786

},

787

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

788

# Source Repo.

789

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

790

"kind": "A String", # The alias kind.

791

"name": "A String", # The alias name.

792

},

793

"revisionId": "A String", # A revision ID.

794

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

795

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

796

# winged-cargo-31) and a repo name within that project.

797

"projectId": "A String", # The ID of the project.

798

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

799

},

800

"uid": "A String", # A server-assigned, globally unique identifier.

801

},

802

},

803

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

804

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

805

# "project/subproject" is a valid project name. The "repo name" is

806

# the hostURI/project.

807

"hostUri": "A String", # The URI of a running Gerrit instance.

808

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

809

"kind": "A String", # The alias kind.

810

"name": "A String", # The alias name.

811

},

812

"revisionId": "A String", # A revision (commit) ID.

},

},

],

"artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this

817

# location.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

818

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

819

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

820

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

821

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

822

# Requirements]

823

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

824

},

825

"repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.

826

# Repository.

827

"tagName": "A String", # Name of the tag to build.

828

"branchName": "A String", # Name of the branch to build.

829

"projectId": "A String", # ID of the project that owns the repo.

830

"repoName": "A String", # Name of the repo.

831

"commitSha": "A String", # Explicit commit SHA to build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

832

},

833

"fileHashes": { # Hash(es) of the build source, which can be used to verify that the original

834

# source integrity was maintained in the build.

835

#

836

# The keys to this map are file paths used as build source and the values

837

# contain the hash values for those files.

838

#

839

# If the build source came in a single package such as a gzipped tarfile

840

# (.tar.gz), the FileHash will be for the single path to that file.

841

"a_key": { # Container message for hashes of byte content of files, used in Source

842

# messages to verify integrity of source input to the build.

843

"fileHash": [ # Collection of file hashes.

844

{ # Container message for hash values.

845

"type": "A String", # The type of hash that was performed.

846

"value": "A String", # The hash value.

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

851

"storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud

852

# Storage.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

853

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

854

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

855

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

856

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

857

# Requirements]

858

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

859

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

860

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

861

"builtArtifacts": [ # Output of the build.

862

{ # Artifact describes a build product.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

863

"name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in

864

# the case of a container build, the name used to push the container image to

865

# Google Container Registry, as presented to `docker push`.

866

#

867

# This field is deprecated in favor of the plural `names` field; it continues

868

# to exist here to allow existing BuildProvenance serialized to json in

869

# google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to

870

# deserialize back into proto.

871

"checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a

872

# container.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

873

"names": [ # Related artifact names. This may be the path to a binary or jar file, or in

874

# the case of a container build, the name used to push the container image to

875

# Google Container Registry, as presented to `docker push`. Note that a

876

# single Artifact ID can have multiple names, for example if two tags are

877

# applied to one image.

878

"A String",

879

],

880

"id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest

881

# like gcr.io/projectID/imagename@sha256:123456

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

882

},

883

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

884

"id": "A String", # Unique identifier of the build.

885

"createTime": "A String", # Time at which the build was created.

886

"buildOptions": { # Special options applied to this build. This is a catch-all field where

887

# build providers can enter any desired additional details.

888

"a_key": "A String",

889

},

890

"logsBucket": "A String", # Google Cloud Storage bucket where logs were written.

891

"finishTime": "A String", # Time at which execution of the build was finished.

892

"creator": "A String", # E-mail address of the user who initiated this build. Note that this was the

893

# user's e-mail address at the time the build was initiated; this address may

894

# not represent the same end-user for all time.

895

"projectId": "A String", # ID of the project.

896

"startTime": "A String", # Time at which execution of the build was started.

897

"commands": [ # Commands requested by the build.

898

{ # Command describes a step performed as part of the build pipeline.

899

"dir": "A String", # Working directory (relative to project source root) used when running

900

# this Command.

901

"env": [ # Environment variables set before running this Command.

902

"A String",

903

],

904

"args": [ # Command-line arguments used when executing this Command.

905

"A String",

906

],

907

"id": "A String", # Optional unique identifier for this Command, used in wait_for to reference

908

# this Command as a dependency.

909

"name": "A String", # Name of the command, as presented on the command line, or if the command is

910

# packaged as a Docker container, as presented to `docker pull`.

911

"waitFor": [ # The ID(s) of the Command(s) that this Command depends on.

"A String",

],

},

],

"triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.

917

"builderVersion": "A String", # Version string of the builder at the time this build was executed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

918

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

919

"provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the

920

# `BuildSignature` in the corresponding Result. After verifying the

921

# signature, `provenance_bytes` can be unmarshalled and compared to the

922

# provenance to confirm that it is unchanged. A base64-encoded string

923

# representation of the provenance bytes is used for the signature in order

924

# to interoperate with openssl which expects this format for signature

925

# verification.

926

#

927

# The serialized form is captured both to avoid ambiguity in how the

928

# provenance is marshalled to json as well to prevent incompatibilities with

929

# future changes.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

930

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

931

"name": "A String", # Output only. The name of the `Occurrence` in the form

932

# "projects/{project_id}/occurrences/{OCCURRENCE_ID}"

933

"deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.

934

"undeployTime": "A String", # End of the lifetime of this deployment.

935

"address": "A String", # Address of the runtime element hosting this deployment.

936

"platform": "A String", # Platform hosting this deployment.

937

"config": "A String", # Configuration used to create this deployment.

938

"deployTime": "A String", # Beginning of the lifetime of this deployment.

939

"resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the

940

# deployable field with the same name.

941

"A String",

942

],

943

"userEmail": "A String", # Identity of the user that triggered this deployment.

944

},

945

"upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.

946

# specific upgrade. This presence is supplied via local sources (i.e. it is

947

# present in the mirror and the running system has noticed its availability).

948

"package": "A String", # Required - The package this Upgrade is for.

949

"distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system

950

# for the resource_url. This allows efficient filtering, as well as

951

# making it easier to use the occurrence.

952

# operating system (CPE). Some distributions have additional metadata around

953

# updates, classifying them into various categories and severities.

954

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

955

# upstream operating system upgrade feed.

956

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

957

# https://cpe.mitre.org/specification/.

958

"severity": "A String", # The severity as specified by the upstream operating system.

959

"cve": [ # The cve that would be resolved by this upgrade.

960

"A String",

961

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

962

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

963

"parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.

964

# For a discussion of this in Debian/Ubuntu:

965

# http://serverfault.com/questions/604541/debian-packages-version-convention

966

# For a discussion of this in Redhat/Fedora/Centos:

967

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

968

"name": "A String", # The main part of the version name.

969

"revision": "A String", # The iteration of the package build from the above version.

970

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

971

# If kind is not NORMAL, then the other fields are ignored.

972

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

973

},

974

},

975

"derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis

976

# in the associated note.

977

# DockerImage relationship. This image would be produced from a Dockerfile

978

# with FROM <DockerImage.Basis in attached Note>.

979

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.

980

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

981

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

982

# Only the name of the final blob is kept.

983

# This field can be used as a filter in list requests.

984

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

985

"A String",

986

],

987

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

988

# representation.

989

# This field can be used as a filter in list requests.

990

},

991

"layerInfo": [ # This contains layer-specific metadata, if populated it has length

992

# "distance" and is ordered with [distance] being the layer immediately

993

# following the base image and [1] being the final layer.

994

{ # Layer holds metadata specific to a layer of a Docker image.

995

"arguments": "A String", # The recovered arguments to the Dockerfile directive.

996

"directive": "A String", # The recovered Dockerfile directive used to construct this layer.

997

},

998

],

999

"baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image

1000

# occurrence.

1001

"distance": 42, # Output only. The number of layers by which this image differs from the

1002

# associated image basis.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1003

},

1004

"resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`

1005

# applies. For example, https://gcr.io/project/image@sha256:foo This field

1006

# can be used as a filter in list requests.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1007

"remediation": "A String", # A description of actions that can be taken to remedy the `Note`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1008

"installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.

1009

# a system.

1010

"location": [ # All of the places within the filesystem versions of this package

1011

# have been found.

1012

{ # An occurrence of a particular package installation found within a

1013

# system's filesystem.

1014

# e.g. glibc was found in /var/lib/dpkg/status

1015

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

1016

# denoting the package manager version distributing a package.

1017

"version": { # Version contains structured information about the version of the package. # The version installed at this location.

1018

# For a discussion of this in Debian/Ubuntu:

1019

# http://serverfault.com/questions/604541/debian-packages-version-convention

1020

# For a discussion of this in Redhat/Fedora/Centos:

1021

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1022

"name": "A String", # The main part of the version name.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1023

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1024

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1025

# If kind is not NORMAL, then the other fields are ignored.

1026

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1027

},

1028

"path": "A String", # The path from which we gathered that this package/version is installed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1029

},

1030

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1031

"name": "A String", # Output only. The name of the installed package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1032

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1033

"noteName": "A String", # An analysis note associated with this image, in the form

1034

# "providers/{provider_id}/notes/{NOTE_ID}"

1035

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1036

"discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1037

"continuousAnalysis": "A String", # Whether the resource is continuously analyzed.

1038

"cpe": "A String", # The CPE of the resource being scanned.

1039

"analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under

1040

# details to show to the user. The LocalizedMessage output only and

1041

# populated by the API.

1042

# different programming environments, including REST APIs and RPC APIs. It is

1043

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

1044

# three pieces of data: error code, error message, and error details.

1045

#

1046

# You can find out more about this error model and how to work with it in the

1047

# [API Design Guide](https://cloud.google.com/apis/design/errors).

1048

"message": "A String", # A developer-facing error message, which should be in English. Any

1049

# user-facing error message should be localized and sent in the

1050

# google.rpc.Status.details field, or localized by the client.

1051

"details": [ # A list of messages that carry the error details. There is a common set of

1052

# message types for APIs to use.

1053

{

1054

"a_key": "", # Properties of the object. Contains field @type with type URL.

1055

},

1056

],

1057

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

1058

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1059

"operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.

1060

# This field is deprecated, do not use.

1061

# network API call.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1062

"response": { # The normal response of the operation in case of success. If the original

1063

# method returns no data on success, such as `Delete`, the response is

1064

# `google.protobuf.Empty`. If the original method is standard

1065

# `Get`/`Create`/`Update`, the response should be the resource. For other

1066

# methods, the response should have the type `XxxResponse`, where `Xxx`

1067

# is the original method name. For example, if the original method name

1068

# is `TakeSnapshot()`, the inferred response type is

1069

# `TakeSnapshotResponse`.

1070

"a_key": "", # Properties of the object. Contains field @type with type URL.

1071

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1072

"name": "A String", # The server-assigned name, which is only unique within the same service that

1073

# originally returns it. If you use the default HTTP mapping, the

1074

# `name` should be a resource name ending with `operations/{unique_id}`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1075

"metadata": { # Service-specific metadata associated with the operation. It typically

1076

# contains progress information and common metadata such as create time.

1077

# Some services might not provide such metadata. Any method that returns a

1078

# long-running operation should document the metadata type, if any.

1079

"a_key": "", # Properties of the object. Contains field @type with type URL.

1080

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1081

"error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.

1082

# different programming environments, including REST APIs and RPC APIs. It is

1083

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

1084

# three pieces of data: error code, error message, and error details.

1085

#

1086

# You can find out more about this error model and how to work with it in the

1087

# [API Design Guide](https://cloud.google.com/apis/design/errors).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1088

"message": "A String", # A developer-facing error message, which should be in English. Any

1089

# user-facing error message should be localized and sent in the

1090

# google.rpc.Status.details field, or localized by the client.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1091

"details": [ # A list of messages that carry the error details. There is a common set of

1092

# message types for APIs to use.

1093

{

1094

"a_key": "", # Properties of the object. Contains field @type with type URL.

1095

},

1096

],

1097

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1098

},

1099

"done": True or False, # If the value is `false`, it means the operation is still in progress.

1100

# If `true`, the operation is completed, and either `error` or `response` is

1101

# available.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1102

},

1103

"analysisStatus": "A String", # The status of discovery for the resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1104

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1105

"createTime": "A String", # Output only. The time this `Occurrence` was created.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1106

"updateTime": "A String", # Output only. The time this `Occurrence` was last updated.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="delete">delete(name, x__xgafv=None)</code>

1112

<pre>Deletes the given `Occurrence` from the system. Use this when

1113

an `Occurrence` is no longer applicable for the given resource.

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1117

"projects/{project_id}/occurrences/{OCCURRENCE_ID}" (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1118

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1125

1126

{ # A generic empty message that you can re-use to avoid defining duplicated

1127

# empty messages in your APIs. A typical example is to use it as the request

1128

# or the response type of an API method. For instance:

1129

#

1130

# service Foo {

1131

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

1132

# }

1133

#

1134

# The JSON representation for `Empty` is empty JSON object `{}`.

}</pre>

</div>

<code class="details" id="get">get(name, x__xgafv=None)</code>

1140

<pre>Returns the requested `Occurrence`.

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1144

"projects/{project_id}/occurrences/{OCCURRENCE_ID}" (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1145

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1152

1153

{ # `Occurrence` includes information about analysis occurrences for an image.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1154

"resource": { # #

1155

# The resource for which the `Occurrence` applies.

1156

# Resource is an entity that can have metadata. E.g., a Docker image.

1157

"uri": "A String", # The unique URI of the resource. E.g.,

1158

# "https://gcr.io/project/image@sha256:foo" for a Docker image.

1159

"name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".

1160

"contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.

1161

"type": "A String", # The type of hash that was performed.

1162

"value": "A String", # The hash value.

1163

},

1164

},

1165

"vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.

1166

# to fix it.

1167

"packageIssue": [ # The set of affected locations and their fixes (if available) within

1168

# the associated resource.

1169

{ # This message wraps a location affected by a vulnerability and its

1170

# associated fix (if one is available).

1171

"affectedLocation": { # The location of the vulnerability # The location of the vulnerability.

1172

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

1173

# filter in list requests.

1174

# For a discussion of this in Debian/Ubuntu:

1175

# http://serverfault.com/questions/604541/debian-packages-version-convention

1176

# For a discussion of this in Redhat/Fedora/Centos:

1177

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1178

"name": "A String", # The main part of the version name.

1179

"revision": "A String", # The iteration of the package build from the above version.

1180

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1181

# If kind is not NORMAL, then the other fields are ignored.

1182

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1183

},

1184

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

1185

# format. Examples include distro or storage location for vulnerable jar.

1186

# This field can be used as a filter in list requests.

1187

"package": "A String", # The package being described.

1188

},

1189

"fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.

1190

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

1191

# filter in list requests.

1192

# For a discussion of this in Debian/Ubuntu:

1193

# http://serverfault.com/questions/604541/debian-packages-version-convention

1194

# For a discussion of this in Redhat/Fedora/Centos:

1195

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1196

"name": "A String", # The main part of the version name.

1197

"revision": "A String", # The iteration of the package build from the above version.

1198

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1199

# If kind is not NORMAL, then the other fields are ignored.

1200

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1201

},

1202

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

1203

# format. Examples include distro or storage location for vulnerable jar.

1204

# This field can be used as a filter in list requests.

1205

"package": "A String", # The package being described.

1206

},

1207

"severityName": "A String",

1208

},

1209

],

1210

"effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is

1211

# available and note provider assigned severity when distro has not yet

1212

# assigned a severity for this vulnerability.

1213

"type": "A String", # The type of package; whether native or non native(ruby gems,

1214

# node.js packages etc)

1215

"severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.

1216

"cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a

1217

# scale of 0-10 where 0 indicates low severity and 10 indicates high

1218

# severity.

1219

},

1220

"attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.

1221

# Attestation can be verified using the attached signature. If the verifier

1222

# trusts the public key of the signer, then verifying the signature is

1223

# sufficient to establish trust. In this circumstance, the

1224

# AttestationAuthority to which this Attestation is attached is primarily

1225

# useful for look-up (how to find this Attestation if you already know the

1226

# Authority and artifact to be verified) and intent (which authority was this

1227

# attestation intended to sign for).

1228

"pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.

1229

# This message only supports `ATTACHED` signatures, where the payload that is

1230

# signed is included alongside the signature itself in the same file.

1231

"pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,

1232

# as output by, e.g. `gpg --list-keys`. This should be the version 4, full

1233

# 160-bit fingerprint, expressed as a 40 character hexadecimal string. See

1234

# https://tools.ietf.org/html/rfc4880#section-12.2 for details.

1235

# Implementations may choose to acknowledge "LONG", "SHORT", or other

1236

# abbreviated key IDs, but only the full fingerprint is guaranteed to work.

1237

# In gpg, the full fingerprint can be retrieved from the `fpr` field

1238

# returned when calling --list-keys with --with-colons. For example:

1239

# ```

1240

# gpg --with-colons --with-fingerprint --force-v4-certs \

1241

# --list-keys attester@example.com

1242

# tru::1:1513631572:0:3:1:5

1243

# pub:...<SNIP>...

1244

# fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:

1245

# ```

1246

# Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.

1247

"signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or

1248

# equivalent. Since this message only supports attached signatures, the

1249

# payload that was signed must be attached. While the signature format

1250

# supported is dependent on the verification implementation, currently only

1251

# ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than

1252

# `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor

1253

# --output=signature.gpg payload.json` will create the signature content

1254

# expected in this field in `signature.gpg` for the `payload.json`

1255

# attestation payload.

1256

"contentType": "A String", # Type (for example schema) of the attestation payload that was signed.

1257

# The verifier must ensure that the provided type is one that the verifier

1258

# supports, and that the attestation payload is a valid instantiation of that

1259

# type (for example by validating a JSON schema).

1260

},

1261

},

1262

"kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are

1263

# specified. This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1264

"buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1265

"provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance

1266

# details about the build from source to completion.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1267

"sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1268

"context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.

1269

# with a path point to a unique revision of a single file or directory.

1270

"labels": { # Labels with user defined metadata.

1271

"a_key": "A String",

1272

},

1273

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

1274

# repository (e.g., GitHub).

1275

"url": "A String", # Git repository URL.

1276

"revisionId": "A String", # Required. Git commit hash.

1277

},

1278

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

1279

# Source Repo.

1280

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

1281

"kind": "A String", # The alias kind.

1282

"name": "A String", # The alias name.

1283

},

1284

"revisionId": "A String", # A revision ID.

1285

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

1286

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

1287

# winged-cargo-31) and a repo name within that project.

1288

"projectId": "A String", # The ID of the project.

1289

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

1290

},

1291

"uid": "A String", # A server-assigned, globally unique identifier.

1292

},

1293

},

1294

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

1295

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

1296

# "project/subproject" is a valid project name. The "repo name" is

1297

# the hostURI/project.

1298

"hostUri": "A String", # The URI of a running Gerrit instance.

1299

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

1300

"kind": "A String", # The alias kind.

1301

"name": "A String", # The alias name.

1302

},

1303

"revisionId": "A String", # A revision (commit) ID.

1304

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1305

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1306

"additionalContexts": [ # If provided, some of the source code used for the build may be found in

1307

# these locations, in the case where the source repository had multiple

1308

# remotes or submodules. This list will not include the context specified in

1309

# the context field.

1310

{ # A SourceContext is a reference to a tree of files. A SourceContext together

1311

# with a path point to a unique revision of a single file or directory.

1312

"labels": { # Labels with user defined metadata.

1313

"a_key": "A String",

1314

},

1315

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

1316

# repository (e.g., GitHub).

1317

"url": "A String", # Git repository URL.

1318

"revisionId": "A String", # Required. Git commit hash.

1319

},

1320

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

1321

# Source Repo.

1322

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

1323

"kind": "A String", # The alias kind.

1324

"name": "A String", # The alias name.

1325

},

1326

"revisionId": "A String", # A revision ID.

1327

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

1328

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

1329

# winged-cargo-31) and a repo name within that project.

1330

"projectId": "A String", # The ID of the project.

1331

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

1332

},

1333

"uid": "A String", # A server-assigned, globally unique identifier.

1334

},

1335

},

1336

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

1337

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

1338

# "project/subproject" is a valid project name. The "repo name" is

1339

# the hostURI/project.

1340

"hostUri": "A String", # The URI of a running Gerrit instance.

1341

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

1342

"kind": "A String", # The alias kind.

1343

"name": "A String", # The alias name.

1344

},

1345

"revisionId": "A String", # A revision (commit) ID.

},

},

],

"artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this

1350

# location.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1351

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1352

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1353

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1354

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

1355

# Requirements]

1356

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1357

},

1358

"repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.

1359

# Repository.

1360

"tagName": "A String", # Name of the tag to build.

1361

"branchName": "A String", # Name of the branch to build.

1362

"projectId": "A String", # ID of the project that owns the repo.

1363

"repoName": "A String", # Name of the repo.

1364

"commitSha": "A String", # Explicit commit SHA to build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1365

},

1366

"fileHashes": { # Hash(es) of the build source, which can be used to verify that the original

1367

# source integrity was maintained in the build.

1368

#

1369

# The keys to this map are file paths used as build source and the values

1370

# contain the hash values for those files.

1371

#

1372

# If the build source came in a single package such as a gzipped tarfile

1373

# (.tar.gz), the FileHash will be for the single path to that file.

1374

"a_key": { # Container message for hashes of byte content of files, used in Source

1375

# messages to verify integrity of source input to the build.

1376

"fileHash": [ # Collection of file hashes.

1377

{ # Container message for hash values.

1378

"type": "A String", # The type of hash that was performed.

1379

"value": "A String", # The hash value.

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1384

"storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud

1385

# Storage.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1386

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1387

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1388

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1389

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

1390

# Requirements]

1391

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1392

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1393

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1394

"builtArtifacts": [ # Output of the build.

1395

{ # Artifact describes a build product.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1396

"name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in

1397

# the case of a container build, the name used to push the container image to

1398

# Google Container Registry, as presented to `docker push`.

1399

#

1400

# This field is deprecated in favor of the plural `names` field; it continues

1401

# to exist here to allow existing BuildProvenance serialized to json in

1402

# google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to

1403

# deserialize back into proto.

1404

"checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a

1405

# container.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1406

"names": [ # Related artifact names. This may be the path to a binary or jar file, or in

1407

# the case of a container build, the name used to push the container image to

1408

# Google Container Registry, as presented to `docker push`. Note that a

1409

# single Artifact ID can have multiple names, for example if two tags are

1410

# applied to one image.

1411

"A String",

1412

],

1413

"id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest

1414

# like gcr.io/projectID/imagename@sha256:123456

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1415

},

1416

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1417

"id": "A String", # Unique identifier of the build.

1418

"createTime": "A String", # Time at which the build was created.

1419

"buildOptions": { # Special options applied to this build. This is a catch-all field where

1420

# build providers can enter any desired additional details.

1421

"a_key": "A String",

1422

},

1423

"logsBucket": "A String", # Google Cloud Storage bucket where logs were written.

1424

"finishTime": "A String", # Time at which execution of the build was finished.

1425

"creator": "A String", # E-mail address of the user who initiated this build. Note that this was the

1426

# user's e-mail address at the time the build was initiated; this address may

1427

# not represent the same end-user for all time.

1428

"projectId": "A String", # ID of the project.

1429

"startTime": "A String", # Time at which execution of the build was started.

1430

"commands": [ # Commands requested by the build.

1431

{ # Command describes a step performed as part of the build pipeline.

1432

"dir": "A String", # Working directory (relative to project source root) used when running

1433

# this Command.

1434

"env": [ # Environment variables set before running this Command.

1435

"A String",

1436

],

1437

"args": [ # Command-line arguments used when executing this Command.

1438

"A String",

1439

],

1440

"id": "A String", # Optional unique identifier for this Command, used in wait_for to reference

1441

# this Command as a dependency.

1442

"name": "A String", # Name of the command, as presented on the command line, or if the command is

1443

# packaged as a Docker container, as presented to `docker pull`.

1444

"waitFor": [ # The ID(s) of the Command(s) that this Command depends on.

"A String",

],

},

],

"triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.

1450

"builderVersion": "A String", # Version string of the builder at the time this build was executed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1451

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1452

"provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the

1453

# `BuildSignature` in the corresponding Result. After verifying the

1454

# signature, `provenance_bytes` can be unmarshalled and compared to the

1455

# provenance to confirm that it is unchanged. A base64-encoded string

1456

# representation of the provenance bytes is used for the signature in order

1457

# to interoperate with openssl which expects this format for signature

1458

# verification.

1459

#

1460

# The serialized form is captured both to avoid ambiguity in how the

1461

# provenance is marshalled to json as well to prevent incompatibilities with

1462

# future changes.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1463

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1464

"name": "A String", # Output only. The name of the `Occurrence` in the form

1465

# "projects/{project_id}/occurrences/{OCCURRENCE_ID}"

1466

"deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.

1467

"undeployTime": "A String", # End of the lifetime of this deployment.

1468

"address": "A String", # Address of the runtime element hosting this deployment.

1469

"platform": "A String", # Platform hosting this deployment.

1470

"config": "A String", # Configuration used to create this deployment.

1471

"deployTime": "A String", # Beginning of the lifetime of this deployment.

1472

"resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the

1473

# deployable field with the same name.

1474

"A String",

1475

],

1476

"userEmail": "A String", # Identity of the user that triggered this deployment.

1477

},

1478

"upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.

1479

# specific upgrade. This presence is supplied via local sources (i.e. it is

1480

# present in the mirror and the running system has noticed its availability).

1481

"package": "A String", # Required - The package this Upgrade is for.

1482

"distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system

1483

# for the resource_url. This allows efficient filtering, as well as

1484

# making it easier to use the occurrence.

1485

# operating system (CPE). Some distributions have additional metadata around

1486

# updates, classifying them into various categories and severities.

1487

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

1488

# upstream operating system upgrade feed.

1489

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

1490

# https://cpe.mitre.org/specification/.

1491

"severity": "A String", # The severity as specified by the upstream operating system.

1492

"cve": [ # The cve that would be resolved by this upgrade.

1493

"A String",

1494

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1495

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1496

"parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.

1497

# For a discussion of this in Debian/Ubuntu:

1498

# http://serverfault.com/questions/604541/debian-packages-version-convention

1499

# For a discussion of this in Redhat/Fedora/Centos:

1500

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1501

"name": "A String", # The main part of the version name.

1502

"revision": "A String", # The iteration of the package build from the above version.

1503

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1504

# If kind is not NORMAL, then the other fields are ignored.

1505

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1506

},

1507

},

1508

"derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis

1509

# in the associated note.

1510

# DockerImage relationship. This image would be produced from a Dockerfile

1511

# with FROM <DockerImage.Basis in attached Note>.

1512

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.

1513

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

1514

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

1515

# Only the name of the final blob is kept.

1516

# This field can be used as a filter in list requests.

1517

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

1518

"A String",

1519

],

1520

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

1521

# representation.

1522

# This field can be used as a filter in list requests.

1523

},

1524

"layerInfo": [ # This contains layer-specific metadata, if populated it has length

1525

# "distance" and is ordered with [distance] being the layer immediately

1526

# following the base image and [1] being the final layer.

1527

{ # Layer holds metadata specific to a layer of a Docker image.

1528

"arguments": "A String", # The recovered arguments to the Dockerfile directive.

1529

"directive": "A String", # The recovered Dockerfile directive used to construct this layer.

1530

},

1531

],

1532

"baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image

1533

# occurrence.

1534

"distance": 42, # Output only. The number of layers by which this image differs from the

1535

# associated image basis.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1536

},

1537

"resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`

1538

# applies. For example, https://gcr.io/project/image@sha256:foo This field

1539

# can be used as a filter in list requests.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1540

"remediation": "A String", # A description of actions that can be taken to remedy the `Note`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1541

"installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.

1542

# a system.

1543

"location": [ # All of the places within the filesystem versions of this package

1544

# have been found.

1545

{ # An occurrence of a particular package installation found within a

1546

# system's filesystem.

1547

# e.g. glibc was found in /var/lib/dpkg/status

1548

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

1549

# denoting the package manager version distributing a package.

1550

"version": { # Version contains structured information about the version of the package. # The version installed at this location.

1551

# For a discussion of this in Debian/Ubuntu:

1552

# http://serverfault.com/questions/604541/debian-packages-version-convention

1553

# For a discussion of this in Redhat/Fedora/Centos:

1554

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1555

"name": "A String", # The main part of the version name.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1556

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1557

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1558

# If kind is not NORMAL, then the other fields are ignored.

1559

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1560

},

1561

"path": "A String", # The path from which we gathered that this package/version is installed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1562

},

1563

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1564

"name": "A String", # Output only. The name of the installed package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1565

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1566

"noteName": "A String", # An analysis note associated with this image, in the form

1567

# "providers/{provider_id}/notes/{NOTE_ID}"

1568

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1569

"discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1570

"continuousAnalysis": "A String", # Whether the resource is continuously analyzed.

1571

"cpe": "A String", # The CPE of the resource being scanned.

1572

"analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under

1573

# details to show to the user. The LocalizedMessage output only and

1574

# populated by the API.

1575

# different programming environments, including REST APIs and RPC APIs. It is

1576

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

1577

# three pieces of data: error code, error message, and error details.

1578

#

1579

# You can find out more about this error model and how to work with it in the

1580

# [API Design Guide](https://cloud.google.com/apis/design/errors).

1581

"message": "A String", # A developer-facing error message, which should be in English. Any

1582

# user-facing error message should be localized and sent in the

1583

# google.rpc.Status.details field, or localized by the client.

1584

"details": [ # A list of messages that carry the error details. There is a common set of

1585

# message types for APIs to use.

1586

{

1587

"a_key": "", # Properties of the object. Contains field @type with type URL.

1588

},

1589

],

1590

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

1591

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1592

"operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.

1593

# This field is deprecated, do not use.

1594

# network API call.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1595

"response": { # The normal response of the operation in case of success. If the original

1596

# method returns no data on success, such as `Delete`, the response is

1597

# `google.protobuf.Empty`. If the original method is standard

1598

# `Get`/`Create`/`Update`, the response should be the resource. For other

1599

# methods, the response should have the type `XxxResponse`, where `Xxx`

1600

# is the original method name. For example, if the original method name

1601

# is `TakeSnapshot()`, the inferred response type is

1602

# `TakeSnapshotResponse`.

1603

"a_key": "", # Properties of the object. Contains field @type with type URL.

1604

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1605

"name": "A String", # The server-assigned name, which is only unique within the same service that

1606

# originally returns it. If you use the default HTTP mapping, the

1607

# `name` should be a resource name ending with `operations/{unique_id}`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1608

"metadata": { # Service-specific metadata associated with the operation. It typically

1609

# contains progress information and common metadata such as create time.

1610

# Some services might not provide such metadata. Any method that returns a

1611

# long-running operation should document the metadata type, if any.

1612

"a_key": "", # Properties of the object. Contains field @type with type URL.

1613

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1614

"error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.

1615

# different programming environments, including REST APIs and RPC APIs. It is

1616

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

1617

# three pieces of data: error code, error message, and error details.

1618

#

1619

# You can find out more about this error model and how to work with it in the

1620

# [API Design Guide](https://cloud.google.com/apis/design/errors).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1621

"message": "A String", # A developer-facing error message, which should be in English. Any

1622

# user-facing error message should be localized and sent in the

1623

# google.rpc.Status.details field, or localized by the client.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1624

"details": [ # A list of messages that carry the error details. There is a common set of

1625

# message types for APIs to use.

1626

{

1627

"a_key": "", # Properties of the object. Contains field @type with type URL.

1628

},

1629

],

1630

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1631

},

1632

"done": True or False, # If the value is `false`, it means the operation is still in progress.

1633

# If `true`, the operation is completed, and either `error` or `response` is

1634

# available.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1635

},

1636

"analysisStatus": "A String", # The status of discovery for the resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1637

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1638

"createTime": "A String", # Output only. The time this `Occurrence` was created.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1639

"updateTime": "A String", # Output only. The time this `Occurrence` was last updated.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>

1645

<pre>Gets the access control policy for a note or an `Occurrence` resource.

1646

Requires `containeranalysis.notes.setIamPolicy` or

1647

`containeranalysis.occurrences.setIamPolicy` permission if the resource is

1648

a note or occurrence, respectively.

1649

Attempting to call this method on a resource without the required

1650

permission will result in a `PERMISSION_DENIED` error. Attempting to call

1651

this method on a non-existent resource will result in a `NOT_FOUND` error

1652

if the user has list permission on the project, or a `PERMISSION_DENIED`

1653

error otherwise. The resource takes the following formats:

1654

`projects/{PROJECT_ID}/occurrences/{OCCURRENCE_ID}` for occurrences and

1655

projects/{PROJECT_ID}/notes/{NOTE_ID} for notes

1656

1657

Args:

1658

resource: string, REQUIRED: The resource for which the policy is being requested.

1659

See the operation documentation for the appropriate value for this field. (required)

1660

body: object, The request body.

1661

The object takes the form of:

1662

1663

{ # Request message for `GetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1664

"options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1665

# `GetIamPolicy`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1666

"requestedPolicyVersion": 42, # Optional. The policy format version to be returned.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1667

#

1668

# Valid values are 0, 1, and 3. Requests specifying an invalid value will be

1669

# rejected.

1670

#

1671

# Requests for policies with any conditional bindings must specify version 3.

1672

# Policies without any conditional bindings may specify any valid value or

1673

# leave the field unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1674

#

1675

# To learn which resources support conditions in their IAM policies, see the

1676

# [IAM

1677

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1678

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1679

}

1680

1681

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1688

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1689

{ # An Identity and Access Management (IAM) policy, which specifies access

1690

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1691

#

1692

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1693

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1694

# `members` to a single `role`. Members can be user accounts, service accounts,

1695

# Google groups, and domains (such as G Suite). A `role` is a named list of

1696

# permissions; each `role` can be an IAM predefined role or a user-created

1697

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1698

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1699

# For some types of Google Cloud resources, a `binding` can also specify a

1700

# `condition`, which is a logical expression that allows access to a resource

1701

# only if the expression evaluates to `true`. A condition can add constraints

1702

# based on attributes of the request, the resource, or both. To learn which

1703

# resources support conditions in their IAM policies, see the

1704

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1705

#

1706

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1707

#

1708

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1709

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1710

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1711

# "role": "roles/resourcemanager.organizationAdmin",

1712

# "members": [

1713

# "user:mike@example.com",

1714

# "group:admins@example.com",

1715

# "domain:google.com",

1716

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1717

# ]

1718

# },

1719

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1720

# "role": "roles/resourcemanager.organizationViewer",

1721

# "members": [

1722

# "user:eve@example.com"

1723

# ],

1724

# "condition": {

1725

# "title": "expirable access",

1726

# "description": "Does not grant access after Sep 2020",

1727

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1728

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1729

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1730

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1731

# "etag": "BwWWja0YfJA=",

1732

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1733

# }

1734

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1735

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1740

# - group:admins@example.com

1741

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1742

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1743

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1744

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1745

# - user:eve@example.com

1746

# role: roles/resourcemanager.organizationViewer

1747

# condition:

1748

# title: expirable access

1749

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1750

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1751

# - etag: BwWWja0YfJA=

1752

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1753

#

1754

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1755

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1756

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1757

# `condition` that determines how and when the `bindings` are applied. Each

1758

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1759

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1760

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

1761

#

1762

# If the condition evaluates to `true`, then this binding applies to the

1763

# current request.

1764

#

1765

# If the condition evaluates to `false`, then this binding does not apply to

1766

# the current request. However, a different role binding might grant the same

1767

# role to one or more of the members in this binding.

1768

#

1769

# To learn which resources support conditions in their IAM policies, see the

1770

# [IAM

1771

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1772

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1773

# are documented at https://github.com/google/cel-spec.

1774

#

1775

# Example (Comparison):

1776

#

1777

# title: "Summary size limit"

1778

# description: "Determines if a summary is less than 100 chars"

1779

# expression: "document.summary.size() < 100"

1780

#

1781

# Example (Equality):

1782

#

1783

# title: "Requestor is owner"

1784

# description: "Determines if requestor is the document owner"

1785

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1790

# description: "Determine whether the document should be publicly visible"

1791

# expression: "document.type != 'private' && document.type != 'internal'"

1792

#

1793

# Example (Data Manipulation):

1794

#

1795

# title: "Notification string"

1796

# description: "Create a notification string with a timestamp."

1797

# expression: "'New message received at ' + string(document.create_time)"

1798

#

1799

# The exact variables and functions that may be referenced within an expression

1800

# are determined by the service that evaluates it. See the service

1801

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1802

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1803

# its purpose. This can be used e.g. in UIs which allow to enter the

1804

# expression.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1805

"expression": "A String", # Textual representation of an expression in Common Expression Language

1806

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1807

"location": "A String", # Optional. String indicating the location of the expression for error

1808

# reporting, e.g. a file name and a position in the file.

1809

"description": "A String", # Optional. Description of the expression. This is a longer text which

1810

# describes the expression, e.g. when hovered over it in a UI.

1811

},

1812

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1813

# `members` can have the following values:

1814

#

1815

# * `allUsers`: A special identifier that represents anyone who is

1816

# on the internet; with or without a Google account.

1817

#

1818

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1819

# who is authenticated with a Google account or a service account.

1820

#

1821

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1822

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1823

#

1824

#

1825

# * `serviceAccount:{emailid}`: An email address that represents a service

1826

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1827

#

1828

# * `group:{emailid}`: An email address that represents a Google group.

1829

# For example, `admins@example.com`.

1830

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1831

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1832

# identifier) representing a user that has been recently deleted. For

1833

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1834

# recovered, this value reverts to `user:{emailid}` and the recovered user

1835

# retains the role in the binding.

1836

#

1837

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1838

# unique identifier) representing a service account that has been recently

1839

# deleted. For example,

1840

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1841

# If the service account is undeleted, this value reverts to

1842

# `serviceAccount:{emailid}` and the undeleted service account retains the

1843

# role in the binding.

1844

#

1845

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1846

# identifier) representing a Google group that has been recently

1847

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1848

# the group is recovered, this value reverts to `group:{emailid}` and the

1849

# recovered group retains the role in the binding.

1850

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1851

#

1852

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

1853

# users of that domain. For example, `google.com` or `example.com`.

1854

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1855

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1856

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1857

"role": "A String", # Role that is assigned to `members`.

1858

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1859

},

1860

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1861

"version": 42, # Specifies the format of the policy.

1862

#

1863

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1864

# are rejected.

1865

#

1866

# Any operation that affects conditional role bindings must specify version

1867

# `3`. This requirement applies to the following operations:

1868

#

1869

# * Getting a policy that includes a conditional role binding

1870

# * Adding a conditional role binding to a policy

1871

# * Changing a conditional role binding in a policy

1872

# * Removing any role binding, with or without a condition, from a policy

1873

# that includes conditions

1874

#

1875

# **Important:** If you use IAM Conditions, you must include the `etag` field

1876

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1877

# you to overwrite a version `3` policy with a version `1` policy, and all of

1878

# the conditions in the version `3` policy are lost.

1879

#

1880

# If a policy does not include any conditions, operations on that policy may

1881

# specify any valid version or leave the field unset.

1882

#

1883

# To learn which resources support conditions in their IAM policies, see the

1884

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1885

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1886

# prevent simultaneous updates of a policy from overwriting each other.

1887

# It is strongly suggested that systems make use of the `etag` in the

1888

# read-modify-write cycle to perform policy updates in order to avoid race

1889

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1890

# systems are expected to put that etag in the request to `setIamPolicy` to

1891

# ensure that their change will be applied to the same version of the policy.

1892

#

1893

# **Important:** If you use IAM Conditions, you must include the `etag` field

1894

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1895

# you to overwrite a version `3` policy with a version `1` policy, and all of

1896

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="getNotes">getNotes(name, x__xgafv=None)</code>

1902

<pre>Gets the `Note` attached to the given `Occurrence`.

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1906

"projects/{project_id}/occurrences/{OCCURRENCE_ID}" (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1907

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1914

1915

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1916

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

1917

# various channels.

1918

# e.g. glibc (aka libc6) is distributed by many, at various versions.

1919

"distribution": [ # The various channels by which a package is distributed.

1920

{ # This represents a particular channel of distribution for a given package.

1921

# e.g. Debian's jessie-backports dpkg mirror

1922

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

1923

# this distribution channel.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1924

# For a discussion of this in Debian/Ubuntu:

1925

# http://serverfault.com/questions/604541/debian-packages-version-convention

1926

# For a discussion of this in Redhat/Fedora/Centos:

1927

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1928

"name": "A String", # The main part of the version name.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1929

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1930

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1931

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1932

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1933

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1934

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

1935

"architecture": "A String", # The CPU architecture for which packages in this distribution

1936

# channel were built

1937

"description": "A String", # The distribution channel-specific description of this package.

1938

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

1939

# denoting the package manager version distributing a package.

1940

"url": "A String", # The distribution channel-specific homepage for this package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1941

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1942

],

1943

"name": "A String", # The name of the package.

1944

},

1945

"name": "A String", # The name of the note in the form

1946

# "projects/{provider_project_id}/notes/{NOTE_ID}"

1947

"relatedUrl": [ # URLs associated with this note

1948

{ # Metadata for any related URL information

1949

"label": "A String", # Label to describe usage of the URL

1950

"url": "A String", # Specific URL to associate with the note

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1951

},

1952

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1953

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

1954

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

1955

# relationship. Linked occurrences are derived from this or an

1956

# equivalent image via:

1957

# FROM <Basis.resource_url>

1958

# Or an equivalent reference, e.g. a tag of the resource_url.

1959

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

1960

# associated occurrence images.

1961

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

1962

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

1963

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

1964

# Only the name of the final blob is kept.

1965

# This field can be used as a filter in list requests.

1966

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1967

"A String",

1968

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1969

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

1970

# representation.

1971

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1972

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1973

},

1974

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

1975

# filter in list requests.

1976

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

1977

"details": [ # All information about the package to specifically identify this

1978

# vulnerability. One entry per (version range and cpe_uri) the

1979

# package vulnerability has manifested in.

1980

{ # Identifies all occurrences of this vulnerability in the package for a

1981

# specific distro/location

1982

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

1983

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

1984

# obsolete details.

1985

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

1986

# For a discussion of this in Debian/Ubuntu:

1987

# http://serverfault.com/questions/604541/debian-packages-version-convention

1988

# For a discussion of this in Redhat/Fedora/Centos:

1989

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1990

"name": "A String", # The main part of the version name.

1991

"revision": "A String", # The iteration of the package build from the above version.

1992

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1993

# If kind is not NORMAL, then the other fields are ignored.

1994

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1995

},

1996

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

1997

# For a discussion of this in Debian/Ubuntu:

1998

# http://serverfault.com/questions/604541/debian-packages-version-convention

1999

# For a discussion of this in Redhat/Fedora/Centos:

2000

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

2001

"name": "A String", # The main part of the version name.

2002

"revision": "A String", # The iteration of the package build from the above version.

2003

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

2004

# If kind is not NORMAL, then the other fields are ignored.

2005

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

2006

},

2007

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

2008

# node.js packages etc)

2009

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

2010

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

2011

# filter in list requests.

2012

# For a discussion of this in Debian/Ubuntu:

2013

# http://serverfault.com/questions/604541/debian-packages-version-convention

2014

# For a discussion of this in Redhat/Fedora/Centos:

2015

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

2016

"name": "A String", # The main part of the version name.

2017

"revision": "A String", # The iteration of the package build from the above version.

2018

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

2019

# If kind is not NORMAL, then the other fields are ignored.

2020

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

2021

},

2022

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

2023

# format. Examples include distro or storage location for vulnerable jar.

2024

# This field can be used as a filter in list requests.

2025

"package": "A String", # The package being described.

2026

},

2027

"description": "A String", # A vendor-specific description of this note.

2028

"package": "A String", # The name of the package where the vulnerability was found.

2029

# This field can be used as a filter in list requests.

2030

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

2031

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

2032

# which the vulnerability manifests. Examples include distro or storage

2033

# location for vulnerable jar.

2034

# This field can be used as a filter in list requests.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2035

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2036

],

2037

"severity": "A String", # Note provider assigned impact of the vulnerability

2038

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

2039

},

2040

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

2041

# the provenance message in linked BuildDetails.

2042

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

2043

# `BuilderDetails`.

2044

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

2045

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

2046

# CN for a cert), or a reference to an external key (such as a reference to a

2047

# key in Cloud Key Management Service).

2048

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

2049

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

2050

# `key_id`

2051

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

2052

# findings are valid and unchanged. If `key_type` is empty, this defaults

2053

# to PEM encoded public keys.

2054

#

2055

# This field may be empty if `key_id` references an external key.

2056

#

2057

# For Cloud Build based signatures, this is a PEM encoded public

2058

# key. To verify the Cloud Build signature, place the contents of

2059

# this field into a file (public.pem). The signature field is base64-decoded

2060

# into its binary representation in signature.bin, and the provenance bytes

2061

# from `BuildDetails` are base64-decoded into a binary representation in

2062

# signed.bin. OpenSSL can then verify the signature:

2063

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2064

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2065

"builderVersion": "A String", # Version of the builder which produced this Note.

2066

},

2067

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

2068

# field can be used as a filter in list requests.

2069

"longDescription": "A String", # A detailed description of this `Note`.

2070

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

2071

"resourceUri": [ # Resource URI for the artifact being deployed.

"A String",

],

},

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

2076

# a filter in list requests.

2077

"shortDescription": "A String", # A one sentence description of this `Note`.

2078

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

2079

# exists in a provider's project. A `Discovery` occurrence is created in a

2080

# consumer's project at the start of analysis. The occurrence's operation will

2081

# indicate the status of the analysis. Absence of an occurrence linked to this

2082

# note for a resource indicates that analysis hasn't started.

2083

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

2084

},

2085

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

2086

# example, an organization might have one `AttestationAuthority` for "QA" and

2087

# one for "build". This Note is intended to act strictly as a grouping

2088

# mechanism for the attached Occurrences (Attestations). This grouping

2089

# mechanism also provides a security boundary, since IAM ACLs gate the ability

2090

# for a principle to attach an Occurrence to a given Note. It also provides a

2091

# single point of lookup to find all attached Attestation Occurrences, even if

2092

# they don't all live in the same project.

2093

"hint": { # This submessage provides human-readable hints about the purpose of the

2094

# AttestationAuthority. Because the name of a Note acts as its resource

2095

# reference, it is important to disambiguate the canonical name of the Note

2096

# (which might be a UUID for security purposes) from "readable" names more

2097

# suitable for debug output. Note that these hints should NOT be used to

2098

# look up AttestationAuthorities in security sensitive contexts, such as when

2099

# looking up Attestations to verify.

2100

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

2101

},

2102

},

2103

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

2104

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

2105

# bash 4.1.2), there will be a Upgrade Note.

2106

"package": "A String", # Required - The package this Upgrade is for.

2107

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

2108

# For a discussion of this in Debian/Ubuntu:

2109

# http://serverfault.com/questions/604541/debian-packages-version-convention

2110

# For a discussion of this in Redhat/Fedora/Centos:

2111

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

2112

"name": "A String", # The main part of the version name.

2113

"revision": "A String", # The iteration of the package build from the above version.

2114

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

2115

# If kind is not NORMAL, then the other fields are ignored.

2116

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

2117

},

2118

"distributions": [ # Metadata about the upgrade for each specific operating system.

2119

{ # The Upgrade Distribution represents metadata about the Upgrade for each

2120

# operating system (CPE). Some distributions have additional metadata around

2121

# updates, classifying them into various categories and severities.

2122

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

2123

# upstream operating system upgrade feed.

2124

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

2125

# https://cpe.mitre.org/specification/.

2126

"severity": "A String", # The severity as specified by the upstream operating system.

2127

"cve": [ # The cve that would be resolved by this upgrade.

"A String",

],

},

],

},

}</pre>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

</div>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2137

<code class="details" id="getVulnerabilitySummary">getVulnerabilitySummary(parent, filter=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2138

<pre>Gets a summary of the number and severity of occurrences.

2139

2140

Args:

2141

parent: string, This contains the project Id for example: projects/{project_id} (required)

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2142

filter: string, The filter expression.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2143

x__xgafv: string, V1 error format.

2144

Allowed values

2145

1 - v1 error format

2146

2 - v2 error format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2147

2148

Returns:

2149

An object of the form:

2150

2151

{ # A summary of how many vulnz occurrences there are per severity type.

2152

# counts by groups, or if we should have different summary messages

2153

# like this.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2154

"counts": [ # A map of how many occurrences were found for each severity.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2155

{ # The number of occurrences created for a specific severity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2156

"severity": "A String", # The severity of the occurrences.

2157

"count": "A String", # The number of occurrences with the severity.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

],

}</pre>

</div>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2164

<code class="details" id="list">list(parent, pageSize=None, kind=None, name=None, filter=None, pageToken=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2165

<pre>Lists active `Occurrences` for a given project matching the filters.

2166

2167

Args:

2168

parent: string, This contains the project Id for example: projects/{project_id}. (required)

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2169

pageSize: integer, Number of occurrences to return in the list.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2170

kind: string, The kind of occurrences to filter on.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2171

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2172

"projects/{project_id}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2173

@Deprecated

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2174

filter: string, The filter expression.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2175

pageToken: string, Token to provide to skip to a particular spot in the list.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2176

x__xgafv: string, V1 error format.

2177

Allowed values

2178

1 - v1 error format

2179

2 - v2 error format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2180

2181

Returns:

2182

An object of the form:

2183

2184

{ # Response including listed active occurrences.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2185

"nextPageToken": "A String", # The next pagination token in the list response. It should be used as

2186

# `page_token` for the following request. An empty value means no more

2187

# results.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2188

"occurrences": [ # The occurrences requested.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2189

{ # `Occurrence` includes information about analysis occurrences for an image.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2190

"resource": { # #

2191

# The resource for which the `Occurrence` applies.

2192

# Resource is an entity that can have metadata. E.g., a Docker image.

2193

"uri": "A String", # The unique URI of the resource. E.g.,

2194

# "https://gcr.io/project/image@sha256:foo" for a Docker image.

2195

"name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".

2196

"contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.

2197

"type": "A String", # The type of hash that was performed.

2198

"value": "A String", # The hash value.

2199

},

2200

},

2201

"vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.

2202

# to fix it.

2203

"packageIssue": [ # The set of affected locations and their fixes (if available) within

2204

# the associated resource.

2205

{ # This message wraps a location affected by a vulnerability and its

2206

# associated fix (if one is available).

2207

"affectedLocation": { # The location of the vulnerability # The location of the vulnerability.

2208

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

2209

# filter in list requests.

2210

# For a discussion of this in Debian/Ubuntu:

2211

# http://serverfault.com/questions/604541/debian-packages-version-convention

2212

# For a discussion of this in Redhat/Fedora/Centos:

2213

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

2214

"name": "A String", # The main part of the version name.

2215

"revision": "A String", # The iteration of the package build from the above version.

2216

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

2217

# If kind is not NORMAL, then the other fields are ignored.

2218

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

2219

},

2220

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

2221

# format. Examples include distro or storage location for vulnerable jar.

2222

# This field can be used as a filter in list requests.

2223

"package": "A String", # The package being described.

2224

},

2225

"fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.

2226

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

2227

# filter in list requests.

2228

# For a discussion of this in Debian/Ubuntu:

2229

# http://serverfault.com/questions/604541/debian-packages-version-convention

2230

# For a discussion of this in Redhat/Fedora/Centos:

2231

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

2232

"name": "A String", # The main part of the version name.

2233

"revision": "A String", # The iteration of the package build from the above version.

2234

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

2235

# If kind is not NORMAL, then the other fields are ignored.

2236

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

2237

},

2238

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

2239

# format. Examples include distro or storage location for vulnerable jar.

2240

# This field can be used as a filter in list requests.

2241

"package": "A String", # The package being described.

2242

},

2243

"severityName": "A String",

2244

},

2245

],

2246

"effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is

2247

# available and note provider assigned severity when distro has not yet

2248

# assigned a severity for this vulnerability.

2249

"type": "A String", # The type of package; whether native or non native(ruby gems,

2250

# node.js packages etc)

2251

"severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.

2252

"cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a

2253

# scale of 0-10 where 0 indicates low severity and 10 indicates high

2254

# severity.

2255

},

2256

"attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.

2257

# Attestation can be verified using the attached signature. If the verifier

2258

# trusts the public key of the signer, then verifying the signature is

2259

# sufficient to establish trust. In this circumstance, the

2260

# AttestationAuthority to which this Attestation is attached is primarily

2261

# useful for look-up (how to find this Attestation if you already know the

2262

# Authority and artifact to be verified) and intent (which authority was this

2263

# attestation intended to sign for).

2264

"pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.

2265

# This message only supports `ATTACHED` signatures, where the payload that is

2266

# signed is included alongside the signature itself in the same file.

2267

"pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,

2268

# as output by, e.g. `gpg --list-keys`. This should be the version 4, full

2269

# 160-bit fingerprint, expressed as a 40 character hexadecimal string. See

2270

# https://tools.ietf.org/html/rfc4880#section-12.2 for details.

2271

# Implementations may choose to acknowledge "LONG", "SHORT", or other

2272

# abbreviated key IDs, but only the full fingerprint is guaranteed to work.

2273

# In gpg, the full fingerprint can be retrieved from the `fpr` field

2274

# returned when calling --list-keys with --with-colons. For example:

2275

# ```

2276

# gpg --with-colons --with-fingerprint --force-v4-certs \

2277

# --list-keys attester@example.com

2278

# tru::1:1513631572:0:3:1:5

2279

# pub:...<SNIP>...

2280

# fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:

2281

# ```

2282

# Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.

2283

"signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or

2284

# equivalent. Since this message only supports attached signatures, the

2285

# payload that was signed must be attached. While the signature format

2286

# supported is dependent on the verification implementation, currently only

2287

# ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than

2288

# `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor

2289

# --output=signature.gpg payload.json` will create the signature content

2290

# expected in this field in `signature.gpg` for the `payload.json`

2291

# attestation payload.

2292

"contentType": "A String", # Type (for example schema) of the attestation payload that was signed.

2293

# The verifier must ensure that the provided type is one that the verifier

2294

# supports, and that the attestation payload is a valid instantiation of that

2295

# type (for example by validating a JSON schema).

2296

},

2297

},

2298

"kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are

2299

# specified. This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2300

"buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2301

"provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance

2302

# details about the build from source to completion.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2303

"sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2304

"context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.

2305

# with a path point to a unique revision of a single file or directory.

2306

"labels": { # Labels with user defined metadata.

2307

"a_key": "A String",

2308

},

2309

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

2310

# repository (e.g., GitHub).

2311

"url": "A String", # Git repository URL.

2312

"revisionId": "A String", # Required. Git commit hash.

2313

},

2314

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

2315

# Source Repo.

2316

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

2317

"kind": "A String", # The alias kind.

2318

"name": "A String", # The alias name.

2319

},

2320

"revisionId": "A String", # A revision ID.

2321

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

2322

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

2323

# winged-cargo-31) and a repo name within that project.

2324

"projectId": "A String", # The ID of the project.

2325

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

2326

},

2327

"uid": "A String", # A server-assigned, globally unique identifier.

2328

},

2329

},

2330

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

2331

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

2332

# "project/subproject" is a valid project name. The "repo name" is

2333

# the hostURI/project.

2334

"hostUri": "A String", # The URI of a running Gerrit instance.

2335

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

2336

"kind": "A String", # The alias kind.

2337

"name": "A String", # The alias name.

2338

},

2339

"revisionId": "A String", # A revision (commit) ID.

2340

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2341

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2342

"additionalContexts": [ # If provided, some of the source code used for the build may be found in

2343

# these locations, in the case where the source repository had multiple

2344

# remotes or submodules. This list will not include the context specified in

2345

# the context field.

2346

{ # A SourceContext is a reference to a tree of files. A SourceContext together

2347

# with a path point to a unique revision of a single file or directory.

2348

"labels": { # Labels with user defined metadata.

2349

"a_key": "A String",

2350

},

2351

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

2352

# repository (e.g., GitHub).

2353

"url": "A String", # Git repository URL.

2354

"revisionId": "A String", # Required. Git commit hash.

2355

},

2356

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

2357

# Source Repo.

2358

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

2359

"kind": "A String", # The alias kind.

2360

"name": "A String", # The alias name.

2361

},

2362

"revisionId": "A String", # A revision ID.

2363

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

2364

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

2365

# winged-cargo-31) and a repo name within that project.

2366

"projectId": "A String", # The ID of the project.

2367

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

2368

},

2369

"uid": "A String", # A server-assigned, globally unique identifier.

2370

},

2371

},

2372

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

2373

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

2374

# "project/subproject" is a valid project name. The "repo name" is

2375

# the hostURI/project.

2376

"hostUri": "A String", # The URI of a running Gerrit instance.

2377

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

2378

"kind": "A String", # The alias kind.

2379

"name": "A String", # The alias name.

2380

},

2381

"revisionId": "A String", # A revision (commit) ID.

},

},

],

"artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this

2386

# location.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2387

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2388

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2389

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2390

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

2391

# Requirements]

2392

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2393

},

2394

"repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.

2395

# Repository.

2396

"tagName": "A String", # Name of the tag to build.

2397

"branchName": "A String", # Name of the branch to build.

2398

"projectId": "A String", # ID of the project that owns the repo.

2399

"repoName": "A String", # Name of the repo.

2400

"commitSha": "A String", # Explicit commit SHA to build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2401

},

2402

"fileHashes": { # Hash(es) of the build source, which can be used to verify that the original

2403

# source integrity was maintained in the build.

2404

#

2405

# The keys to this map are file paths used as build source and the values

2406

# contain the hash values for those files.

2407

#

2408

# If the build source came in a single package such as a gzipped tarfile

2409

# (.tar.gz), the FileHash will be for the single path to that file.

2410

"a_key": { # Container message for hashes of byte content of files, used in Source

2411

# messages to verify integrity of source input to the build.

2412

"fileHash": [ # Collection of file hashes.

2413

{ # Container message for hash values.

2414

"type": "A String", # The type of hash that was performed.

2415

"value": "A String", # The hash value.

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2420

"storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud

2421

# Storage.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2422

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2423

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2424

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2425

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

2426

# Requirements]

2427

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2428

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2429

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2430

"builtArtifacts": [ # Output of the build.

2431

{ # Artifact describes a build product.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2432

"name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in

2433

# the case of a container build, the name used to push the container image to

2434

# Google Container Registry, as presented to `docker push`.

2435

#

2436

# This field is deprecated in favor of the plural `names` field; it continues

2437

# to exist here to allow existing BuildProvenance serialized to json in

2438

# google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to

2439

# deserialize back into proto.

2440

"checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a

2441

# container.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2442

"names": [ # Related artifact names. This may be the path to a binary or jar file, or in

2443

# the case of a container build, the name used to push the container image to

2444

# Google Container Registry, as presented to `docker push`. Note that a

2445

# single Artifact ID can have multiple names, for example if two tags are

2446

# applied to one image.

2447

"A String",

2448

],

2449

"id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest

2450

# like gcr.io/projectID/imagename@sha256:123456

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2451

},

2452

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2453

"id": "A String", # Unique identifier of the build.

2454

"createTime": "A String", # Time at which the build was created.

2455

"buildOptions": { # Special options applied to this build. This is a catch-all field where

2456

# build providers can enter any desired additional details.

2457

"a_key": "A String",

2458

},

2459

"logsBucket": "A String", # Google Cloud Storage bucket where logs were written.

2460

"finishTime": "A String", # Time at which execution of the build was finished.

2461

"creator": "A String", # E-mail address of the user who initiated this build. Note that this was the

2462

# user's e-mail address at the time the build was initiated; this address may

2463

# not represent the same end-user for all time.

2464

"projectId": "A String", # ID of the project.

2465

"startTime": "A String", # Time at which execution of the build was started.

2466

"commands": [ # Commands requested by the build.

2467

{ # Command describes a step performed as part of the build pipeline.

2468

"dir": "A String", # Working directory (relative to project source root) used when running

2469

# this Command.

2470

"env": [ # Environment variables set before running this Command.

2471

"A String",

2472

],

2473

"args": [ # Command-line arguments used when executing this Command.

2474

"A String",

2475

],

2476

"id": "A String", # Optional unique identifier for this Command, used in wait_for to reference

2477

# this Command as a dependency.

2478

"name": "A String", # Name of the command, as presented on the command line, or if the command is

2479

# packaged as a Docker container, as presented to `docker pull`.

2480

"waitFor": [ # The ID(s) of the Command(s) that this Command depends on.

"A String",

],

},

],

"triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.

2486

"builderVersion": "A String", # Version string of the builder at the time this build was executed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2487

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2488

"provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the

2489

# `BuildSignature` in the corresponding Result. After verifying the

2490

# signature, `provenance_bytes` can be unmarshalled and compared to the

2491

# provenance to confirm that it is unchanged. A base64-encoded string

2492

# representation of the provenance bytes is used for the signature in order

2493

# to interoperate with openssl which expects this format for signature

2494

# verification.

2495

#

2496

# The serialized form is captured both to avoid ambiguity in how the

2497

# provenance is marshalled to json as well to prevent incompatibilities with

2498

# future changes.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2499

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2500

"name": "A String", # Output only. The name of the `Occurrence` in the form

2501

# "projects/{project_id}/occurrences/{OCCURRENCE_ID}"

2502

"deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.

2503

"undeployTime": "A String", # End of the lifetime of this deployment.

2504

"address": "A String", # Address of the runtime element hosting this deployment.

2505

"platform": "A String", # Platform hosting this deployment.

2506

"config": "A String", # Configuration used to create this deployment.

2507

"deployTime": "A String", # Beginning of the lifetime of this deployment.

2508

"resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the

2509

# deployable field with the same name.

2510

"A String",

2511

],

2512

"userEmail": "A String", # Identity of the user that triggered this deployment.

2513

},

2514

"upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.

2515

# specific upgrade. This presence is supplied via local sources (i.e. it is

2516

# present in the mirror and the running system has noticed its availability).

2517

"package": "A String", # Required - The package this Upgrade is for.

2518

"distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system

2519

# for the resource_url. This allows efficient filtering, as well as

2520

# making it easier to use the occurrence.

2521

# operating system (CPE). Some distributions have additional metadata around

2522

# updates, classifying them into various categories and severities.

2523

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

2524

# upstream operating system upgrade feed.

2525

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

2526

# https://cpe.mitre.org/specification/.

2527

"severity": "A String", # The severity as specified by the upstream operating system.

2528

"cve": [ # The cve that would be resolved by this upgrade.

2529

"A String",

2530

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2531

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2532

"parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.

2533

# For a discussion of this in Debian/Ubuntu:

2534

# http://serverfault.com/questions/604541/debian-packages-version-convention

2535

# For a discussion of this in Redhat/Fedora/Centos:

2536

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

2537

"name": "A String", # The main part of the version name.

2538

"revision": "A String", # The iteration of the package build from the above version.

2539

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

2540

# If kind is not NORMAL, then the other fields are ignored.

2541

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

2542

},

2543

},

2544

"derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis

2545

# in the associated note.

2546

# DockerImage relationship. This image would be produced from a Dockerfile

2547

# with FROM <DockerImage.Basis in attached Note>.

2548

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.

2549

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

2550

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

2551

# Only the name of the final blob is kept.

2552

# This field can be used as a filter in list requests.

2553

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

2554

"A String",

2555

],

2556

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

2557

# representation.

2558

# This field can be used as a filter in list requests.

2559

},

2560

"layerInfo": [ # This contains layer-specific metadata, if populated it has length

2561

# "distance" and is ordered with [distance] being the layer immediately

2562

# following the base image and [1] being the final layer.

2563

{ # Layer holds metadata specific to a layer of a Docker image.

2564

"arguments": "A String", # The recovered arguments to the Dockerfile directive.

2565

"directive": "A String", # The recovered Dockerfile directive used to construct this layer.

2566

},

2567

],

2568

"baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image

2569

# occurrence.

2570

"distance": 42, # Output only. The number of layers by which this image differs from the

2571

# associated image basis.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2572

},

2573

"resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`

2574

# applies. For example, https://gcr.io/project/image@sha256:foo This field

2575

# can be used as a filter in list requests.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2576

"remediation": "A String", # A description of actions that can be taken to remedy the `Note`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2577

"installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.

2578

# a system.

2579

"location": [ # All of the places within the filesystem versions of this package

2580

# have been found.

2581

{ # An occurrence of a particular package installation found within a

2582

# system's filesystem.

2583

# e.g. glibc was found in /var/lib/dpkg/status

2584

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

2585

# denoting the package manager version distributing a package.

2586

"version": { # Version contains structured information about the version of the package. # The version installed at this location.

2587

# For a discussion of this in Debian/Ubuntu:

2588

# http://serverfault.com/questions/604541/debian-packages-version-convention

2589

# For a discussion of this in Redhat/Fedora/Centos:

2590

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

2591

"name": "A String", # The main part of the version name.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2592

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2593

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

2594

# If kind is not NORMAL, then the other fields are ignored.

2595

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2596

},

2597

"path": "A String", # The path from which we gathered that this package/version is installed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2598

},

2599

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2600

"name": "A String", # Output only. The name of the installed package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2601

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2602

"noteName": "A String", # An analysis note associated with this image, in the form

2603

# "providers/{provider_id}/notes/{NOTE_ID}"

2604

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2605

"discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2606

"continuousAnalysis": "A String", # Whether the resource is continuously analyzed.

2607

"cpe": "A String", # The CPE of the resource being scanned.

2608

"analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under

2609

# details to show to the user. The LocalizedMessage output only and

2610

# populated by the API.

2611

# different programming environments, including REST APIs and RPC APIs. It is

2612

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

2613

# three pieces of data: error code, error message, and error details.

2614

#

2615

# You can find out more about this error model and how to work with it in the

2616

# [API Design Guide](https://cloud.google.com/apis/design/errors).

2617

"message": "A String", # A developer-facing error message, which should be in English. Any

2618

# user-facing error message should be localized and sent in the

2619

# google.rpc.Status.details field, or localized by the client.

2620

"details": [ # A list of messages that carry the error details. There is a common set of

2621

# message types for APIs to use.

2622

{

2623

"a_key": "", # Properties of the object. Contains field @type with type URL.

2624

},

2625

],

2626

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

2627

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2628

"operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.

2629

# This field is deprecated, do not use.

2630

# network API call.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2631

"response": { # The normal response of the operation in case of success. If the original

2632

# method returns no data on success, such as `Delete`, the response is

2633

# `google.protobuf.Empty`. If the original method is standard

2634

# `Get`/`Create`/`Update`, the response should be the resource. For other

2635

# methods, the response should have the type `XxxResponse`, where `Xxx`

2636

# is the original method name. For example, if the original method name

2637

# is `TakeSnapshot()`, the inferred response type is

2638

# `TakeSnapshotResponse`.

2639

"a_key": "", # Properties of the object. Contains field @type with type URL.

2640

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2641

"name": "A String", # The server-assigned name, which is only unique within the same service that

2642

# originally returns it. If you use the default HTTP mapping, the

2643

# `name` should be a resource name ending with `operations/{unique_id}`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2644

"metadata": { # Service-specific metadata associated with the operation. It typically

2645

# contains progress information and common metadata such as create time.

2646

# Some services might not provide such metadata. Any method that returns a

2647

# long-running operation should document the metadata type, if any.

2648

"a_key": "", # Properties of the object. Contains field @type with type URL.

2649

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2650

"error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.

2651

# different programming environments, including REST APIs and RPC APIs. It is

2652

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

2653

# three pieces of data: error code, error message, and error details.

2654

#

2655

# You can find out more about this error model and how to work with it in the

2656

# [API Design Guide](https://cloud.google.com/apis/design/errors).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2657

"message": "A String", # A developer-facing error message, which should be in English. Any

2658

# user-facing error message should be localized and sent in the

2659

# google.rpc.Status.details field, or localized by the client.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2660

"details": [ # A list of messages that carry the error details. There is a common set of

2661

# message types for APIs to use.

2662

{

2663

"a_key": "", # Properties of the object. Contains field @type with type URL.

2664

},

2665

],

2666

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2667

},

2668

"done": True or False, # If the value is `false`, it means the operation is still in progress.

2669

# If `true`, the operation is completed, and either `error` or `response` is

2670

# available.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2671

},

2672

"analysisStatus": "A String", # The status of discovery for the resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2673

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2674

"createTime": "A String", # Output only. The time this `Occurrence` was created.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2675

"updateTime": "A String", # Output only. The time this `Occurrence` was last updated.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

],

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

2683

<pre>Retrieves the next page of results.

2684

2685

Args:

2686

previous_request: The request for the previous page. (required)

2687

previous_response: The response from the request for the previous page. (required)

2688

2689

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2690

A request object that you can call 'execute()' on to request the next

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2691

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2696

<code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2697

<pre>Updates an existing occurrence.

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2701

Should be of the form "projects/{project_id}/occurrences/{OCCURRENCE_ID}". (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2702

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2703

The object takes the form of:

2704

2705

{ # `Occurrence` includes information about analysis occurrences for an image.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2706

"resource": { # #

2707

# The resource for which the `Occurrence` applies.

2708

# Resource is an entity that can have metadata. E.g., a Docker image.

2709

"uri": "A String", # The unique URI of the resource. E.g.,

2710

# "https://gcr.io/project/image@sha256:foo" for a Docker image.

2711

"name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".

2712

"contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.

2713

"type": "A String", # The type of hash that was performed.

2714

"value": "A String", # The hash value.

2715

},

2716

},

2717

"vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.

2718

# to fix it.

2719

"packageIssue": [ # The set of affected locations and their fixes (if available) within

2720

# the associated resource.

2721

{ # This message wraps a location affected by a vulnerability and its

2722

# associated fix (if one is available).

2723

"affectedLocation": { # The location of the vulnerability # The location of the vulnerability.

2724

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

2725

# filter in list requests.

2726

# For a discussion of this in Debian/Ubuntu:

2727

# http://serverfault.com/questions/604541/debian-packages-version-convention

2728

# For a discussion of this in Redhat/Fedora/Centos:

2729

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

2730

"name": "A String", # The main part of the version name.

2731

"revision": "A String", # The iteration of the package build from the above version.

2732

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

2733

# If kind is not NORMAL, then the other fields are ignored.

2734

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

2735

},

2736

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

2737

# format. Examples include distro or storage location for vulnerable jar.

2738

# This field can be used as a filter in list requests.

2739

"package": "A String", # The package being described.

2740

},

2741

"fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.

2742

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

2743

# filter in list requests.

2744

# For a discussion of this in Debian/Ubuntu:

2745

# http://serverfault.com/questions/604541/debian-packages-version-convention

2746

# For a discussion of this in Redhat/Fedora/Centos:

2747

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

2748

"name": "A String", # The main part of the version name.

2749

"revision": "A String", # The iteration of the package build from the above version.

2750

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

2751

# If kind is not NORMAL, then the other fields are ignored.

2752

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

2753

},

2754

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

2755

# format. Examples include distro or storage location for vulnerable jar.

2756

# This field can be used as a filter in list requests.

2757

"package": "A String", # The package being described.

2758

},

2759

"severityName": "A String",

2760

},

2761

],

2762

"effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is

2763

# available and note provider assigned severity when distro has not yet

2764

# assigned a severity for this vulnerability.

2765

"type": "A String", # The type of package; whether native or non native(ruby gems,

2766

# node.js packages etc)

2767

"severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.

2768

"cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a

2769

# scale of 0-10 where 0 indicates low severity and 10 indicates high

2770

# severity.

2771

},

2772

"attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.

2773

# Attestation can be verified using the attached signature. If the verifier

2774

# trusts the public key of the signer, then verifying the signature is

2775

# sufficient to establish trust. In this circumstance, the

2776

# AttestationAuthority to which this Attestation is attached is primarily

2777

# useful for look-up (how to find this Attestation if you already know the

2778

# Authority and artifact to be verified) and intent (which authority was this

2779

# attestation intended to sign for).

2780

"pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.

2781

# This message only supports `ATTACHED` signatures, where the payload that is

2782

# signed is included alongside the signature itself in the same file.

2783

"pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,

2784

# as output by, e.g. `gpg --list-keys`. This should be the version 4, full

2785

# 160-bit fingerprint, expressed as a 40 character hexadecimal string. See

2786

# https://tools.ietf.org/html/rfc4880#section-12.2 for details.

2787

# Implementations may choose to acknowledge "LONG", "SHORT", or other

2788

# abbreviated key IDs, but only the full fingerprint is guaranteed to work.

2789

# In gpg, the full fingerprint can be retrieved from the `fpr` field

2790

# returned when calling --list-keys with --with-colons. For example:

2791

# ```

2792

# gpg --with-colons --with-fingerprint --force-v4-certs \

2793

# --list-keys attester@example.com

2794

# tru::1:1513631572:0:3:1:5

2795

# pub:...<SNIP>...

2796

# fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:

2797

# ```

2798

# Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.

2799

"signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or

2800

# equivalent. Since this message only supports attached signatures, the

2801

# payload that was signed must be attached. While the signature format

2802

# supported is dependent on the verification implementation, currently only

2803

# ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than

2804

# `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor

2805

# --output=signature.gpg payload.json` will create the signature content

2806

# expected in this field in `signature.gpg` for the `payload.json`

2807

# attestation payload.

2808

"contentType": "A String", # Type (for example schema) of the attestation payload that was signed.

2809

# The verifier must ensure that the provided type is one that the verifier

2810

# supports, and that the attestation payload is a valid instantiation of that

2811

# type (for example by validating a JSON schema).

2812

},

2813

},

2814

"kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are

2815

# specified. This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2816

"buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2817

"provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance

2818

# details about the build from source to completion.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2819

"sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2820

"context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.

2821

# with a path point to a unique revision of a single file or directory.

2822

"labels": { # Labels with user defined metadata.

2823

"a_key": "A String",

2824

},

2825

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

2826

# repository (e.g., GitHub).

2827

"url": "A String", # Git repository URL.

2828

"revisionId": "A String", # Required. Git commit hash.

2829

},

2830

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

2831

# Source Repo.

2832

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

2833

"kind": "A String", # The alias kind.

2834

"name": "A String", # The alias name.

2835

},

2836

"revisionId": "A String", # A revision ID.

2837

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

2838

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

2839

# winged-cargo-31) and a repo name within that project.

2840

"projectId": "A String", # The ID of the project.

2841

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

2842

},

2843

"uid": "A String", # A server-assigned, globally unique identifier.

2844

},

2845

},

2846

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

2847

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

2848

# "project/subproject" is a valid project name. The "repo name" is

2849

# the hostURI/project.

2850

"hostUri": "A String", # The URI of a running Gerrit instance.

2851

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

2852

"kind": "A String", # The alias kind.

2853

"name": "A String", # The alias name.

2854

},

2855

"revisionId": "A String", # A revision (commit) ID.

2856

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2857

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2858

"additionalContexts": [ # If provided, some of the source code used for the build may be found in

2859

# these locations, in the case where the source repository had multiple

2860

# remotes or submodules. This list will not include the context specified in

2861

# the context field.

2862

{ # A SourceContext is a reference to a tree of files. A SourceContext together

2863

# with a path point to a unique revision of a single file or directory.

2864

"labels": { # Labels with user defined metadata.

2865

"a_key": "A String",

2866

},

2867

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

2868

# repository (e.g., GitHub).

2869

"url": "A String", # Git repository URL.

2870

"revisionId": "A String", # Required. Git commit hash.

2871

},

2872

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

2873

# Source Repo.

2874

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

2875

"kind": "A String", # The alias kind.

2876

"name": "A String", # The alias name.

2877

},

2878

"revisionId": "A String", # A revision ID.

2879

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

2880

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

2881

# winged-cargo-31) and a repo name within that project.

2882

"projectId": "A String", # The ID of the project.

2883

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

2884

},

2885

"uid": "A String", # A server-assigned, globally unique identifier.

2886

},

2887

},

2888

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

2889

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

2890

# "project/subproject" is a valid project name. The "repo name" is

2891

# the hostURI/project.

2892

"hostUri": "A String", # The URI of a running Gerrit instance.

2893

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

2894

"kind": "A String", # The alias kind.

2895

"name": "A String", # The alias name.

2896

},

2897

"revisionId": "A String", # A revision (commit) ID.

},

},

],

"artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this

2902

# location.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2903

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2904

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2905

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2906

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

2907

# Requirements]

2908

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2909

},

2910

"repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.

2911

# Repository.

2912

"tagName": "A String", # Name of the tag to build.

2913

"branchName": "A String", # Name of the branch to build.

2914

"projectId": "A String", # ID of the project that owns the repo.

2915

"repoName": "A String", # Name of the repo.

2916

"commitSha": "A String", # Explicit commit SHA to build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2917

},

2918

"fileHashes": { # Hash(es) of the build source, which can be used to verify that the original

2919

# source integrity was maintained in the build.

2920

#

2921

# The keys to this map are file paths used as build source and the values

2922

# contain the hash values for those files.

2923

#

2924

# If the build source came in a single package such as a gzipped tarfile

2925

# (.tar.gz), the FileHash will be for the single path to that file.

2926

"a_key": { # Container message for hashes of byte content of files, used in Source

2927

# messages to verify integrity of source input to the build.

2928

"fileHash": [ # Collection of file hashes.

2929

{ # Container message for hash values.

2930

"type": "A String", # The type of hash that was performed.

2931

"value": "A String", # The hash value.

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2936

"storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud

2937

# Storage.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2938

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2939

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2940

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2941

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

2942

# Requirements]

2943

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2944

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2945

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2946

"builtArtifacts": [ # Output of the build.

2947

{ # Artifact describes a build product.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2948

"name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in

2949

# the case of a container build, the name used to push the container image to

2950

# Google Container Registry, as presented to `docker push`.

2951

#

2952

# This field is deprecated in favor of the plural `names` field; it continues

2953

# to exist here to allow existing BuildProvenance serialized to json in

2954

# google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to

2955

# deserialize back into proto.

2956

"checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a

2957

# container.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2958

"names": [ # Related artifact names. This may be the path to a binary or jar file, or in

2959

# the case of a container build, the name used to push the container image to

2960

# Google Container Registry, as presented to `docker push`. Note that a

2961

# single Artifact ID can have multiple names, for example if two tags are

2962

# applied to one image.

2963

"A String",

2964

],

2965

"id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest

2966

# like gcr.io/projectID/imagename@sha256:123456

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2967

},

2968

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2969

"id": "A String", # Unique identifier of the build.

2970

"createTime": "A String", # Time at which the build was created.

2971

"buildOptions": { # Special options applied to this build. This is a catch-all field where

2972

# build providers can enter any desired additional details.

2973

"a_key": "A String",

2974

},

2975

"logsBucket": "A String", # Google Cloud Storage bucket where logs were written.

2976

"finishTime": "A String", # Time at which execution of the build was finished.

2977

"creator": "A String", # E-mail address of the user who initiated this build. Note that this was the

2978

# user's e-mail address at the time the build was initiated; this address may

2979

# not represent the same end-user for all time.

2980

"projectId": "A String", # ID of the project.

2981

"startTime": "A String", # Time at which execution of the build was started.

2982

"commands": [ # Commands requested by the build.

2983

{ # Command describes a step performed as part of the build pipeline.

2984

"dir": "A String", # Working directory (relative to project source root) used when running

2985

# this Command.

2986

"env": [ # Environment variables set before running this Command.

2987

"A String",

2988

],

2989

"args": [ # Command-line arguments used when executing this Command.

2990

"A String",

2991

],

2992

"id": "A String", # Optional unique identifier for this Command, used in wait_for to reference

2993

# this Command as a dependency.

2994

"name": "A String", # Name of the command, as presented on the command line, or if the command is

2995

# packaged as a Docker container, as presented to `docker pull`.

2996

"waitFor": [ # The ID(s) of the Command(s) that this Command depends on.

"A String",

],

},

],

"triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.

3002

"builderVersion": "A String", # Version string of the builder at the time this build was executed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3003

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3004

"provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the

3005

# `BuildSignature` in the corresponding Result. After verifying the

3006

# signature, `provenance_bytes` can be unmarshalled and compared to the

3007

# provenance to confirm that it is unchanged. A base64-encoded string

3008

# representation of the provenance bytes is used for the signature in order

3009

# to interoperate with openssl which expects this format for signature

3010

# verification.

3011

#

3012

# The serialized form is captured both to avoid ambiguity in how the

3013

# provenance is marshalled to json as well to prevent incompatibilities with

3014

# future changes.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3015

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3016

"name": "A String", # Output only. The name of the `Occurrence` in the form

3017

# "projects/{project_id}/occurrences/{OCCURRENCE_ID}"

3018

"deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.

3019

"undeployTime": "A String", # End of the lifetime of this deployment.

3020

"address": "A String", # Address of the runtime element hosting this deployment.

3021

"platform": "A String", # Platform hosting this deployment.

3022

"config": "A String", # Configuration used to create this deployment.

3023

"deployTime": "A String", # Beginning of the lifetime of this deployment.

3024

"resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the

3025

# deployable field with the same name.

3026

"A String",

3027

],

3028

"userEmail": "A String", # Identity of the user that triggered this deployment.

3029

},

3030

"upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.

3031

# specific upgrade. This presence is supplied via local sources (i.e. it is

3032

# present in the mirror and the running system has noticed its availability).

3033

"package": "A String", # Required - The package this Upgrade is for.

3034

"distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system

3035

# for the resource_url. This allows efficient filtering, as well as

3036

# making it easier to use the occurrence.

3037

# operating system (CPE). Some distributions have additional metadata around

3038

# updates, classifying them into various categories and severities.

3039

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

3040

# upstream operating system upgrade feed.

3041

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

3042

# https://cpe.mitre.org/specification/.

3043

"severity": "A String", # The severity as specified by the upstream operating system.

3044

"cve": [ # The cve that would be resolved by this upgrade.

3045

"A String",

3046

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3047

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3048

"parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.

3049

# For a discussion of this in Debian/Ubuntu:

3050

# http://serverfault.com/questions/604541/debian-packages-version-convention

3051

# For a discussion of this in Redhat/Fedora/Centos:

3052

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

3053

"name": "A String", # The main part of the version name.

3054

"revision": "A String", # The iteration of the package build from the above version.

3055

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

3056

# If kind is not NORMAL, then the other fields are ignored.

3057

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

3058

},

3059

},

3060

"derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis

3061

# in the associated note.

3062

# DockerImage relationship. This image would be produced from a Dockerfile

3063

# with FROM <DockerImage.Basis in attached Note>.

3064

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.

3065

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

3066

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

3067

# Only the name of the final blob is kept.

3068

# This field can be used as a filter in list requests.

3069

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

3070

"A String",

3071

],

3072

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

3073

# representation.

3074

# This field can be used as a filter in list requests.

3075

},

3076

"layerInfo": [ # This contains layer-specific metadata, if populated it has length

3077

# "distance" and is ordered with [distance] being the layer immediately

3078

# following the base image and [1] being the final layer.

3079

{ # Layer holds metadata specific to a layer of a Docker image.

3080

"arguments": "A String", # The recovered arguments to the Dockerfile directive.

3081

"directive": "A String", # The recovered Dockerfile directive used to construct this layer.

3082

},

3083

],

3084

"baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image

3085

# occurrence.

3086

"distance": 42, # Output only. The number of layers by which this image differs from the

3087

# associated image basis.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3088

},

3089

"resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`

3090

# applies. For example, https://gcr.io/project/image@sha256:foo This field

3091

# can be used as a filter in list requests.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3092

"remediation": "A String", # A description of actions that can be taken to remedy the `Note`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3093

"installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.

3094

# a system.

3095

"location": [ # All of the places within the filesystem versions of this package

3096

# have been found.

3097

{ # An occurrence of a particular package installation found within a

3098

# system's filesystem.

3099

# e.g. glibc was found in /var/lib/dpkg/status

3100

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

3101

# denoting the package manager version distributing a package.

3102

"version": { # Version contains structured information about the version of the package. # The version installed at this location.

3103

# For a discussion of this in Debian/Ubuntu:

3104

# http://serverfault.com/questions/604541/debian-packages-version-convention

3105

# For a discussion of this in Redhat/Fedora/Centos:

3106

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

3107

"name": "A String", # The main part of the version name.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3108

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3109

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

3110

# If kind is not NORMAL, then the other fields are ignored.

3111

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3112

},

3113

"path": "A String", # The path from which we gathered that this package/version is installed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3114

},

3115

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3116

"name": "A String", # Output only. The name of the installed package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3117

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3118

"noteName": "A String", # An analysis note associated with this image, in the form

3119

# "providers/{provider_id}/notes/{NOTE_ID}"

3120

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3121

"discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3122

"continuousAnalysis": "A String", # Whether the resource is continuously analyzed.

3123

"cpe": "A String", # The CPE of the resource being scanned.

3124

"analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under

3125

# details to show to the user. The LocalizedMessage output only and

3126

# populated by the API.

3127

# different programming environments, including REST APIs and RPC APIs. It is

3128

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

3129

# three pieces of data: error code, error message, and error details.

3130

#

3131

# You can find out more about this error model and how to work with it in the

3132

# [API Design Guide](https://cloud.google.com/apis/design/errors).

3133

"message": "A String", # A developer-facing error message, which should be in English. Any

3134

# user-facing error message should be localized and sent in the

3135

# google.rpc.Status.details field, or localized by the client.

3136

"details": [ # A list of messages that carry the error details. There is a common set of

3137

# message types for APIs to use.

3138

{

3139

"a_key": "", # Properties of the object. Contains field @type with type URL.

3140

},

3141

],

3142

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

3143

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3144

"operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.

3145

# This field is deprecated, do not use.

3146

# network API call.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3147

"response": { # The normal response of the operation in case of success. If the original

3148

# method returns no data on success, such as `Delete`, the response is

3149

# `google.protobuf.Empty`. If the original method is standard

3150

# `Get`/`Create`/`Update`, the response should be the resource. For other

3151

# methods, the response should have the type `XxxResponse`, where `Xxx`

3152

# is the original method name. For example, if the original method name

3153

# is `TakeSnapshot()`, the inferred response type is

3154

# `TakeSnapshotResponse`.

3155

"a_key": "", # Properties of the object. Contains field @type with type URL.

3156

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3157

"name": "A String", # The server-assigned name, which is only unique within the same service that

3158

# originally returns it. If you use the default HTTP mapping, the

3159

# `name` should be a resource name ending with `operations/{unique_id}`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3160

"metadata": { # Service-specific metadata associated with the operation. It typically

3161

# contains progress information and common metadata such as create time.

3162

# Some services might not provide such metadata. Any method that returns a

3163

# long-running operation should document the metadata type, if any.

3164

"a_key": "", # Properties of the object. Contains field @type with type URL.

3165

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3166

"error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.

3167

# different programming environments, including REST APIs and RPC APIs. It is

3168

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

3169

# three pieces of data: error code, error message, and error details.

3170

#

3171

# You can find out more about this error model and how to work with it in the

3172

# [API Design Guide](https://cloud.google.com/apis/design/errors).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3173

"message": "A String", # A developer-facing error message, which should be in English. Any

3174

# user-facing error message should be localized and sent in the

3175

# google.rpc.Status.details field, or localized by the client.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3176

"details": [ # A list of messages that carry the error details. There is a common set of

3177

# message types for APIs to use.

3178

{

3179

"a_key": "", # Properties of the object. Contains field @type with type URL.

3180

},

3181

],

3182

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3183

},

3184

"done": True or False, # If the value is `false`, it means the operation is still in progress.

3185

# If `true`, the operation is completed, and either `error` or `response` is

3186

# available.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3187

},

3188

"analysisStatus": "A String", # The status of discovery for the resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3189

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3190

"createTime": "A String", # Output only. The time this `Occurrence` was created.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3191

"updateTime": "A String", # Output only. The time this `Occurrence` was last updated.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3192

}

3193

3194

updateMask: string, The fields to update.

3195

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

3202

3203

{ # `Occurrence` includes information about analysis occurrences for an image.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3204

"resource": { # #

3205

# The resource for which the `Occurrence` applies.

3206

# Resource is an entity that can have metadata. E.g., a Docker image.

3207

"uri": "A String", # The unique URI of the resource. E.g.,

3208

# "https://gcr.io/project/image@sha256:foo" for a Docker image.

3209

"name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".

3210

"contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.

3211

"type": "A String", # The type of hash that was performed.

3212

"value": "A String", # The hash value.

3213

},

3214

},

3215

"vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.

3216

# to fix it.

3217

"packageIssue": [ # The set of affected locations and their fixes (if available) within

3218

# the associated resource.

3219

{ # This message wraps a location affected by a vulnerability and its

3220

# associated fix (if one is available).

3221

"affectedLocation": { # The location of the vulnerability # The location of the vulnerability.

3222

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

3223

# filter in list requests.

3224

# For a discussion of this in Debian/Ubuntu:

3225

# http://serverfault.com/questions/604541/debian-packages-version-convention

3226

# For a discussion of this in Redhat/Fedora/Centos:

3227

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

3228

"name": "A String", # The main part of the version name.

3229

"revision": "A String", # The iteration of the package build from the above version.

3230

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

3231

# If kind is not NORMAL, then the other fields are ignored.

3232

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

3233

},

3234

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

3235

# format. Examples include distro or storage location for vulnerable jar.

3236

# This field can be used as a filter in list requests.

3237

"package": "A String", # The package being described.

3238

},

3239

"fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.

3240

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

3241

# filter in list requests.

3242

# For a discussion of this in Debian/Ubuntu:

3243

# http://serverfault.com/questions/604541/debian-packages-version-convention

3244

# For a discussion of this in Redhat/Fedora/Centos:

3245

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

3246

"name": "A String", # The main part of the version name.

3247

"revision": "A String", # The iteration of the package build from the above version.

3248

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

3249

# If kind is not NORMAL, then the other fields are ignored.

3250

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

3251

},

3252

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

3253

# format. Examples include distro or storage location for vulnerable jar.

3254

# This field can be used as a filter in list requests.

3255

"package": "A String", # The package being described.

3256

},

3257

"severityName": "A String",

3258

},

3259

],

3260

"effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is

3261

# available and note provider assigned severity when distro has not yet

3262

# assigned a severity for this vulnerability.

3263

"type": "A String", # The type of package; whether native or non native(ruby gems,

3264

# node.js packages etc)

3265

"severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.

3266

"cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a

3267

# scale of 0-10 where 0 indicates low severity and 10 indicates high

3268

# severity.

3269

},

3270

"attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.

3271

# Attestation can be verified using the attached signature. If the verifier

3272

# trusts the public key of the signer, then verifying the signature is

3273

# sufficient to establish trust. In this circumstance, the

3274

# AttestationAuthority to which this Attestation is attached is primarily

3275

# useful for look-up (how to find this Attestation if you already know the

3276

# Authority and artifact to be verified) and intent (which authority was this

3277

# attestation intended to sign for).

3278

"pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.

3279

# This message only supports `ATTACHED` signatures, where the payload that is

3280

# signed is included alongside the signature itself in the same file.

3281

"pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,

3282

# as output by, e.g. `gpg --list-keys`. This should be the version 4, full

3283

# 160-bit fingerprint, expressed as a 40 character hexadecimal string. See

3284

# https://tools.ietf.org/html/rfc4880#section-12.2 for details.

3285

# Implementations may choose to acknowledge "LONG", "SHORT", or other

3286

# abbreviated key IDs, but only the full fingerprint is guaranteed to work.

3287

# In gpg, the full fingerprint can be retrieved from the `fpr` field

3288

# returned when calling --list-keys with --with-colons. For example:

3289

# ```

3290

# gpg --with-colons --with-fingerprint --force-v4-certs \

3291

# --list-keys attester@example.com

3292

# tru::1:1513631572:0:3:1:5

3293

# pub:...<SNIP>...

3294

# fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:

3295

# ```

3296

# Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.

3297

"signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or

3298

# equivalent. Since this message only supports attached signatures, the

3299

# payload that was signed must be attached. While the signature format

3300

# supported is dependent on the verification implementation, currently only

3301

# ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than

3302

# `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor

3303

# --output=signature.gpg payload.json` will create the signature content

3304

# expected in this field in `signature.gpg` for the `payload.json`

3305

# attestation payload.

3306

"contentType": "A String", # Type (for example schema) of the attestation payload that was signed.

3307

# The verifier must ensure that the provided type is one that the verifier

3308

# supports, and that the attestation payload is a valid instantiation of that

3309

# type (for example by validating a JSON schema).

3310

},

3311

},

3312

"kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are

3313

# specified. This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3314

"buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3315

"provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance

3316

# details about the build from source to completion.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3317

"sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3318

"context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.

3319

# with a path point to a unique revision of a single file or directory.

3320

"labels": { # Labels with user defined metadata.

3321

"a_key": "A String",

3322

},

3323

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

3324

# repository (e.g., GitHub).

3325

"url": "A String", # Git repository URL.

3326

"revisionId": "A String", # Required. Git commit hash.

3327

},

3328

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

3329

# Source Repo.

3330

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

3331

"kind": "A String", # The alias kind.

3332

"name": "A String", # The alias name.

3333

},

3334

"revisionId": "A String", # A revision ID.

3335

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

3336

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

3337

# winged-cargo-31) and a repo name within that project.

3338

"projectId": "A String", # The ID of the project.

3339

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

3340

},

3341

"uid": "A String", # A server-assigned, globally unique identifier.

3342

},

3343

},

3344

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

3345

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

3346

# "project/subproject" is a valid project name. The "repo name" is

3347

# the hostURI/project.

3348

"hostUri": "A String", # The URI of a running Gerrit instance.

3349

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

3350

"kind": "A String", # The alias kind.

3351

"name": "A String", # The alias name.

3352

},

3353

"revisionId": "A String", # A revision (commit) ID.

3354

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3355

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3356

"additionalContexts": [ # If provided, some of the source code used for the build may be found in

3357

# these locations, in the case where the source repository had multiple

3358

# remotes or submodules. This list will not include the context specified in

3359

# the context field.

3360

{ # A SourceContext is a reference to a tree of files. A SourceContext together

3361

# with a path point to a unique revision of a single file or directory.

3362

"labels": { # Labels with user defined metadata.

3363

"a_key": "A String",

3364

},

3365

"git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).

3366

# repository (e.g., GitHub).

3367

"url": "A String", # Git repository URL.

3368

"revisionId": "A String", # Required. Git commit hash.

3369

},

3370

"cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.

3371

# Source Repo.

3372

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

3373

"kind": "A String", # The alias kind.

3374

"name": "A String", # The alias name.

3375

},

3376

"revisionId": "A String", # A revision ID.

3377

"repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.

3378

"projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.

3379

# winged-cargo-31) and a repo name within that project.

3380

"projectId": "A String", # The ID of the project.

3381

"repoName": "A String", # The name of the repo. Leave empty for the default repo.

3382

},

3383

"uid": "A String", # A server-assigned, globally unique identifier.

3384

},

3385

},

3386

"gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.

3387

"gerritProject": "A String", # The full project name within the host. Projects may be nested, so

3388

# "project/subproject" is a valid project name. The "repo name" is

3389

# the hostURI/project.

3390

"hostUri": "A String", # The URI of a running Gerrit instance.

3391

"aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.

3392

"kind": "A String", # The alias kind.

3393

"name": "A String", # The alias name.

3394

},

3395

"revisionId": "A String", # A revision (commit) ID.

},

},

],

"artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this

3400

# location.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3401

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3402

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3403

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3404

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

3405

# Requirements]

3406

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3407

},

3408

"repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.

3409

# Repository.

3410

"tagName": "A String", # Name of the tag to build.

3411

"branchName": "A String", # Name of the branch to build.

3412

"projectId": "A String", # ID of the project that owns the repo.

3413

"repoName": "A String", # Name of the repo.

3414

"commitSha": "A String", # Explicit commit SHA to build.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3415

},

3416

"fileHashes": { # Hash(es) of the build source, which can be used to verify that the original

3417

# source integrity was maintained in the build.

3418

#

3419

# The keys to this map are file paths used as build source and the values

3420

# contain the hash values for those files.

3421

#

3422

# If the build source came in a single package such as a gzipped tarfile

3423

# (.tar.gz), the FileHash will be for the single path to that file.

3424

"a_key": { # Container message for hashes of byte content of files, used in Source

3425

# messages to verify integrity of source input to the build.

3426

"fileHash": [ # Collection of file hashes.

3427

{ # Container message for hash values.

3428

"type": "A String", # The type of hash that was performed.

3429

"value": "A String", # The hash value.

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3434

"storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud

3435

# Storage.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3436

# Google Cloud Storage.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3437

"generation": "A String", # Google Cloud Storage generation for the object.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3438

"object": "A String", # Google Cloud Storage object containing source.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3439

"bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name

3440

# Requirements]

3441

# (https://cloud.google.com/storage/docs/bucket-naming#requirements)).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3442

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3443

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3444

"builtArtifacts": [ # Output of the build.

3445

{ # Artifact describes a build product.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3446

"name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in

3447

# the case of a container build, the name used to push the container image to

3448

# Google Container Registry, as presented to `docker push`.

3449

#

3450

# This field is deprecated in favor of the plural `names` field; it continues

3451

# to exist here to allow existing BuildProvenance serialized to json in

3452

# google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to

3453

# deserialize back into proto.

3454

"checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a

3455

# container.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3456

"names": [ # Related artifact names. This may be the path to a binary or jar file, or in

3457

# the case of a container build, the name used to push the container image to

3458

# Google Container Registry, as presented to `docker push`. Note that a

3459

# single Artifact ID can have multiple names, for example if two tags are

3460

# applied to one image.

3461

"A String",

3462

],

3463

"id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest

3464

# like gcr.io/projectID/imagename@sha256:123456

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3465

},

3466

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3467

"id": "A String", # Unique identifier of the build.

3468

"createTime": "A String", # Time at which the build was created.

3469

"buildOptions": { # Special options applied to this build. This is a catch-all field where

3470

# build providers can enter any desired additional details.

3471

"a_key": "A String",

3472

},

3473

"logsBucket": "A String", # Google Cloud Storage bucket where logs were written.

3474

"finishTime": "A String", # Time at which execution of the build was finished.

3475

"creator": "A String", # E-mail address of the user who initiated this build. Note that this was the

3476

# user's e-mail address at the time the build was initiated; this address may

3477

# not represent the same end-user for all time.

3478

"projectId": "A String", # ID of the project.

3479

"startTime": "A String", # Time at which execution of the build was started.

3480

"commands": [ # Commands requested by the build.

3481

{ # Command describes a step performed as part of the build pipeline.

3482

"dir": "A String", # Working directory (relative to project source root) used when running

3483

# this Command.

3484

"env": [ # Environment variables set before running this Command.

3485

"A String",

3486

],

3487

"args": [ # Command-line arguments used when executing this Command.

3488

"A String",

3489

],

3490

"id": "A String", # Optional unique identifier for this Command, used in wait_for to reference

3491

# this Command as a dependency.

3492

"name": "A String", # Name of the command, as presented on the command line, or if the command is

3493

# packaged as a Docker container, as presented to `docker pull`.

3494

"waitFor": [ # The ID(s) of the Command(s) that this Command depends on.

"A String",

],

},

],

"triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.

3500

"builderVersion": "A String", # Version string of the builder at the time this build was executed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3501

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3502

"provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the

3503

# `BuildSignature` in the corresponding Result. After verifying the

3504

# signature, `provenance_bytes` can be unmarshalled and compared to the

3505

# provenance to confirm that it is unchanged. A base64-encoded string

3506

# representation of the provenance bytes is used for the signature in order

3507

# to interoperate with openssl which expects this format for signature

3508

# verification.

3509

#

3510

# The serialized form is captured both to avoid ambiguity in how the

3511

# provenance is marshalled to json as well to prevent incompatibilities with

3512

# future changes.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3513

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3514

"name": "A String", # Output only. The name of the `Occurrence` in the form

3515

# "projects/{project_id}/occurrences/{OCCURRENCE_ID}"

3516

"deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.

3517

"undeployTime": "A String", # End of the lifetime of this deployment.

3518

"address": "A String", # Address of the runtime element hosting this deployment.

3519

"platform": "A String", # Platform hosting this deployment.

3520

"config": "A String", # Configuration used to create this deployment.

3521

"deployTime": "A String", # Beginning of the lifetime of this deployment.

3522

"resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the

3523

# deployable field with the same name.

3524

"A String",

3525

],

3526

"userEmail": "A String", # Identity of the user that triggered this deployment.

3527

},

3528

"upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.

3529

# specific upgrade. This presence is supplied via local sources (i.e. it is

3530

# present in the mirror and the running system has noticed its availability).

3531

"package": "A String", # Required - The package this Upgrade is for.

3532

"distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system

3533

# for the resource_url. This allows efficient filtering, as well as

3534

# making it easier to use the occurrence.

3535

# operating system (CPE). Some distributions have additional metadata around

3536

# updates, classifying them into various categories and severities.

3537

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

3538

# upstream operating system upgrade feed.

3539

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

3540

# https://cpe.mitre.org/specification/.

3541

"severity": "A String", # The severity as specified by the upstream operating system.

3542

"cve": [ # The cve that would be resolved by this upgrade.

3543

"A String",

3544

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3545

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3546

"parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.

3547

# For a discussion of this in Debian/Ubuntu:

3548

# http://serverfault.com/questions/604541/debian-packages-version-convention

3549

# For a discussion of this in Redhat/Fedora/Centos:

3550

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

3551

"name": "A String", # The main part of the version name.

3552

"revision": "A String", # The iteration of the package build from the above version.

3553

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

3554

# If kind is not NORMAL, then the other fields are ignored.

3555

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

3556

},

3557

},

3558

"derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis

3559

# in the associated note.

3560

# DockerImage relationship. This image would be produced from a Dockerfile

3561

# with FROM <DockerImage.Basis in attached Note>.

3562

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.

3563

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

3564

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

3565

# Only the name of the final blob is kept.

3566

# This field can be used as a filter in list requests.

3567

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

3568

"A String",

3569

],

3570

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

3571

# representation.

3572

# This field can be used as a filter in list requests.

3573

},

3574

"layerInfo": [ # This contains layer-specific metadata, if populated it has length

3575

# "distance" and is ordered with [distance] being the layer immediately

3576

# following the base image and [1] being the final layer.

3577

{ # Layer holds metadata specific to a layer of a Docker image.

3578

"arguments": "A String", # The recovered arguments to the Dockerfile directive.

3579

"directive": "A String", # The recovered Dockerfile directive used to construct this layer.

3580

},

3581

],

3582

"baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image

3583

# occurrence.

3584

"distance": 42, # Output only. The number of layers by which this image differs from the

3585

# associated image basis.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3586

},

3587

"resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`

3588

# applies. For example, https://gcr.io/project/image@sha256:foo This field

3589

# can be used as a filter in list requests.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3590

"remediation": "A String", # A description of actions that can be taken to remedy the `Note`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3591

"installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.

3592

# a system.

3593

"location": [ # All of the places within the filesystem versions of this package

3594

# have been found.

3595

{ # An occurrence of a particular package installation found within a

3596

# system's filesystem.

3597

# e.g. glibc was found in /var/lib/dpkg/status

3598

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

3599

# denoting the package manager version distributing a package.

3600

"version": { # Version contains structured information about the version of the package. # The version installed at this location.

3601

# For a discussion of this in Debian/Ubuntu:

3602

# http://serverfault.com/questions/604541/debian-packages-version-convention

3603

# For a discussion of this in Redhat/Fedora/Centos:

3604

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

3605

"name": "A String", # The main part of the version name.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3606

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3607

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

3608

# If kind is not NORMAL, then the other fields are ignored.

3609

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3610

},

3611

"path": "A String", # The path from which we gathered that this package/version is installed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3612

},

3613

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3614

"name": "A String", # Output only. The name of the installed package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3615

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3616

"noteName": "A String", # An analysis note associated with this image, in the form

3617

# "providers/{provider_id}/notes/{NOTE_ID}"

3618

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3619

"discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3620

"continuousAnalysis": "A String", # Whether the resource is continuously analyzed.

3621

"cpe": "A String", # The CPE of the resource being scanned.

3622

"analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under

3623

# details to show to the user. The LocalizedMessage output only and

3624

# populated by the API.

3625

# different programming environments, including REST APIs and RPC APIs. It is

3626

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

3627

# three pieces of data: error code, error message, and error details.

3628

#

3629

# You can find out more about this error model and how to work with it in the

3630

# [API Design Guide](https://cloud.google.com/apis/design/errors).

3631

"message": "A String", # A developer-facing error message, which should be in English. Any

3632

# user-facing error message should be localized and sent in the

3633

# google.rpc.Status.details field, or localized by the client.

3634

"details": [ # A list of messages that carry the error details. There is a common set of

3635

# message types for APIs to use.

3636

{

3637

"a_key": "", # Properties of the object. Contains field @type with type URL.

3638

},

3639

],

3640

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

3641

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3642

"operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.

3643

# This field is deprecated, do not use.

3644

# network API call.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3645

"response": { # The normal response of the operation in case of success. If the original

3646

# method returns no data on success, such as `Delete`, the response is

3647

# `google.protobuf.Empty`. If the original method is standard

3648

# `Get`/`Create`/`Update`, the response should be the resource. For other

3649

# methods, the response should have the type `XxxResponse`, where `Xxx`

3650

# is the original method name. For example, if the original method name

3651

# is `TakeSnapshot()`, the inferred response type is

3652

# `TakeSnapshotResponse`.

3653

"a_key": "", # Properties of the object. Contains field @type with type URL.

3654

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3655

"name": "A String", # The server-assigned name, which is only unique within the same service that

3656

# originally returns it. If you use the default HTTP mapping, the

3657

# `name` should be a resource name ending with `operations/{unique_id}`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3658

"metadata": { # Service-specific metadata associated with the operation. It typically

3659

# contains progress information and common metadata such as create time.

3660

# Some services might not provide such metadata. Any method that returns a

3661

# long-running operation should document the metadata type, if any.

3662

"a_key": "", # Properties of the object. Contains field @type with type URL.

3663

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3664

"error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.

3665

# different programming environments, including REST APIs and RPC APIs. It is

3666

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

3667

# three pieces of data: error code, error message, and error details.

3668

#

3669

# You can find out more about this error model and how to work with it in the

3670

# [API Design Guide](https://cloud.google.com/apis/design/errors).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3671

"message": "A String", # A developer-facing error message, which should be in English. Any

3672

# user-facing error message should be localized and sent in the

3673

# google.rpc.Status.details field, or localized by the client.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3674

"details": [ # A list of messages that carry the error details. There is a common set of

3675

# message types for APIs to use.

3676

{

3677

"a_key": "", # Properties of the object. Contains field @type with type URL.

3678

},

3679

],

3680

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3681

},

3682

"done": True or False, # If the value is `false`, it means the operation is still in progress.

3683

# If `true`, the operation is completed, and either `error` or `response` is

3684

# available.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3685

},

3686

"analysisStatus": "A String", # The status of discovery for the resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3687

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3688

"createTime": "A String", # Output only. The time this `Occurrence` was created.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3689

"updateTime": "A String", # Output only. The time this `Occurrence` was last updated.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3694

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3695

<pre>Sets the access control policy on the specified `Note` or `Occurrence`.

3696

Requires `containeranalysis.notes.setIamPolicy` or

3697

`containeranalysis.occurrences.setIamPolicy` permission if the resource is

3698

a `Note` or an `Occurrence`, respectively.

3699

Attempting to call this method without these permissions will result in a `

3700

`PERMISSION_DENIED` error.

3701

Attempting to call this method on a non-existent resource will result in a

3702

`NOT_FOUND` error if the user has `containeranalysis.notes.list` permission

3703

on a `Note` or `containeranalysis.occurrences.list` on an `Occurrence`, or

3704

a `PERMISSION_DENIED` error otherwise. The resource takes the following

3705

formats: `projects/{projectid}/occurrences/{occurrenceid}` for occurrences

3706

and projects/{projectid}/notes/{noteid} for notes

3707

3708

Args:

3709

resource: string, REQUIRED: The resource for which the policy is being specified.

3710

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3711

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3712

The object takes the form of:

3713

3714

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3715

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3716

# the policy is limited to a few 10s of KB. An empty policy is a

3717

# valid policy but certain Cloud Platform services (such as Projects)

3718

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3719

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3720

#

3721

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3722

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

3723

# `members` to a single `role`. Members can be user accounts, service accounts,

3724

# Google groups, and domains (such as G Suite). A `role` is a named list of

3725

# permissions; each `role` can be an IAM predefined role or a user-created

3726

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3727

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3728

# For some types of Google Cloud resources, a `binding` can also specify a

3729

# `condition`, which is a logical expression that allows access to a resource

3730

# only if the expression evaluates to `true`. A condition can add constraints

3731

# based on attributes of the request, the resource, or both. To learn which

3732

# resources support conditions in their IAM policies, see the

3733

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3734

#

3735

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3736

#

3737

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3738

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3739

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3740

# "role": "roles/resourcemanager.organizationAdmin",

3741

# "members": [

3742

# "user:mike@example.com",

3743

# "group:admins@example.com",

3744

# "domain:google.com",

3745

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3746

# ]

3747

# },

3748

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3749

# "role": "roles/resourcemanager.organizationViewer",

3750

# "members": [

3751

# "user:eve@example.com"

3752

# ],

3753

# "condition": {

3754

# "title": "expirable access",

3755

# "description": "Does not grant access after Sep 2020",

3756

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3757

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3758

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3759

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3760

# "etag": "BwWWja0YfJA=",

3761

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3762

# }

3763

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3764

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

3769

# - group:admins@example.com

3770

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3771

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

3772

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3773

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3774

# - user:eve@example.com

3775

# role: roles/resourcemanager.organizationViewer

3776

# condition:

3777

# title: expirable access

3778

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3779

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3780

# - etag: BwWWja0YfJA=

3781

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3782

#

3783

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3784

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3785

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3786

# `condition` that determines how and when the `bindings` are applied. Each

3787

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3788

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3789

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

3790

#

3791

# If the condition evaluates to `true`, then this binding applies to the

3792

# current request.

3793

#

3794

# If the condition evaluates to `false`, then this binding does not apply to

3795

# the current request. However, a different role binding might grant the same

3796

# role to one or more of the members in this binding.

3797

#

3798

# To learn which resources support conditions in their IAM policies, see the

3799

# [IAM

3800

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

3801

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

3802

# are documented at https://github.com/google/cel-spec.

3803

#

3804

# Example (Comparison):

3805

#

3806

# title: "Summary size limit"

3807

# description: "Determines if a summary is less than 100 chars"

3808

# expression: "document.summary.size() < 100"

3809

#

3810

# Example (Equality):

3811

#

3812

# title: "Requestor is owner"

3813

# description: "Determines if requestor is the document owner"

3814

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

3819

# description: "Determine whether the document should be publicly visible"

3820

# expression: "document.type != 'private' && document.type != 'internal'"

3821

#

3822

# Example (Data Manipulation):

3823

#

3824

# title: "Notification string"

3825

# description: "Create a notification string with a timestamp."

3826

# expression: "'New message received at ' + string(document.create_time)"

3827

#

3828

# The exact variables and functions that may be referenced within an expression

3829

# are determined by the service that evaluates it. See the service

3830

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3831

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

3832

# its purpose. This can be used e.g. in UIs which allow to enter the

3833

# expression.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3834

"expression": "A String", # Textual representation of an expression in Common Expression Language

3835

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3836

"location": "A String", # Optional. String indicating the location of the expression for error

3837

# reporting, e.g. a file name and a position in the file.

3838

"description": "A String", # Optional. Description of the expression. This is a longer text which

3839

# describes the expression, e.g. when hovered over it in a UI.

3840

},

3841

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3842

# `members` can have the following values:

3843

#

3844

# * `allUsers`: A special identifier that represents anyone who is

3845

# on the internet; with or without a Google account.

3846

#

3847

# * `allAuthenticatedUsers`: A special identifier that represents anyone

3848

# who is authenticated with a Google account or a service account.

3849

#

3850

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3851

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3852

#

3853

#

3854

# * `serviceAccount:{emailid}`: An email address that represents a service

3855

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

3856

#

3857

# * `group:{emailid}`: An email address that represents a Google group.

3858

# For example, `admins@example.com`.

3859

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3860

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

3861

# identifier) representing a user that has been recently deleted. For

3862

# example, `alice@example.com?uid=123456789012345678901`. If the user is

3863

# recovered, this value reverts to `user:{emailid}` and the recovered user

3864

# retains the role in the binding.

3865

#

3866

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

3867

# unique identifier) representing a service account that has been recently

3868

# deleted. For example,

3869

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

3870

# If the service account is undeleted, this value reverts to

3871

# `serviceAccount:{emailid}` and the undeleted service account retains the

3872

# role in the binding.

3873

#

3874

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

3875

# identifier) representing a Google group that has been recently

3876

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

3877

# the group is recovered, this value reverts to `group:{emailid}` and the

3878

# recovered group retains the role in the binding.

3879

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3880

#

3881

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

3882

# users of that domain. For example, `google.com` or `example.com`.

3883

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3884

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3885

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3886

"role": "A String", # Role that is assigned to `members`.

3887

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3888

},

3889

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3890

"version": 42, # Specifies the format of the policy.

3891

#

3892

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

3893

# are rejected.

3894

#

3895

# Any operation that affects conditional role bindings must specify version

3896

# `3`. This requirement applies to the following operations:

3897

#

3898

# * Getting a policy that includes a conditional role binding

3899

# * Adding a conditional role binding to a policy

3900

# * Changing a conditional role binding in a policy

3901

# * Removing any role binding, with or without a condition, from a policy

3902

# that includes conditions

3903

#

3904

# **Important:** If you use IAM Conditions, you must include the `etag` field

3905

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

3906

# you to overwrite a version `3` policy with a version `1` policy, and all of

3907

# the conditions in the version `3` policy are lost.

3908

#

3909

# If a policy does not include any conditions, operations on that policy may

3910

# specify any valid version or leave the field unset.

3911

#

3912

# To learn which resources support conditions in their IAM policies, see the

3913

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

3914

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

3915

# prevent simultaneous updates of a policy from overwriting each other.

3916

# It is strongly suggested that systems make use of the `etag` in the

3917

# read-modify-write cycle to perform policy updates in order to avoid race

3918

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

3919

# systems are expected to put that etag in the request to `setIamPolicy` to

3920

# ensure that their change will be applied to the same version of the policy.

3921

#

3922

# **Important:** If you use IAM Conditions, you must include the `etag` field

3923

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

3924

# you to overwrite a version `3` policy with a version `1` policy, and all of

3925

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3926

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3927

}

3928

3929

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

3936

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3937

{ # An Identity and Access Management (IAM) policy, which specifies access

3938

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3939

#

3940

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3941

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

3942

# `members` to a single `role`. Members can be user accounts, service accounts,

3943

# Google groups, and domains (such as G Suite). A `role` is a named list of

3944

# permissions; each `role` can be an IAM predefined role or a user-created

3945

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3946

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3947

# For some types of Google Cloud resources, a `binding` can also specify a

3948

# `condition`, which is a logical expression that allows access to a resource

3949

# only if the expression evaluates to `true`. A condition can add constraints

3950

# based on attributes of the request, the resource, or both. To learn which

3951

# resources support conditions in their IAM policies, see the

3952

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3953

#

3954

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3955

#

3956

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3957

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3958

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3959

# "role": "roles/resourcemanager.organizationAdmin",

3960

# "members": [

3961

# "user:mike@example.com",

3962

# "group:admins@example.com",

3963

# "domain:google.com",

3964

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3965

# ]

3966

# },

3967

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3968

# "role": "roles/resourcemanager.organizationViewer",

3969

# "members": [

3970

# "user:eve@example.com"

3971

# ],

3972

# "condition": {

3973

# "title": "expirable access",

3974

# "description": "Does not grant access after Sep 2020",

3975

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3976

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3977

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3978

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3979

# "etag": "BwWWja0YfJA=",

3980

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3981

# }

3982

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3983

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

3988

# - group:admins@example.com

3989

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3990

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

3991

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3992

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3993

# - user:eve@example.com

3994

# role: roles/resourcemanager.organizationViewer

3995

# condition:

3996

# title: expirable access

3997

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3998

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3999

# - etag: BwWWja0YfJA=

4000

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4001

#

4002

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4003

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4004

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4005

# `condition` that determines how and when the `bindings` are applied. Each

4006

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4007

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4008

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

4009

#

4010

# If the condition evaluates to `true`, then this binding applies to the

4011

# current request.

4012

#

4013

# If the condition evaluates to `false`, then this binding does not apply to

4014

# the current request. However, a different role binding might grant the same

4015

# role to one or more of the members in this binding.

4016

#

4017

# To learn which resources support conditions in their IAM policies, see the

4018

# [IAM

4019

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

4020

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

4021

# are documented at https://github.com/google/cel-spec.

4022

#

4023

# Example (Comparison):

4024

#

4025

# title: "Summary size limit"

4026

# description: "Determines if a summary is less than 100 chars"

4027

# expression: "document.summary.size() < 100"

4028

#

4029

# Example (Equality):

4030

#

4031

# title: "Requestor is owner"

4032

# description: "Determines if requestor is the document owner"

4033

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

4038

# description: "Determine whether the document should be publicly visible"

4039

# expression: "document.type != 'private' && document.type != 'internal'"

4040

#

4041

# Example (Data Manipulation):

4042

#

4043

# title: "Notification string"

4044

# description: "Create a notification string with a timestamp."

4045

# expression: "'New message received at ' + string(document.create_time)"

4046

#

4047

# The exact variables and functions that may be referenced within an expression

4048

# are determined by the service that evaluates it. See the service

4049

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4050

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

4051

# its purpose. This can be used e.g. in UIs which allow to enter the

4052

# expression.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

4053

"expression": "A String", # Textual representation of an expression in Common Expression Language

4054

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4055

"location": "A String", # Optional. String indicating the location of the expression for error

4056

# reporting, e.g. a file name and a position in the file.

4057

"description": "A String", # Optional. Description of the expression. This is a longer text which

4058

# describes the expression, e.g. when hovered over it in a UI.

4059

},

4060

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4061

# `members` can have the following values:

4062

#

4063

# * `allUsers`: A special identifier that represents anyone who is

4064

# on the internet; with or without a Google account.

4065

#

4066

# * `allAuthenticatedUsers`: A special identifier that represents anyone

4067

# who is authenticated with a Google account or a service account.

4068

#

4069

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4070

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4071

#

4072

#

4073

# * `serviceAccount:{emailid}`: An email address that represents a service

4074

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

4075

#

4076

# * `group:{emailid}`: An email address that represents a Google group.

4077

# For example, `admins@example.com`.

4078

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4079

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

4080

# identifier) representing a user that has been recently deleted. For

4081

# example, `alice@example.com?uid=123456789012345678901`. If the user is

4082

# recovered, this value reverts to `user:{emailid}` and the recovered user

4083

# retains the role in the binding.

4084

#

4085

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

4086

# unique identifier) representing a service account that has been recently

4087

# deleted. For example,

4088

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

4089

# If the service account is undeleted, this value reverts to

4090

# `serviceAccount:{emailid}` and the undeleted service account retains the

4091

# role in the binding.

4092

#

4093

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

4094

# identifier) representing a Google group that has been recently

4095

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

4096

# the group is recovered, this value reverts to `group:{emailid}` and the

4097

# recovered group retains the role in the binding.

4098

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4099

#

4100

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

4101

# users of that domain. For example, `google.com` or `example.com`.

4102

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4103

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4104

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

4105

"role": "A String", # Role that is assigned to `members`.

4106

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4107

},

4108

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

4109

"version": 42, # Specifies the format of the policy.

4110

#

4111

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

4112

# are rejected.

4113

#

4114

# Any operation that affects conditional role bindings must specify version

4115

# `3`. This requirement applies to the following operations:

4116

#

4117

# * Getting a policy that includes a conditional role binding

4118

# * Adding a conditional role binding to a policy

4119

# * Changing a conditional role binding in a policy

4120

# * Removing any role binding, with or without a condition, from a policy

4121

# that includes conditions

4122

#

4123

# **Important:** If you use IAM Conditions, you must include the `etag` field

4124

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

4125

# you to overwrite a version `3` policy with a version `1` policy, and all of

4126

# the conditions in the version `3` policy are lost.

4127

#

4128

# If a policy does not include any conditions, operations on that policy may

4129

# specify any valid version or leave the field unset.

4130

#

4131

# To learn which resources support conditions in their IAM policies, see the

4132

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

4133

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

4134

# prevent simultaneous updates of a policy from overwriting each other.

4135

# It is strongly suggested that systems make use of the `etag` in the

4136

# read-modify-write cycle to perform policy updates in order to avoid race

4137

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

4138

# systems are expected to put that etag in the request to `setIamPolicy` to

4139

# ensure that their change will be applied to the same version of the policy.

4140

#

4141

# **Important:** If you use IAM Conditions, you must include the `etag` field

4142

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

4143

# you to overwrite a version `3` policy with a version `1` policy, and all of

4144

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4149

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4150

<pre>Returns the permissions that a caller has on the specified note or

4151

occurrence resource. Requires list permission on the project (for example,

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4152

"storage.objects.list" on the containing bucket for testing permission of

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4153

an object). Attempting to call this method on a non-existent resource will

4154

result in a `NOT_FOUND` error if the user has list permission on the

4155

project, or a `PERMISSION_DENIED` error otherwise. The resource takes the

4156

following formats: `projects/{PROJECT_ID}/occurrences/{OCCURRENCE_ID}` for

4157

`Occurrences` and `projects/{PROJECT_ID}/notes/{NOTE_ID}` for `Notes`

4158

4159

Args:

4160

resource: string, REQUIRED: The resource for which the policy detail is being requested.

4161

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4162

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4163

The object takes the form of:

4164

4165

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4166

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

4167

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4168

# information see

4169

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4170

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

4181

4182

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4183

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4184

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4185

"A String",

Bu Sun Kim