Blame - docs/dyn/containeranalysis_v1alpha1.projects.notes.html - platform/external/python/google-api-python-client

2020-05-01 07:42:23 -0700

[diff] [blame]

83

<code><a href="#create">create(parent, body=None, name=None, noteId=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

84

<p class="firstline">Creates a new `Note`.</p>

85

86

<code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>

87

<p class="firstline">Deletes the given `Note` from the system.</p>

88

89

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

90

<p class="firstline">Returns the requested `Note`.</p>

91

92

<code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

93

<p class="firstline">Gets the access control policy for a note or an `Occurrence` resource.</p>

94

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

95

<code><a href="#list">list(parent, filter=None, name=None, pageToken=None, pageSize=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

96

<p class="firstline">Lists all `Notes` for a given project.</p>

97

98

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

99

<p class="firstline">Retrieves the next page of results.</p>

100

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

101

<code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

102

<p class="firstline">Updates an existing `Note`.</p>

103

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

104

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

105

<p class="firstline">Sets the access control policy on the specified `Note` or `Occurrence`.</p>

106

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

107

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

108

<p class="firstline">Returns the permissions that a caller has on the specified note or</p>

109

<h3>Method Details</h3>

110

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

111

<code class="details" id="create">create(parent, body=None, name=None, noteId=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

112

<pre>Creates a new `Note`.

113

114

Args:

115

parent: string, This field contains the project Id for example:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

116

"projects/{project_id} (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

117

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

118

The object takes the form of:

119

120

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

121

"relatedUrl": [ # URLs associated with this note

122

{ # Metadata for any related URL information

123

"url": "A String", # Specific URL to associate with the note

124

"label": "A String", # Label to describe usage of the URL

125

},

126

],

127

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

128

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

129

# relationship. Linked occurrences are derived from this or an

130

# equivalent image via:

131

# FROM <Basis.resource_url>

132

# Or an equivalent reference, e.g. a tag of the resource_url.

133

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

134

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

135

"A String",

136

],

137

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

138

# representation.

139

# This field can be used as a filter in list requests.

140

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

141

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

142

# Only the name of the final blob is kept.

143

# This field can be used as a filter in list requests.

144

},

145

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

146

# associated occurrence images.

147

},

148

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

149

# field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

150

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

151

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

152

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

153

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

154

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

155

# findings are valid and unchanged. If `key_type` is empty, this defaults

156

# to PEM encoded public keys.

157

#

158

# This field may be empty if `key_id` references an external key.

159

#

160

# For Cloud Build based signatures, this is a PEM encoded public

161

# key. To verify the Cloud Build signature, place the contents of

162

# this field into a file (public.pem). The signature field is base64-decoded

163

# into its binary representation in signature.bin, and the provenance bytes

164

# from `BuildDetails` are base64-decoded into a binary representation in

165

# signed.bin. OpenSSL can then verify the signature:

166

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

167

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

168

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

169

# CN for a cert), or a reference to an external key (such as a reference to a

170

# key in Cloud Key Management Service).

171

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

172

# `key_id`

173

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

174

},

175

"builderVersion": "A String", # Version of the builder which produced this Note.

176

},

177

"longDescription": "A String", # A detailed description of this `Note`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

178

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

179

"resourceUri": [ # Resource URI for the artifact being deployed.

180

"A String",

181

],

182

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

183

"shortDescription": "A String", # A one sentence description of this `Note`.

184

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

185

# example, an organization might have one `AttestationAuthority` for "QA" and

186

# one for "build". This Note is intended to act strictly as a grouping

187

# mechanism for the attached Occurrences (Attestations). This grouping

188

# mechanism also provides a security boundary, since IAM ACLs gate the ability

189

# for a principle to attach an Occurrence to a given Note. It also provides a

190

# single point of lookup to find all attached Attestation Occurrences, even if

191

# they don't all live in the same project.

192

"hint": { # This submessage provides human-readable hints about the purpose of the

193

# AttestationAuthority. Because the name of a Note acts as its resource

194

# reference, it is important to disambiguate the canonical name of the Note

195

# (which might be a UUID for security purposes) from "readable" names more

196

# suitable for debug output. Note that these hints should NOT be used to

197

# look up AttestationAuthorities in security sensitive contexts, such as when

198

# looking up Attestations to verify.

199

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

200

},

201

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

202

"name": "A String", # The name of the note in the form

203

# "projects/{provider_project_id}/notes/{NOTE_ID}"

204

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

205

"severity": "A String", # Note provider assigned impact of the vulnerability

206

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

207

# vulnerability. One entry per (version range and cpe_uri) the

208

# package vulnerability has manifested in.

209

{ # Identifies all occurrences of this vulnerability in the package for a

210

# specific distro/location

211

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

212

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

213

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

214

# filter in list requests.

215

# For a discussion of this in Debian/Ubuntu:

216

# http://serverfault.com/questions/604541/debian-packages-version-convention

217

# For a discussion of this in Redhat/Fedora/Centos:

218

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

219

"name": "A String", # The main part of the version name.

220

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

221

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

222

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

223

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

224

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

225

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

226

# format. Examples include distro or storage location for vulnerable jar.

227

# This field can be used as a filter in list requests.

228

"package": "A String", # The package being described.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

229

},

230

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

231

# node.js packages etc)

232

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

233

# which the vulnerability manifests. Examples include distro or storage

234

# location for vulnerable jar.

235

# This field can be used as a filter in list requests.

236

"description": "A String", # A vendor-specific description of this note.

237

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

238

# For a discussion of this in Debian/Ubuntu:

239

# http://serverfault.com/questions/604541/debian-packages-version-convention

240

# For a discussion of this in Redhat/Fedora/Centos:

241

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

242

"name": "A String", # The main part of the version name.

243

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

244

# If kind is not NORMAL, then the other fields are ignored.

245

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

246

"revision": "A String", # The iteration of the package build from the above version.

247

},

248

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

249

"package": "A String", # The name of the package where the vulnerability was found.

250

# This field can be used as a filter in list requests.

251

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

252

# For a discussion of this in Debian/Ubuntu:

253

# http://serverfault.com/questions/604541/debian-packages-version-convention

254

# For a discussion of this in Redhat/Fedora/Centos:

255

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

256

"name": "A String", # The main part of the version name.

257

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

258

# If kind is not NORMAL, then the other fields are ignored.

259

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

260

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

261

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

262

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

263

# obsolete details.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

264

},

265

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

266

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

267

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

268

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

269

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

270

# bash 4.1.2), there will be a Upgrade Note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

271

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

272

# For a discussion of this in Debian/Ubuntu:

273

# http://serverfault.com/questions/604541/debian-packages-version-convention

274

# For a discussion of this in Redhat/Fedora/Centos:

275

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

276

"name": "A String", # The main part of the version name.

277

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

278

# If kind is not NORMAL, then the other fields are ignored.

279

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

280

"revision": "A String", # The iteration of the package build from the above version.

281

},

282

"distributions": [ # Metadata about the upgrade for each specific operating system.

283

{ # The Upgrade Distribution represents metadata about the Upgrade for each

284

# operating system (CPE). Some distributions have additional metadata around

285

# updates, classifying them into various categories and severities.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

286

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

287

# upstream operating system upgrade feed.

288

"severity": "A String", # The severity as specified by the upstream operating system.

289

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

290

# https://cpe.mitre.org/specification/.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

291

"cve": [ # The cve that would be resolved by this upgrade.

292

"A String",

293

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

294

},

295

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

296

"package": "A String", # Required - The package this Upgrade is for.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

297

},

298

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

299

# various channels.

300

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

301

"name": "A String", # The name of the package.

302

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

303

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

304

# e.g. Debian's jessie-backports dpkg mirror

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

305

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

306

# this distribution channel.

307

# For a discussion of this in Debian/Ubuntu:

308

# http://serverfault.com/questions/604541/debian-packages-version-convention

309

# For a discussion of this in Redhat/Fedora/Centos:

310

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

311

"name": "A String", # The main part of the version name.

312

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

313

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

314

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

315

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

316

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

317

"description": "A String", # The distribution channel-specific description of this package.

318

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

319

# denoting the package manager version distributing a package.

320

"url": "A String", # The distribution channel-specific homepage for this package.

321

"architecture": "A String", # The CPU architecture for which packages in this distribution

322

# channel were built

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

323

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

324

},

325

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

326

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

327

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

328

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

329

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

330

# exists in a provider's project. A `Discovery` occurrence is created in a

331

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

332

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

333

# note for a resource indicates that analysis hasn't started.

334

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

335

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

336

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

337

# a filter in list requests.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

341

Should be of the form "providers/{provider_id}".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

342

@Deprecated

343

noteId: string, The ID to use for this note.

344

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

351

352

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

353

"relatedUrl": [ # URLs associated with this note

354

{ # Metadata for any related URL information

355

"url": "A String", # Specific URL to associate with the note

356

"label": "A String", # Label to describe usage of the URL

357

},

358

],

359

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

360

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

361

# relationship. Linked occurrences are derived from this or an

362

# equivalent image via:

363

# FROM <Basis.resource_url>

364

# Or an equivalent reference, e.g. a tag of the resource_url.

365

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

366

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

367

"A String",

368

],

369

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

370

# representation.

371

# This field can be used as a filter in list requests.

372

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

373

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

374

# Only the name of the final blob is kept.

375

# This field can be used as a filter in list requests.

376

},

377

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

378

# associated occurrence images.

379

},

380

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

381

# field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

382

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

383

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

384

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

385

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

386

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

387

# findings are valid and unchanged. If `key_type` is empty, this defaults

388

# to PEM encoded public keys.

389

#

390

# This field may be empty if `key_id` references an external key.

391

#

392

# For Cloud Build based signatures, this is a PEM encoded public

393

# key. To verify the Cloud Build signature, place the contents of

394

# this field into a file (public.pem). The signature field is base64-decoded

395

# into its binary representation in signature.bin, and the provenance bytes

396

# from `BuildDetails` are base64-decoded into a binary representation in

397

# signed.bin. OpenSSL can then verify the signature:

398

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

399

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

400

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

401

# CN for a cert), or a reference to an external key (such as a reference to a

402

# key in Cloud Key Management Service).

403

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

404

# `key_id`

405

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

406

},

407

"builderVersion": "A String", # Version of the builder which produced this Note.

408

},

409

"longDescription": "A String", # A detailed description of this `Note`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

410

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

411

"resourceUri": [ # Resource URI for the artifact being deployed.

412

"A String",

413

],

414

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

415

"shortDescription": "A String", # A one sentence description of this `Note`.

416

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

417

# example, an organization might have one `AttestationAuthority` for "QA" and

418

# one for "build". This Note is intended to act strictly as a grouping

419

# mechanism for the attached Occurrences (Attestations). This grouping

420

# mechanism also provides a security boundary, since IAM ACLs gate the ability

421

# for a principle to attach an Occurrence to a given Note. It also provides a

422

# single point of lookup to find all attached Attestation Occurrences, even if

423

# they don't all live in the same project.

424

"hint": { # This submessage provides human-readable hints about the purpose of the

425

# AttestationAuthority. Because the name of a Note acts as its resource

426

# reference, it is important to disambiguate the canonical name of the Note

427

# (which might be a UUID for security purposes) from "readable" names more

428

# suitable for debug output. Note that these hints should NOT be used to

429

# look up AttestationAuthorities in security sensitive contexts, such as when

430

# looking up Attestations to verify.

431

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

432

},

433

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

434

"name": "A String", # The name of the note in the form

435

# "projects/{provider_project_id}/notes/{NOTE_ID}"

436

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

437

"severity": "A String", # Note provider assigned impact of the vulnerability

438

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

439

# vulnerability. One entry per (version range and cpe_uri) the

440

# package vulnerability has manifested in.

441

{ # Identifies all occurrences of this vulnerability in the package for a

442

# specific distro/location

443

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

444

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

445

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

446

# filter in list requests.

447

# For a discussion of this in Debian/Ubuntu:

448

# http://serverfault.com/questions/604541/debian-packages-version-convention

449

# For a discussion of this in Redhat/Fedora/Centos:

450

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

451

"name": "A String", # The main part of the version name.

452

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

453

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

454

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

455

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

456

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

457

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

458

# format. Examples include distro or storage location for vulnerable jar.

459

# This field can be used as a filter in list requests.

460

"package": "A String", # The package being described.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

461

},

462

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

463

# node.js packages etc)

464

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

465

# which the vulnerability manifests. Examples include distro or storage

466

# location for vulnerable jar.

467

# This field can be used as a filter in list requests.

468

"description": "A String", # A vendor-specific description of this note.

469

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

470

# For a discussion of this in Debian/Ubuntu:

471

# http://serverfault.com/questions/604541/debian-packages-version-convention

472

# For a discussion of this in Redhat/Fedora/Centos:

473

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

474

"name": "A String", # The main part of the version name.

475

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

476

# If kind is not NORMAL, then the other fields are ignored.

477

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

478

"revision": "A String", # The iteration of the package build from the above version.

479

},

480

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

481

"package": "A String", # The name of the package where the vulnerability was found.

482

# This field can be used as a filter in list requests.

483

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

484

# For a discussion of this in Debian/Ubuntu:

485

# http://serverfault.com/questions/604541/debian-packages-version-convention

486

# For a discussion of this in Redhat/Fedora/Centos:

487

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

488

"name": "A String", # The main part of the version name.

489

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

490

# If kind is not NORMAL, then the other fields are ignored.

491

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

492

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

493

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

494

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

495

# obsolete details.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

496

},

497

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

498

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

499

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

500

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

501

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

502

# bash 4.1.2), there will be a Upgrade Note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

503

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

504

# For a discussion of this in Debian/Ubuntu:

505

# http://serverfault.com/questions/604541/debian-packages-version-convention

506

# For a discussion of this in Redhat/Fedora/Centos:

507

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

508

"name": "A String", # The main part of the version name.

509

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

510

# If kind is not NORMAL, then the other fields are ignored.

511

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

512

"revision": "A String", # The iteration of the package build from the above version.

513

},

514

"distributions": [ # Metadata about the upgrade for each specific operating system.

515

{ # The Upgrade Distribution represents metadata about the Upgrade for each

516

# operating system (CPE). Some distributions have additional metadata around

517

# updates, classifying them into various categories and severities.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

518

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

519

# upstream operating system upgrade feed.

520

"severity": "A String", # The severity as specified by the upstream operating system.

521

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

522

# https://cpe.mitre.org/specification/.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

523

"cve": [ # The cve that would be resolved by this upgrade.

524

"A String",

525

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

526

},

527

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

528

"package": "A String", # Required - The package this Upgrade is for.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

529

},

530

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

531

# various channels.

532

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

533

"name": "A String", # The name of the package.

534

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

535

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

536

# e.g. Debian's jessie-backports dpkg mirror

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

537

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

538

# this distribution channel.

539

# For a discussion of this in Debian/Ubuntu:

540

# http://serverfault.com/questions/604541/debian-packages-version-convention

541

# For a discussion of this in Redhat/Fedora/Centos:

542

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

543

"name": "A String", # The main part of the version name.

544

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

545

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

546

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

547

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

548

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

549

"description": "A String", # The distribution channel-specific description of this package.

550

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

551

# denoting the package manager version distributing a package.

552

"url": "A String", # The distribution channel-specific homepage for this package.

553

"architecture": "A String", # The CPU architecture for which packages in this distribution

554

# channel were built

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

555

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

556

},

557

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

558

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

559

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

560

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

561

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

562

# exists in a provider's project. A `Discovery` occurrence is created in a

563

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

564

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

565

# note for a resource indicates that analysis hasn't started.

566

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

567

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

568

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

569

# a filter in list requests.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="delete">delete(name, x__xgafv=None)</code>

575

<pre>Deletes the given `Note` from the system.

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

579

"providers/{provider_id}/notes/{NOTE_ID}" (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

580

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

587

588

{ # A generic empty message that you can re-use to avoid defining duplicated

589

# empty messages in your APIs. A typical example is to use it as the request

590

# or the response type of an API method. For instance:

591

#

592

# service Foo {

593

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

594

# }

595

#

596

# The JSON representation for `Empty` is empty JSON object `{}`.

}</pre>

</div>

<code class="details" id="get">get(name, x__xgafv=None)</code>

602

<pre>Returns the requested `Note`.

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

606

"providers/{provider_id}/notes/{NOTE_ID}" (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

607

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

614

615

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

616

"relatedUrl": [ # URLs associated with this note

617

{ # Metadata for any related URL information

618

"url": "A String", # Specific URL to associate with the note

619

"label": "A String", # Label to describe usage of the URL

620

},

621

],

622

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

623

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

624

# relationship. Linked occurrences are derived from this or an

625

# equivalent image via:

626

# FROM <Basis.resource_url>

627

# Or an equivalent reference, e.g. a tag of the resource_url.

628

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

629

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

630

"A String",

631

],

632

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

633

# representation.

634

# This field can be used as a filter in list requests.

635

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

636

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

637

# Only the name of the final blob is kept.

638

# This field can be used as a filter in list requests.

639

},

640

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

641

# associated occurrence images.

642

},

643

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

644

# field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

645

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

646

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

647

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

648

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

649

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

650

# findings are valid and unchanged. If `key_type` is empty, this defaults

651

# to PEM encoded public keys.

652

#

653

# This field may be empty if `key_id` references an external key.

654

#

655

# For Cloud Build based signatures, this is a PEM encoded public

656

# key. To verify the Cloud Build signature, place the contents of

657

# this field into a file (public.pem). The signature field is base64-decoded

658

# into its binary representation in signature.bin, and the provenance bytes

659

# from `BuildDetails` are base64-decoded into a binary representation in

660

# signed.bin. OpenSSL can then verify the signature:

661

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

662

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

663

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

664

# CN for a cert), or a reference to an external key (such as a reference to a

665

# key in Cloud Key Management Service).

666

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

667

# `key_id`

668

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

669

},

670

"builderVersion": "A String", # Version of the builder which produced this Note.

671

},

672

"longDescription": "A String", # A detailed description of this `Note`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

673

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

674

"resourceUri": [ # Resource URI for the artifact being deployed.

675

"A String",

676

],

677

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

678

"shortDescription": "A String", # A one sentence description of this `Note`.

679

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

680

# example, an organization might have one `AttestationAuthority` for "QA" and

681

# one for "build". This Note is intended to act strictly as a grouping

682

# mechanism for the attached Occurrences (Attestations). This grouping

683

# mechanism also provides a security boundary, since IAM ACLs gate the ability

684

# for a principle to attach an Occurrence to a given Note. It also provides a

685

# single point of lookup to find all attached Attestation Occurrences, even if

686

# they don't all live in the same project.

687

"hint": { # This submessage provides human-readable hints about the purpose of the

688

# AttestationAuthority. Because the name of a Note acts as its resource

689

# reference, it is important to disambiguate the canonical name of the Note

690

# (which might be a UUID for security purposes) from "readable" names more

691

# suitable for debug output. Note that these hints should NOT be used to

692

# look up AttestationAuthorities in security sensitive contexts, such as when

693

# looking up Attestations to verify.

694

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

695

},

696

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

697

"name": "A String", # The name of the note in the form

698

# "projects/{provider_project_id}/notes/{NOTE_ID}"

699

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

700

"severity": "A String", # Note provider assigned impact of the vulnerability

701

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

702

# vulnerability. One entry per (version range and cpe_uri) the

703

# package vulnerability has manifested in.

704

{ # Identifies all occurrences of this vulnerability in the package for a

705

# specific distro/location

706

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

707

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

708

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

709

# filter in list requests.

710

# For a discussion of this in Debian/Ubuntu:

711

# http://serverfault.com/questions/604541/debian-packages-version-convention

712

# For a discussion of this in Redhat/Fedora/Centos:

713

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

714

"name": "A String", # The main part of the version name.

715

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

716

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

717

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

718

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

719

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

720

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

721

# format. Examples include distro or storage location for vulnerable jar.

722

# This field can be used as a filter in list requests.

723

"package": "A String", # The package being described.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

724

},

725

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

726

# node.js packages etc)

727

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

728

# which the vulnerability manifests. Examples include distro or storage

729

# location for vulnerable jar.

730

# This field can be used as a filter in list requests.

731

"description": "A String", # A vendor-specific description of this note.

732

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

733

# For a discussion of this in Debian/Ubuntu:

734

# http://serverfault.com/questions/604541/debian-packages-version-convention

735

# For a discussion of this in Redhat/Fedora/Centos:

736

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

737

"name": "A String", # The main part of the version name.

738

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

739

# If kind is not NORMAL, then the other fields are ignored.

740

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

741

"revision": "A String", # The iteration of the package build from the above version.

742

},

743

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

744

"package": "A String", # The name of the package where the vulnerability was found.

745

# This field can be used as a filter in list requests.

746

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

747

# For a discussion of this in Debian/Ubuntu:

748

# http://serverfault.com/questions/604541/debian-packages-version-convention

749

# For a discussion of this in Redhat/Fedora/Centos:

750

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

751

"name": "A String", # The main part of the version name.

752

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

753

# If kind is not NORMAL, then the other fields are ignored.

754

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

755

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

756

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

757

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

758

# obsolete details.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

759

},

760

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

761

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

762

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

763

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

764

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

765

# bash 4.1.2), there will be a Upgrade Note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

766

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

767

# For a discussion of this in Debian/Ubuntu:

768

# http://serverfault.com/questions/604541/debian-packages-version-convention

769

# For a discussion of this in Redhat/Fedora/Centos:

770

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

771

"name": "A String", # The main part of the version name.

772

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

773

# If kind is not NORMAL, then the other fields are ignored.

774

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

775

"revision": "A String", # The iteration of the package build from the above version.

776

},

777

"distributions": [ # Metadata about the upgrade for each specific operating system.

778

{ # The Upgrade Distribution represents metadata about the Upgrade for each

779

# operating system (CPE). Some distributions have additional metadata around

780

# updates, classifying them into various categories and severities.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

781

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

782

# upstream operating system upgrade feed.

783

"severity": "A String", # The severity as specified by the upstream operating system.

784

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

785

# https://cpe.mitre.org/specification/.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

786

"cve": [ # The cve that would be resolved by this upgrade.

787

"A String",

788

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

789

},

790

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

791

"package": "A String", # Required - The package this Upgrade is for.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

792

},

793

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

794

# various channels.

795

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

796

"name": "A String", # The name of the package.

797

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

798

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

799

# e.g. Debian's jessie-backports dpkg mirror

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

800

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

801

# this distribution channel.

802

# For a discussion of this in Debian/Ubuntu:

803

# http://serverfault.com/questions/604541/debian-packages-version-convention

804

# For a discussion of this in Redhat/Fedora/Centos:

805

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

806

"name": "A String", # The main part of the version name.

807

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

808

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

809

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

810

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

811

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

812

"description": "A String", # The distribution channel-specific description of this package.

813

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

814

# denoting the package manager version distributing a package.

815

"url": "A String", # The distribution channel-specific homepage for this package.

816

"architecture": "A String", # The CPU architecture for which packages in this distribution

817

# channel were built

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

818

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

819

},

820

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

821

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

822

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

823

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

824

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

825

# exists in a provider's project. A `Discovery` occurrence is created in a

826

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

827

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

828

# note for a resource indicates that analysis hasn't started.

829

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

830

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

831

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

832

# a filter in list requests.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>

838

<pre>Gets the access control policy for a note or an `Occurrence` resource.

839

Requires `containeranalysis.notes.setIamPolicy` or

840

`containeranalysis.occurrences.setIamPolicy` permission if the resource is

841

a note or occurrence, respectively.

842

Attempting to call this method on a resource without the required

843

permission will result in a `PERMISSION_DENIED` error. Attempting to call

844

this method on a non-existent resource will result in a `NOT_FOUND` error

845

if the user has list permission on the project, or a `PERMISSION_DENIED`

846

error otherwise. The resource takes the following formats:

847

`projects/{PROJECT_ID}/occurrences/{OCCURRENCE_ID}` for occurrences and

848

projects/{PROJECT_ID}/notes/{NOTE_ID} for notes

849

850

Args:

851

resource: string, REQUIRED: The resource for which the policy is being requested.

852

See the operation documentation for the appropriate value for this field. (required)

853

body: object, The request body.

854

The object takes the form of:

855

856

{ # Request message for `GetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

857

"options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

858

# `GetIamPolicy`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

859

"requestedPolicyVersion": 42, # Optional. The policy format version to be returned.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

860

#

861

# Valid values are 0, 1, and 3. Requests specifying an invalid value will be

862

# rejected.

863

#

864

# Requests for policies with any conditional bindings must specify version 3.

865

# Policies without any conditional bindings may specify any valid value or

866

# leave the field unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

867

#

868

# To learn which resources support conditions in their IAM policies, see the

869

# [IAM

870

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

871

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

872

}

873

874

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

881

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

882

{ # An Identity and Access Management (IAM) policy, which specifies access

883

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

884

#

885

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

886

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

887

# `members` to a single `role`. Members can be user accounts, service accounts,

888

# Google groups, and domains (such as G Suite). A `role` is a named list of

889

# permissions; each `role` can be an IAM predefined role or a user-created

890

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

891

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

892

# For some types of Google Cloud resources, a `binding` can also specify a

893

# `condition`, which is a logical expression that allows access to a resource

894

# only if the expression evaluates to `true`. A condition can add constraints

895

# based on attributes of the request, the resource, or both. To learn which

896

# resources support conditions in their IAM policies, see the

897

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

898

#

899

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

900

#

901

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

902

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

903

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

904

# "role": "roles/resourcemanager.organizationAdmin",

905

# "members": [

906

# "user:mike@example.com",

907

# "group:admins@example.com",

908

# "domain:google.com",

909

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

910

# ]

911

# },

912

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

913

# "role": "roles/resourcemanager.organizationViewer",

914

# "members": [

915

# "user:eve@example.com"

916

# ],

917

# "condition": {

918

# "title": "expirable access",

919

# "description": "Does not grant access after Sep 2020",

920

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

921

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

922

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

923

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

924

# "etag": "BwWWja0YfJA=",

925

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

926

# }

927

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

928

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

933

# - group:admins@example.com

934

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

935

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

936

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

937

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

938

# - user:eve@example.com

939

# role: roles/resourcemanager.organizationViewer

940

# condition:

941

# title: expirable access

942

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

943

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

944

# - etag: BwWWja0YfJA=

945

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

946

#

947

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

948

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

949

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

950

# prevent simultaneous updates of a policy from overwriting each other.

951

# It is strongly suggested that systems make use of the `etag` in the

952

# read-modify-write cycle to perform policy updates in order to avoid race

953

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

954

# systems are expected to put that etag in the request to `setIamPolicy` to

955

# ensure that their change will be applied to the same version of the policy.

956

#

957

# **Important:** If you use IAM Conditions, you must include the `etag` field

958

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

959

# you to overwrite a version `3` policy with a version `1` policy, and all of

960

# the conditions in the version `3` policy are lost.

961

"version": 42, # Specifies the format of the policy.

962

#

963

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

964

# are rejected.

965

#

966

# Any operation that affects conditional role bindings must specify version

967

# `3`. This requirement applies to the following operations:

968

#

969

# * Getting a policy that includes a conditional role binding

970

# * Adding a conditional role binding to a policy

971

# * Changing a conditional role binding in a policy

972

# * Removing any role binding, with or without a condition, from a policy

973

# that includes conditions

974

#

975

# **Important:** If you use IAM Conditions, you must include the `etag` field

976

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

977

# you to overwrite a version `3` policy with a version `1` policy, and all of

978

# the conditions in the version `3` policy are lost.

979

#

980

# If a policy does not include any conditions, operations on that policy may

981

# specify any valid version or leave the field unset.

982

#

983

# To learn which resources support conditions in their IAM policies, see the

984

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

985

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

986

# `condition` that determines how and when the `bindings` are applied. Each

987

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

988

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

989

"role": "A String", # Role that is assigned to `members`.

990

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

991

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

992

#

993

# If the condition evaluates to `true`, then this binding applies to the

994

# current request.

995

#

996

# If the condition evaluates to `false`, then this binding does not apply to

997

# the current request. However, a different role binding might grant the same

998

# role to one or more of the members in this binding.

999

#

1000

# To learn which resources support conditions in their IAM policies, see the

1001

# [IAM

1002

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1003

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1004

# are documented at https://github.com/google/cel-spec.

1005

#

1006

# Example (Comparison):

1007

#

1008

# title: "Summary size limit"

1009

# description: "Determines if a summary is less than 100 chars"

1010

# expression: "document.summary.size() < 100"

1011

#

1012

# Example (Equality):

1013

#

1014

# title: "Requestor is owner"

1015

# description: "Determines if requestor is the document owner"

1016

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1021

# description: "Determine whether the document should be publicly visible"

1022

# expression: "document.type != 'private' && document.type != 'internal'"

1023

#

1024

# Example (Data Manipulation):

1025

#

1026

# title: "Notification string"

1027

# description: "Create a notification string with a timestamp."

1028

# expression: "'New message received at ' + string(document.create_time)"

1029

#

1030

# The exact variables and functions that may be referenced within an expression

1031

# are determined by the service that evaluates it. See the service

1032

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1033

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1034

# its purpose. This can be used e.g. in UIs which allow to enter the

1035

# expression.

1036

"location": "A String", # Optional. String indicating the location of the expression for error

1037

# reporting, e.g. a file name and a position in the file.

1038

"description": "A String", # Optional. Description of the expression. This is a longer text which

1039

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1040

"expression": "A String", # Textual representation of an expression in Common Expression Language

1041

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1042

},

1043

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1044

# `members` can have the following values:

1045

#

1046

# * `allUsers`: A special identifier that represents anyone who is

1047

# on the internet; with or without a Google account.

1048

#

1049

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1050

# who is authenticated with a Google account or a service account.

1051

#

1052

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1053

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1054

#

1055

#

1056

# * `serviceAccount:{emailid}`: An email address that represents a service

1057

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1058

#

1059

# * `group:{emailid}`: An email address that represents a Google group.

1060

# For example, `admins@example.com`.

1061

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1062

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1063

# identifier) representing a user that has been recently deleted. For

1064

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1065

# recovered, this value reverts to `user:{emailid}` and the recovered user

1066

# retains the role in the binding.

1067

#

1068

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1069

# unique identifier) representing a service account that has been recently

1070

# deleted. For example,

1071

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1072

# If the service account is undeleted, this value reverts to

1073

# `serviceAccount:{emailid}` and the undeleted service account retains the

1074

# role in the binding.

1075

#

1076

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1077

# identifier) representing a Google group that has been recently

1078

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1079

# the group is recovered, this value reverts to `group:{emailid}` and the

1080

# recovered group retains the role in the binding.

1081

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1082

#

1083

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

1084

# users of that domain. For example, `google.com` or `example.com`.

1085

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1086

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1087

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1088

},

1089

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1094

<code class="details" id="list">list(parent, filter=None, name=None, pageToken=None, pageSize=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1095

<pre>Lists all `Notes` for a given project.

1096

1097

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1098

parent: string, This field contains the project Id for example: "projects/{PROJECT_ID}". (required)

1099

filter: string, The filter expression.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1100

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1101

"providers/{provider_id}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1102

@Deprecated

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1103

pageToken: string, Token to provide to skip to a particular spot in the list.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1104

pageSize: integer, Number of notes to return in the list.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1105

x__xgafv: string, V1 error format.

1106

Allowed values

1107

1 - v1 error format

1108

2 - v2 error format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1109

1110

Returns:

1111

An object of the form:

1112

1113

{ # Response including listed notes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1114

"notes": [ # The occurrences requested

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1115

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1116

"relatedUrl": [ # URLs associated with this note

1117

{ # Metadata for any related URL information

1118

"url": "A String", # Specific URL to associate with the note

1119

"label": "A String", # Label to describe usage of the URL

1120

},

1121

],

1122

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

1123

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

1124

# relationship. Linked occurrences are derived from this or an

1125

# equivalent image via:

1126

# FROM <Basis.resource_url>

1127

# Or an equivalent reference, e.g. a tag of the resource_url.

1128

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

1129

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

1130

"A String",

1131

],

1132

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

1133

# representation.

1134

# This field can be used as a filter in list requests.

1135

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

1136

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

1137

# Only the name of the final blob is kept.

1138

# This field can be used as a filter in list requests.

1139

},

1140

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

1141

# associated occurrence images.

1142

},

1143

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

1144

# field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1145

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1146

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1147

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1148

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1149

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1150

# findings are valid and unchanged. If `key_type` is empty, this defaults

1151

# to PEM encoded public keys.

1152

#

1153

# This field may be empty if `key_id` references an external key.

1154

#

1155

# For Cloud Build based signatures, this is a PEM encoded public

1156

# key. To verify the Cloud Build signature, place the contents of

1157

# this field into a file (public.pem). The signature field is base64-decoded

1158

# into its binary representation in signature.bin, and the provenance bytes

1159

# from `BuildDetails` are base64-decoded into a binary representation in

1160

# signed.bin. OpenSSL can then verify the signature:

1161

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1162

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

1163

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

1164

# CN for a cert), or a reference to an external key (such as a reference to a

1165

# key in Cloud Key Management Service).

1166

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

1167

# `key_id`

1168

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1169

},

1170

"builderVersion": "A String", # Version of the builder which produced this Note.

1171

},

1172

"longDescription": "A String", # A detailed description of this `Note`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1173

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

1174

"resourceUri": [ # Resource URI for the artifact being deployed.

1175

"A String",

1176

],

1177

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1178

"shortDescription": "A String", # A one sentence description of this `Note`.

1179

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

1180

# example, an organization might have one `AttestationAuthority` for "QA" and

1181

# one for "build". This Note is intended to act strictly as a grouping

1182

# mechanism for the attached Occurrences (Attestations). This grouping

1183

# mechanism also provides a security boundary, since IAM ACLs gate the ability

1184

# for a principle to attach an Occurrence to a given Note. It also provides a

1185

# single point of lookup to find all attached Attestation Occurrences, even if

1186

# they don't all live in the same project.

1187

"hint": { # This submessage provides human-readable hints about the purpose of the

1188

# AttestationAuthority. Because the name of a Note acts as its resource

1189

# reference, it is important to disambiguate the canonical name of the Note

1190

# (which might be a UUID for security purposes) from "readable" names more

1191

# suitable for debug output. Note that these hints should NOT be used to

1192

# look up AttestationAuthorities in security sensitive contexts, such as when

1193

# looking up Attestations to verify.

1194

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1195

},

1196

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1197

"name": "A String", # The name of the note in the form

1198

# "projects/{provider_project_id}/notes/{NOTE_ID}"

1199

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1200

"severity": "A String", # Note provider assigned impact of the vulnerability

1201

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1202

# vulnerability. One entry per (version range and cpe_uri) the

1203

# package vulnerability has manifested in.

1204

{ # Identifies all occurrences of this vulnerability in the package for a

1205

# specific distro/location

1206

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1207

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1208

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1209

# filter in list requests.

1210

# For a discussion of this in Debian/Ubuntu:

1211

# http://serverfault.com/questions/604541/debian-packages-version-convention

1212

# For a discussion of this in Redhat/Fedora/Centos:

1213

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1214

"name": "A String", # The main part of the version name.

1215

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1216

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1217

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1218

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1219

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1220

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

1221

# format. Examples include distro or storage location for vulnerable jar.

1222

# This field can be used as a filter in list requests.

1223

"package": "A String", # The package being described.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1224

},

1225

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

1226

# node.js packages etc)

1227

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

1228

# which the vulnerability manifests. Examples include distro or storage

1229

# location for vulnerable jar.

1230

# This field can be used as a filter in list requests.

1231

"description": "A String", # A vendor-specific description of this note.

1232

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

1233

# For a discussion of this in Debian/Ubuntu:

1234

# http://serverfault.com/questions/604541/debian-packages-version-convention

1235

# For a discussion of this in Redhat/Fedora/Centos:

1236

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1237

"name": "A String", # The main part of the version name.

1238

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1239

# If kind is not NORMAL, then the other fields are ignored.

1240

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1241

"revision": "A String", # The iteration of the package build from the above version.

1242

},

1243

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

1244

"package": "A String", # The name of the package where the vulnerability was found.

1245

# This field can be used as a filter in list requests.

1246

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

1247

# For a discussion of this in Debian/Ubuntu:

1248

# http://serverfault.com/questions/604541/debian-packages-version-convention

1249

# For a discussion of this in Redhat/Fedora/Centos:

1250

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1251

"name": "A String", # The main part of the version name.

1252

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1253

# If kind is not NORMAL, then the other fields are ignored.

1254

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1255

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1256

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1257

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

1258

# obsolete details.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1259

},

1260

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1261

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1262

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1263

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

1264

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

1265

# bash 4.1.2), there will be a Upgrade Note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1266

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

1267

# For a discussion of this in Debian/Ubuntu:

1268

# http://serverfault.com/questions/604541/debian-packages-version-convention

1269

# For a discussion of this in Redhat/Fedora/Centos:

1270

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1271

"name": "A String", # The main part of the version name.

1272

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1273

# If kind is not NORMAL, then the other fields are ignored.

1274

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1275

"revision": "A String", # The iteration of the package build from the above version.

1276

},

1277

"distributions": [ # Metadata about the upgrade for each specific operating system.

1278

{ # The Upgrade Distribution represents metadata about the Upgrade for each

1279

# operating system (CPE). Some distributions have additional metadata around

1280

# updates, classifying them into various categories and severities.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1281

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

1282

# upstream operating system upgrade feed.

1283

"severity": "A String", # The severity as specified by the upstream operating system.

1284

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

1285

# https://cpe.mitre.org/specification/.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1286

"cve": [ # The cve that would be resolved by this upgrade.

1287

"A String",

1288

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1289

},

1290

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1291

"package": "A String", # Required - The package this Upgrade is for.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1292

},

1293

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1294

# various channels.

1295

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1296

"name": "A String", # The name of the package.

1297

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1298

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1299

# e.g. Debian's jessie-backports dpkg mirror

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1300

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1301

# this distribution channel.

1302

# For a discussion of this in Debian/Ubuntu:

1303

# http://serverfault.com/questions/604541/debian-packages-version-convention

1304

# For a discussion of this in Redhat/Fedora/Centos:

1305

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1306

"name": "A String", # The main part of the version name.

1307

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1308

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1309

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1310

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1311

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1312

"description": "A String", # The distribution channel-specific description of this package.

1313

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

1314

# denoting the package manager version distributing a package.

1315

"url": "A String", # The distribution channel-specific homepage for this package.

1316

"architecture": "A String", # The CPU architecture for which packages in this distribution

1317

# channel were built

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1318

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1319

},

1320

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1321

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1322

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1323

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1324

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

1325

# exists in a provider's project. A `Discovery` occurrence is created in a

1326

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1327

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1328

# note for a resource indicates that analysis hasn't started.

1329

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1330

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1331

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

1332

# a filter in list requests.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1333

},

1334

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1335

"nextPageToken": "A String", # The next pagination token in the list response. It should be used as

1336

# page_token for the following request. An empty value means no more result.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

1342

<pre>Retrieves the next page of results.

1343

1344

Args:

1345

previous_request: The request for the previous page. (required)

1346

previous_response: The response from the request for the previous page. (required)

1347

1348

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1349

A request object that you can call 'execute()' on to request the next

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1350

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1355

<code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1356

<pre>Updates an existing `Note`.

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1360

Should be of the form "projects/{provider_id}/notes/{note_id}". (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1361

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1362

The object takes the form of:

1363

1364

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1365

"relatedUrl": [ # URLs associated with this note

1366

{ # Metadata for any related URL information

1367

"url": "A String", # Specific URL to associate with the note

1368

"label": "A String", # Label to describe usage of the URL

1369

},

1370

],

1371

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

1372

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

1373

# relationship. Linked occurrences are derived from this or an

1374

# equivalent image via:

1375

# FROM <Basis.resource_url>

1376

# Or an equivalent reference, e.g. a tag of the resource_url.

1377

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

1378

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

1379

"A String",

1380

],

1381

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

1382

# representation.

1383

# This field can be used as a filter in list requests.

1384

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

1385

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

1386

# Only the name of the final blob is kept.

1387

# This field can be used as a filter in list requests.

1388

},

1389

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

1390

# associated occurrence images.

1391

},

1392

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

1393

# field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1394

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1395

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1396

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1397

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1398

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1399

# findings are valid and unchanged. If `key_type` is empty, this defaults

1400

# to PEM encoded public keys.

1401

#

1402

# This field may be empty if `key_id` references an external key.

1403

#

1404

# For Cloud Build based signatures, this is a PEM encoded public

1405

# key. To verify the Cloud Build signature, place the contents of

1406

# this field into a file (public.pem). The signature field is base64-decoded

1407

# into its binary representation in signature.bin, and the provenance bytes

1408

# from `BuildDetails` are base64-decoded into a binary representation in

1409

# signed.bin. OpenSSL can then verify the signature:

1410

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1411

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

1412

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

1413

# CN for a cert), or a reference to an external key (such as a reference to a

1414

# key in Cloud Key Management Service).

1415

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

1416

# `key_id`

1417

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1418

},

1419

"builderVersion": "A String", # Version of the builder which produced this Note.

1420

},

1421

"longDescription": "A String", # A detailed description of this `Note`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1422

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

1423

"resourceUri": [ # Resource URI for the artifact being deployed.

1424

"A String",

1425

],

1426

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1427

"shortDescription": "A String", # A one sentence description of this `Note`.

1428

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

1429

# example, an organization might have one `AttestationAuthority` for "QA" and

1430

# one for "build". This Note is intended to act strictly as a grouping

1431

# mechanism for the attached Occurrences (Attestations). This grouping

1432

# mechanism also provides a security boundary, since IAM ACLs gate the ability

1433

# for a principle to attach an Occurrence to a given Note. It also provides a

1434

# single point of lookup to find all attached Attestation Occurrences, even if

1435

# they don't all live in the same project.

1436

"hint": { # This submessage provides human-readable hints about the purpose of the

1437

# AttestationAuthority. Because the name of a Note acts as its resource

1438

# reference, it is important to disambiguate the canonical name of the Note

1439

# (which might be a UUID for security purposes) from "readable" names more

1440

# suitable for debug output. Note that these hints should NOT be used to

1441

# look up AttestationAuthorities in security sensitive contexts, such as when

1442

# looking up Attestations to verify.

1443

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1444

},

1445

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1446

"name": "A String", # The name of the note in the form

1447

# "projects/{provider_project_id}/notes/{NOTE_ID}"

1448

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1449

"severity": "A String", # Note provider assigned impact of the vulnerability

1450

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1451

# vulnerability. One entry per (version range and cpe_uri) the

1452

# package vulnerability has manifested in.

1453

{ # Identifies all occurrences of this vulnerability in the package for a

1454

# specific distro/location

1455

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1456

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1457

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1458

# filter in list requests.

1459

# For a discussion of this in Debian/Ubuntu:

1460

# http://serverfault.com/questions/604541/debian-packages-version-convention

1461

# For a discussion of this in Redhat/Fedora/Centos:

1462

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1463

"name": "A String", # The main part of the version name.

1464

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1465

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1466

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1467

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1468

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1469

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

1470

# format. Examples include distro or storage location for vulnerable jar.

1471

# This field can be used as a filter in list requests.

1472

"package": "A String", # The package being described.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1473

},

1474

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

1475

# node.js packages etc)

1476

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

1477

# which the vulnerability manifests. Examples include distro or storage

1478

# location for vulnerable jar.

1479

# This field can be used as a filter in list requests.

1480

"description": "A String", # A vendor-specific description of this note.

1481

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

1482

# For a discussion of this in Debian/Ubuntu:

1483

# http://serverfault.com/questions/604541/debian-packages-version-convention

1484

# For a discussion of this in Redhat/Fedora/Centos:

1485

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1486

"name": "A String", # The main part of the version name.

1487

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1488

# If kind is not NORMAL, then the other fields are ignored.

1489

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1490

"revision": "A String", # The iteration of the package build from the above version.

1491

},

1492

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

1493

"package": "A String", # The name of the package where the vulnerability was found.

1494

# This field can be used as a filter in list requests.

1495

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

1496

# For a discussion of this in Debian/Ubuntu:

1497

# http://serverfault.com/questions/604541/debian-packages-version-convention

1498

# For a discussion of this in Redhat/Fedora/Centos:

1499

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1500

"name": "A String", # The main part of the version name.

1501

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1502

# If kind is not NORMAL, then the other fields are ignored.

1503

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1504

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1505

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1506

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

1507

# obsolete details.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1508

},

1509

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1510

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1511

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1512

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

1513

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

1514

# bash 4.1.2), there will be a Upgrade Note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1515

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

1516

# For a discussion of this in Debian/Ubuntu:

1517

# http://serverfault.com/questions/604541/debian-packages-version-convention

1518

# For a discussion of this in Redhat/Fedora/Centos:

1519

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1520

"name": "A String", # The main part of the version name.

1521

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1522

# If kind is not NORMAL, then the other fields are ignored.

1523

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1524

"revision": "A String", # The iteration of the package build from the above version.

1525

},

1526

"distributions": [ # Metadata about the upgrade for each specific operating system.

1527

{ # The Upgrade Distribution represents metadata about the Upgrade for each

1528

# operating system (CPE). Some distributions have additional metadata around

1529

# updates, classifying them into various categories and severities.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1530

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

1531

# upstream operating system upgrade feed.

1532

"severity": "A String", # The severity as specified by the upstream operating system.

1533

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

1534

# https://cpe.mitre.org/specification/.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1535

"cve": [ # The cve that would be resolved by this upgrade.

1536

"A String",

1537

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1538

},

1539

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1540

"package": "A String", # Required - The package this Upgrade is for.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1541

},

1542

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1543

# various channels.

1544

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1545

"name": "A String", # The name of the package.

1546

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1547

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1548

# e.g. Debian's jessie-backports dpkg mirror

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1549

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1550

# this distribution channel.

1551

# For a discussion of this in Debian/Ubuntu:

1552

# http://serverfault.com/questions/604541/debian-packages-version-convention

1553

# For a discussion of this in Redhat/Fedora/Centos:

1554

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1555

"name": "A String", # The main part of the version name.

1556

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1557

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1558

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1559

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1560

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1561

"description": "A String", # The distribution channel-specific description of this package.

1562

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

1563

# denoting the package manager version distributing a package.

1564

"url": "A String", # The distribution channel-specific homepage for this package.

1565

"architecture": "A String", # The CPU architecture for which packages in this distribution

1566

# channel were built

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1567

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1568

},

1569

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1570

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1571

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1572

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1573

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

1574

# exists in a provider's project. A `Discovery` occurrence is created in a

1575

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1576

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1577

# note for a resource indicates that analysis hasn't started.

1578

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1579

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1580

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

1581

# a filter in list requests.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1582

}

1583

1584

updateMask: string, The fields to update.

1585

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1592

1593

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1594

"relatedUrl": [ # URLs associated with this note

1595

{ # Metadata for any related URL information

1596

"url": "A String", # Specific URL to associate with the note

1597

"label": "A String", # Label to describe usage of the URL

1598

},

1599

],

1600

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

1601

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

1602

# relationship. Linked occurrences are derived from this or an

1603

# equivalent image via:

1604

# FROM <Basis.resource_url>

1605

# Or an equivalent reference, e.g. a tag of the resource_url.

1606

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

1607

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

1608

"A String",

1609

],

1610

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

1611

# representation.

1612

# This field can be used as a filter in list requests.

1613

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

1614

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

1615

# Only the name of the final blob is kept.

1616

# This field can be used as a filter in list requests.

1617

},

1618

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

1619

# associated occurrence images.

1620

},

1621

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

1622

# field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1623

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1624

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1625

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1626

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1627

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1628

# findings are valid and unchanged. If `key_type` is empty, this defaults

1629

# to PEM encoded public keys.

1630

#

1631

# This field may be empty if `key_id` references an external key.

1632

#

1633

# For Cloud Build based signatures, this is a PEM encoded public

1634

# key. To verify the Cloud Build signature, place the contents of

1635

# this field into a file (public.pem). The signature field is base64-decoded

1636

# into its binary representation in signature.bin, and the provenance bytes

1637

# from `BuildDetails` are base64-decoded into a binary representation in

1638

# signed.bin. OpenSSL can then verify the signature:

1639

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1640

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

1641

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

1642

# CN for a cert), or a reference to an external key (such as a reference to a

1643

# key in Cloud Key Management Service).

1644

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

1645

# `key_id`

1646

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1647

},

1648

"builderVersion": "A String", # Version of the builder which produced this Note.

1649

},

1650

"longDescription": "A String", # A detailed description of this `Note`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1651

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

1652

"resourceUri": [ # Resource URI for the artifact being deployed.

1653

"A String",

1654

],

1655

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1656

"shortDescription": "A String", # A one sentence description of this `Note`.

1657

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

1658

# example, an organization might have one `AttestationAuthority` for "QA" and

1659

# one for "build". This Note is intended to act strictly as a grouping

1660

# mechanism for the attached Occurrences (Attestations). This grouping

1661

# mechanism also provides a security boundary, since IAM ACLs gate the ability

1662

# for a principle to attach an Occurrence to a given Note. It also provides a

1663

# single point of lookup to find all attached Attestation Occurrences, even if

1664

# they don't all live in the same project.

1665

"hint": { # This submessage provides human-readable hints about the purpose of the

1666

# AttestationAuthority. Because the name of a Note acts as its resource

1667

# reference, it is important to disambiguate the canonical name of the Note

1668

# (which might be a UUID for security purposes) from "readable" names more

1669

# suitable for debug output. Note that these hints should NOT be used to

1670

# look up AttestationAuthorities in security sensitive contexts, such as when

1671

# looking up Attestations to verify.

1672

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1673

},

1674

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1675

"name": "A String", # The name of the note in the form

1676

# "projects/{provider_project_id}/notes/{NOTE_ID}"

1677

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1678

"severity": "A String", # Note provider assigned impact of the vulnerability

1679

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1680

# vulnerability. One entry per (version range and cpe_uri) the

1681

# package vulnerability has manifested in.

1682

{ # Identifies all occurrences of this vulnerability in the package for a

1683

# specific distro/location

1684

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1685

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1686

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1687

# filter in list requests.

1688

# For a discussion of this in Debian/Ubuntu:

1689

# http://serverfault.com/questions/604541/debian-packages-version-convention

1690

# For a discussion of this in Redhat/Fedora/Centos:

1691

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1692

"name": "A String", # The main part of the version name.

1693

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1694

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1695

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1696

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1697

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1698

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

1699

# format. Examples include distro or storage location for vulnerable jar.

1700

# This field can be used as a filter in list requests.

1701

"package": "A String", # The package being described.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1702

},

1703

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

1704

# node.js packages etc)

1705

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

1706

# which the vulnerability manifests. Examples include distro or storage

1707

# location for vulnerable jar.

1708

# This field can be used as a filter in list requests.

1709

"description": "A String", # A vendor-specific description of this note.

1710

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

1711

# For a discussion of this in Debian/Ubuntu:

1712

# http://serverfault.com/questions/604541/debian-packages-version-convention

1713

# For a discussion of this in Redhat/Fedora/Centos:

1714

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1715

"name": "A String", # The main part of the version name.

1716

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1717

# If kind is not NORMAL, then the other fields are ignored.

1718

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1719

"revision": "A String", # The iteration of the package build from the above version.

1720

},

1721

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

1722

"package": "A String", # The name of the package where the vulnerability was found.

1723

# This field can be used as a filter in list requests.

1724

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

1725

# For a discussion of this in Debian/Ubuntu:

1726

# http://serverfault.com/questions/604541/debian-packages-version-convention

1727

# For a discussion of this in Redhat/Fedora/Centos:

1728

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1729

"name": "A String", # The main part of the version name.

1730

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1731

# If kind is not NORMAL, then the other fields are ignored.

1732

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1733

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1734

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1735

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

1736

# obsolete details.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1737

},

1738

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1739

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1740

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1741

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

1742

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

1743

# bash 4.1.2), there will be a Upgrade Note.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1744

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

1745

# For a discussion of this in Debian/Ubuntu:

1746

# http://serverfault.com/questions/604541/debian-packages-version-convention

1747

# For a discussion of this in Redhat/Fedora/Centos:

1748

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1749

"name": "A String", # The main part of the version name.

1750

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1751

# If kind is not NORMAL, then the other fields are ignored.

1752

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1753

"revision": "A String", # The iteration of the package build from the above version.

1754

},

1755

"distributions": [ # Metadata about the upgrade for each specific operating system.

1756

{ # The Upgrade Distribution represents metadata about the Upgrade for each

1757

# operating system (CPE). Some distributions have additional metadata around

1758

# updates, classifying them into various categories and severities.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1759

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

1760

# upstream operating system upgrade feed.

1761

"severity": "A String", # The severity as specified by the upstream operating system.

1762

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

1763

# https://cpe.mitre.org/specification/.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1764

"cve": [ # The cve that would be resolved by this upgrade.

1765

"A String",

1766

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1767

},

1768

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1769

"package": "A String", # Required - The package this Upgrade is for.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1770

},

1771

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1772

# various channels.

1773

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1774

"name": "A String", # The name of the package.

1775

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1776

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1777

# e.g. Debian's jessie-backports dpkg mirror

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1778

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1779

# this distribution channel.

1780

# For a discussion of this in Debian/Ubuntu:

1781

# http://serverfault.com/questions/604541/debian-packages-version-convention

1782

# For a discussion of this in Redhat/Fedora/Centos:

1783

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1784

"name": "A String", # The main part of the version name.

1785

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1786

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1787

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1788

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1789

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1790

"description": "A String", # The distribution channel-specific description of this package.

1791

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

1792

# denoting the package manager version distributing a package.

1793

"url": "A String", # The distribution channel-specific homepage for this package.

1794

"architecture": "A String", # The CPU architecture for which packages in this distribution

1795

# channel were built

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1796

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1797

},

1798

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1799

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1800

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1801

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1802

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

1803

# exists in a provider's project. A `Discovery` occurrence is created in a

1804

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1805

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1806

# note for a resource indicates that analysis hasn't started.

1807

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1808

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1809

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

1810

# a filter in list requests.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1815

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1816

<pre>Sets the access control policy on the specified `Note` or `Occurrence`.

1817

Requires `containeranalysis.notes.setIamPolicy` or

1818

`containeranalysis.occurrences.setIamPolicy` permission if the resource is

1819

a `Note` or an `Occurrence`, respectively.

1820

Attempting to call this method without these permissions will result in a `

1821

`PERMISSION_DENIED` error.

1822

Attempting to call this method on a non-existent resource will result in a

1823

`NOT_FOUND` error if the user has `containeranalysis.notes.list` permission

1824

on a `Note` or `containeranalysis.occurrences.list` on an `Occurrence`, or

1825

a `PERMISSION_DENIED` error otherwise. The resource takes the following

1826

formats: `projects/{projectid}/occurrences/{occurrenceid}` for occurrences

1827

and projects/{projectid}/notes/{noteid} for notes

1828

1829

Args:

1830

resource: string, REQUIRED: The resource for which the policy is being specified.

1831

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1832

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1833

The object takes the form of:

1834

1835

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1836

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1837

# the policy is limited to a few 10s of KB. An empty policy is a

1838

# valid policy but certain Cloud Platform services (such as Projects)

1839

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1840

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1841

#

1842

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1843

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1844

# `members` to a single `role`. Members can be user accounts, service accounts,

1845

# Google groups, and domains (such as G Suite). A `role` is a named list of

1846

# permissions; each `role` can be an IAM predefined role or a user-created

1847

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1848

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1849

# For some types of Google Cloud resources, a `binding` can also specify a

1850

# `condition`, which is a logical expression that allows access to a resource

1851

# only if the expression evaluates to `true`. A condition can add constraints

1852

# based on attributes of the request, the resource, or both. To learn which

1853

# resources support conditions in their IAM policies, see the

1854

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1855

#

1856

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1857

#

1858

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1859

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1860

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1861

# "role": "roles/resourcemanager.organizationAdmin",

1862

# "members": [

1863

# "user:mike@example.com",

1864

# "group:admins@example.com",

1865

# "domain:google.com",

1866

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1867

# ]

1868

# },

1869

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1870

# "role": "roles/resourcemanager.organizationViewer",

1871

# "members": [

1872

# "user:eve@example.com"

1873

# ],

1874

# "condition": {

1875

# "title": "expirable access",

1876

# "description": "Does not grant access after Sep 2020",

1877

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1878

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1879

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1880

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1881

# "etag": "BwWWja0YfJA=",

1882

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1883

# }

1884

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1885

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1890

# - group:admins@example.com

1891

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1892

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1893

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1894

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1895

# - user:eve@example.com

1896

# role: roles/resourcemanager.organizationViewer

1897

# condition:

1898

# title: expirable access

1899

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1900

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1901

# - etag: BwWWja0YfJA=

1902

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1903

#

1904

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1905

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1906

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1907

# prevent simultaneous updates of a policy from overwriting each other.

1908

# It is strongly suggested that systems make use of the `etag` in the

1909

# read-modify-write cycle to perform policy updates in order to avoid race

1910

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1911

# systems are expected to put that etag in the request to `setIamPolicy` to

1912

# ensure that their change will be applied to the same version of the policy.

1913

#

1914

# **Important:** If you use IAM Conditions, you must include the `etag` field

1915

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1916

# you to overwrite a version `3` policy with a version `1` policy, and all of

1917

# the conditions in the version `3` policy are lost.

1918

"version": 42, # Specifies the format of the policy.

1919

#

1920

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1921

# are rejected.

1922

#

1923

# Any operation that affects conditional role bindings must specify version

1924

# `3`. This requirement applies to the following operations:

1925

#

1926

# * Getting a policy that includes a conditional role binding

1927

# * Adding a conditional role binding to a policy

1928

# * Changing a conditional role binding in a policy

1929

# * Removing any role binding, with or without a condition, from a policy

1930

# that includes conditions

1931

#

1932

# **Important:** If you use IAM Conditions, you must include the `etag` field

1933

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1934

# you to overwrite a version `3` policy with a version `1` policy, and all of

1935

# the conditions in the version `3` policy are lost.

1936

#

1937

# If a policy does not include any conditions, operations on that policy may

1938

# specify any valid version or leave the field unset.

1939

#

1940

# To learn which resources support conditions in their IAM policies, see the

1941

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1942

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1943

# `condition` that determines how and when the `bindings` are applied. Each

1944

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1945

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1946

"role": "A String", # Role that is assigned to `members`.

1947

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1948

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

1949

#

1950

# If the condition evaluates to `true`, then this binding applies to the

1951

# current request.

1952

#

1953

# If the condition evaluates to `false`, then this binding does not apply to

1954

# the current request. However, a different role binding might grant the same

1955

# role to one or more of the members in this binding.

1956

#

1957

# To learn which resources support conditions in their IAM policies, see the

1958

# [IAM

1959

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1960

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1961

# are documented at https://github.com/google/cel-spec.

1962

#

1963

# Example (Comparison):

1964

#

1965

# title: "Summary size limit"

1966

# description: "Determines if a summary is less than 100 chars"

1967

# expression: "document.summary.size() < 100"

1968

#

1969

# Example (Equality):

1970

#

1971

# title: "Requestor is owner"

1972

# description: "Determines if requestor is the document owner"

1973

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1978

# description: "Determine whether the document should be publicly visible"

1979

# expression: "document.type != 'private' && document.type != 'internal'"

1980

#

1981

# Example (Data Manipulation):

1982

#

1983

# title: "Notification string"

1984

# description: "Create a notification string with a timestamp."

1985

# expression: "'New message received at ' + string(document.create_time)"

1986

#

1987

# The exact variables and functions that may be referenced within an expression

1988

# are determined by the service that evaluates it. See the service

1989

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1990

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1991

# its purpose. This can be used e.g. in UIs which allow to enter the

1992

# expression.

1993

"location": "A String", # Optional. String indicating the location of the expression for error

1994

# reporting, e.g. a file name and a position in the file.

1995

"description": "A String", # Optional. Description of the expression. This is a longer text which

1996

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1997

"expression": "A String", # Textual representation of an expression in Common Expression Language

1998

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1999

},

2000

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2001

# `members` can have the following values:

2002

#

2003

# * `allUsers`: A special identifier that represents anyone who is

2004

# on the internet; with or without a Google account.

2005

#

2006

# * `allAuthenticatedUsers`: A special identifier that represents anyone

2007

# who is authenticated with a Google account or a service account.

2008

#

2009

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2010

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2011

#

2012

#

2013

# * `serviceAccount:{emailid}`: An email address that represents a service

2014

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

2015

#

2016

# * `group:{emailid}`: An email address that represents a Google group.

2017

# For example, `admins@example.com`.

2018

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2019

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

2020

# identifier) representing a user that has been recently deleted. For

2021

# example, `alice@example.com?uid=123456789012345678901`. If the user is

2022

# recovered, this value reverts to `user:{emailid}` and the recovered user

2023

# retains the role in the binding.

2024

#

2025

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

2026

# unique identifier) representing a service account that has been recently

2027

# deleted. For example,

2028

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

2029

# If the service account is undeleted, this value reverts to

2030

# `serviceAccount:{emailid}` and the undeleted service account retains the

2031

# role in the binding.

2032

#

2033

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

2034

# identifier) representing a Google group that has been recently

2035

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

2036

# the group is recovered, this value reverts to `group:{emailid}` and the

2037

# recovered group retains the role in the binding.

2038

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2039

#

2040

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

2041

# users of that domain. For example, `google.com` or `example.com`.

2042

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2043

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2044

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2045

},

2046

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2047

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2048

}

2049

2050

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2057

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2058

{ # An Identity and Access Management (IAM) policy, which specifies access

2059

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2060

#

2061

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2062

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

2063

# `members` to a single `role`. Members can be user accounts, service accounts,

2064

# Google groups, and domains (such as G Suite). A `role` is a named list of

2065

# permissions; each `role` can be an IAM predefined role or a user-created

2066

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2067

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2068

# For some types of Google Cloud resources, a `binding` can also specify a

2069

# `condition`, which is a logical expression that allows access to a resource

2070

# only if the expression evaluates to `true`. A condition can add constraints

2071

# based on attributes of the request, the resource, or both. To learn which

2072

# resources support conditions in their IAM policies, see the

2073

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2074

#

2075

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2076

#

2077

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2078

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2079

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2080

# "role": "roles/resourcemanager.organizationAdmin",

2081

# "members": [

2082

# "user:mike@example.com",

2083

# "group:admins@example.com",

2084

# "domain:google.com",

2085

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2086

# ]

2087

# },

2088

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2089

# "role": "roles/resourcemanager.organizationViewer",

2090

# "members": [

2091

# "user:eve@example.com"

2092

# ],

2093

# "condition": {

2094

# "title": "expirable access",

2095

# "description": "Does not grant access after Sep 2020",

2096

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2097

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2098

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2099

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2100

# "etag": "BwWWja0YfJA=",

2101

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2102

# }

2103

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2104

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

2109

# - group:admins@example.com

2110

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2111

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

2112

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2113

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2114

# - user:eve@example.com

2115

# role: roles/resourcemanager.organizationViewer

2116

# condition:

2117

# title: expirable access

2118

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2119

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2120

# - etag: BwWWja0YfJA=

2121

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2122

#

2123

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2124

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2125

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

2126

# prevent simultaneous updates of a policy from overwriting each other.

2127

# It is strongly suggested that systems make use of the `etag` in the

2128

# read-modify-write cycle to perform policy updates in order to avoid race

2129

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

2130

# systems are expected to put that etag in the request to `setIamPolicy` to

2131

# ensure that their change will be applied to the same version of the policy.

2132

#

2133

# **Important:** If you use IAM Conditions, you must include the `etag` field

2134

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2135

# you to overwrite a version `3` policy with a version `1` policy, and all of

2136

# the conditions in the version `3` policy are lost.

2137

"version": 42, # Specifies the format of the policy.

2138

#

2139

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

2140

# are rejected.

2141

#

2142

# Any operation that affects conditional role bindings must specify version

2143

# `3`. This requirement applies to the following operations:

2144

#

2145

# * Getting a policy that includes a conditional role binding

2146

# * Adding a conditional role binding to a policy

2147

# * Changing a conditional role binding in a policy

2148

# * Removing any role binding, with or without a condition, from a policy

2149

# that includes conditions

2150

#

2151

# **Important:** If you use IAM Conditions, you must include the `etag` field

2152

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2153

# you to overwrite a version `3` policy with a version `1` policy, and all of

2154

# the conditions in the version `3` policy are lost.

2155

#

2156

# If a policy does not include any conditions, operations on that policy may

2157

# specify any valid version or leave the field unset.

2158

#

2159

# To learn which resources support conditions in their IAM policies, see the

2160

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

2161

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2162

# `condition` that determines how and when the `bindings` are applied. Each

2163

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2164

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2165

"role": "A String", # Role that is assigned to `members`.

2166

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2167

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

2168

#

2169

# If the condition evaluates to `true`, then this binding applies to the

2170

# current request.

2171

#

2172

# If the condition evaluates to `false`, then this binding does not apply to

2173

# the current request. However, a different role binding might grant the same

2174

# role to one or more of the members in this binding.

2175

#

2176

# To learn which resources support conditions in their IAM policies, see the

2177

# [IAM

2178

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

2179

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

2180

# are documented at https://github.com/google/cel-spec.

2181

#

2182

# Example (Comparison):

2183

#

2184

# title: "Summary size limit"

2185

# description: "Determines if a summary is less than 100 chars"

2186

# expression: "document.summary.size() < 100"

2187

#

2188

# Example (Equality):

2189

#

2190

# title: "Requestor is owner"

2191

# description: "Determines if requestor is the document owner"

2192

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

2197

# description: "Determine whether the document should be publicly visible"

2198

# expression: "document.type != 'private' && document.type != 'internal'"

2199

#

2200

# Example (Data Manipulation):

2201

#

2202

# title: "Notification string"

2203

# description: "Create a notification string with a timestamp."

2204

# expression: "'New message received at ' + string(document.create_time)"

2205

#

2206

# The exact variables and functions that may be referenced within an expression

2207

# are determined by the service that evaluates it. See the service

2208

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2209

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

2210

# its purpose. This can be used e.g. in UIs which allow to enter the

2211

# expression.

2212

"location": "A String", # Optional. String indicating the location of the expression for error

2213

# reporting, e.g. a file name and a position in the file.

2214

"description": "A String", # Optional. Description of the expression. This is a longer text which

2215

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2216

"expression": "A String", # Textual representation of an expression in Common Expression Language

2217

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2218

},

2219

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2220

# `members` can have the following values:

2221

#

2222

# * `allUsers`: A special identifier that represents anyone who is

2223

# on the internet; with or without a Google account.

2224

#

2225

# * `allAuthenticatedUsers`: A special identifier that represents anyone

2226

# who is authenticated with a Google account or a service account.

2227

#

2228

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2229

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2230

#

2231

#

2232

# * `serviceAccount:{emailid}`: An email address that represents a service

2233

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

2234

#

2235

# * `group:{emailid}`: An email address that represents a Google group.

2236

# For example, `admins@example.com`.

2237

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2238

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

2239

# identifier) representing a user that has been recently deleted. For

2240

# example, `alice@example.com?uid=123456789012345678901`. If the user is

2241

# recovered, this value reverts to `user:{emailid}` and the recovered user

2242

# retains the role in the binding.

2243

#

2244

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

2245

# unique identifier) representing a service account that has been recently

2246

# deleted. For example,

2247

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

2248

# If the service account is undeleted, this value reverts to

2249

# `serviceAccount:{emailid}` and the undeleted service account retains the

2250

# role in the binding.

2251

#

2252

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

2253

# identifier) representing a Google group that has been recently

2254

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

2255

# the group is recovered, this value reverts to `group:{emailid}` and the

2256

# recovered group retains the role in the binding.

2257

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2258

#

2259

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

2260

# users of that domain. For example, `google.com` or `example.com`.

2261

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2262

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2263

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2264

},

2265

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2270

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2271

<pre>Returns the permissions that a caller has on the specified note or

2272

occurrence resource. Requires list permission on the project (for example,

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2273

"storage.objects.list" on the containing bucket for testing permission of

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2274

an object). Attempting to call this method on a non-existent resource will

2275

result in a `NOT_FOUND` error if the user has list permission on the

2276

project, or a `PERMISSION_DENIED` error otherwise. The resource takes the

2277

following formats: `projects/{PROJECT_ID}/occurrences/{OCCURRENCE_ID}` for

2278

`Occurrences` and `projects/{PROJECT_ID}/notes/{NOTE_ID}` for `Notes`

2279

2280

Args:

2281

resource: string, REQUIRED: The resource for which the policy detail is being requested.

2282

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2283

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2284

The object takes the form of:

2285

2286

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2287

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

2288

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2289

# information see

2290

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2291

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2302

2303

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2304

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2305

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2306

"A String",

Bu Sun Kim