Blame - docs/dyn/containeranalysis_v1alpha1.projects.notes.html - platform/external/python/google-api-python-client

2020-05-01 07:42:23 -0700

[diff] [blame]

83

<code><a href="#create">create(parent, body=None, name=None, noteId=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

84

<p class="firstline">Creates a new `Note`.</p>

85

86

<code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>

87

<p class="firstline">Deletes the given `Note` from the system.</p>

88

89

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

90

<p class="firstline">Returns the requested `Note`.</p>

91

92

<code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

93

<p class="firstline">Gets the access control policy for a note or an `Occurrence` resource.</p>

94

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

95

<code><a href="#list">list(parent, filter=None, name=None, pageToken=None, pageSize=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

96

<p class="firstline">Lists all `Notes` for a given project.</p>

97

98

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

99

<p class="firstline">Retrieves the next page of results.</p>

100

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

101

<code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

102

<p class="firstline">Updates an existing `Note`.</p>

103

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

104

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

105

<p class="firstline">Sets the access control policy on the specified `Note` or `Occurrence`.</p>

106

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

107

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

108

<p class="firstline">Returns the permissions that a caller has on the specified note or</p>

109

<h3>Method Details</h3>

110

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

111

<code class="details" id="create">create(parent, body=None, name=None, noteId=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

112

<pre>Creates a new `Note`.

113

114

Args:

115

parent: string, This field contains the project Id for example:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

116

"projects/{project_id} (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

117

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

118

The object takes the form of:

119

120

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

121

"relatedUrl": [ # URLs associated with this note

122

{ # Metadata for any related URL information

123

"url": "A String", # Specific URL to associate with the note

124

"label": "A String", # Label to describe usage of the URL

125

},

126

],

127

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

128

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

129

# relationship. Linked occurrences are derived from this or an

130

# equivalent image via:

131

# FROM <Basis.resource_url>

132

# Or an equivalent reference, e.g. a tag of the resource_url.

133

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

134

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

135

"A String",

136

],

137

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

138

# representation.

139

# This field can be used as a filter in list requests.

140

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

141

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

142

# Only the name of the final blob is kept.

143

# This field can be used as a filter in list requests.

144

},

145

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

146

# associated occurrence images.

147

},

148

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

149

# field can be used as a filter in list requests.

150

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

151

"resourceUri": [ # Resource URI for the artifact being deployed.

"A String",

],

},

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

156

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

157

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

158

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

159

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

160

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

161

# CN for a cert), or a reference to an external key (such as a reference to a

162

# key in Cloud Key Management Service).

163

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

164

# `key_id`

165

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

166

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

167

# findings are valid and unchanged. If `key_type` is empty, this defaults

168

# to PEM encoded public keys.

169

#

170

# This field may be empty if `key_id` references an external key.

171

#

172

# For Cloud Build based signatures, this is a PEM encoded public

173

# key. To verify the Cloud Build signature, place the contents of

174

# this field into a file (public.pem). The signature field is base64-decoded

175

# into its binary representation in signature.bin, and the provenance bytes

176

# from `BuildDetails` are base64-decoded into a binary representation in

177

# signed.bin. OpenSSL can then verify the signature:

178

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

179

},

180

"builderVersion": "A String", # Version of the builder which produced this Note.

181

},

182

"longDescription": "A String", # A detailed description of this `Note`.

183

"shortDescription": "A String", # A one sentence description of this `Note`.

184

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

185

# example, an organization might have one `AttestationAuthority` for "QA" and

186

# one for "build". This Note is intended to act strictly as a grouping

187

# mechanism for the attached Occurrences (Attestations). This grouping

188

# mechanism also provides a security boundary, since IAM ACLs gate the ability

189

# for a principle to attach an Occurrence to a given Note. It also provides a

190

# single point of lookup to find all attached Attestation Occurrences, even if

191

# they don't all live in the same project.

192

"hint": { # This submessage provides human-readable hints about the purpose of the

193

# AttestationAuthority. Because the name of a Note acts as its resource

194

# reference, it is important to disambiguate the canonical name of the Note

195

# (which might be a UUID for security purposes) from "readable" names more

196

# suitable for debug output. Note that these hints should NOT be used to

197

# look up AttestationAuthorities in security sensitive contexts, such as when

198

# looking up Attestations to verify.

199

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

200

},

201

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

202

"name": "A String", # The name of the note in the form

203

# "projects/{provider_project_id}/notes/{NOTE_ID}"

204

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

205

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

206

"severity": "A String", # Note provider assigned impact of the vulnerability

207

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

208

# vulnerability. One entry per (version range and cpe_uri) the

209

# package vulnerability has manifested in.

210

{ # Identifies all occurrences of this vulnerability in the package for a

211

# specific distro/location

212

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

213

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

214

# obsolete details.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

215

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

216

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

217

# format. Examples include distro or storage location for vulnerable jar.

218

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

219

"package": "A String", # The package being described.

220

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

221

# filter in list requests.

222

# For a discussion of this in Debian/Ubuntu:

223

# http://serverfault.com/questions/604541/debian-packages-version-convention

224

# For a discussion of this in Redhat/Fedora/Centos:

225

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

226

"name": "A String", # The main part of the version name.

227

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

228

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

229

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

230

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

231

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

232

},

233

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

234

# node.js packages etc)

235

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

236

# which the vulnerability manifests. Examples include distro or storage

237

# location for vulnerable jar.

238

# This field can be used as a filter in list requests.

239

"description": "A String", # A vendor-specific description of this note.

240

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

241

# For a discussion of this in Debian/Ubuntu:

242

# http://serverfault.com/questions/604541/debian-packages-version-convention

243

# For a discussion of this in Redhat/Fedora/Centos:

244

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

245

"name": "A String", # The main part of the version name.

246

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

247

# If kind is not NORMAL, then the other fields are ignored.

248

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

249

"revision": "A String", # The iteration of the package build from the above version.

250

},

251

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

252

"package": "A String", # The name of the package where the vulnerability was found.

253

# This field can be used as a filter in list requests.

254

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

255

# For a discussion of this in Debian/Ubuntu:

256

# http://serverfault.com/questions/604541/debian-packages-version-convention

257

# For a discussion of this in Redhat/Fedora/Centos:

258

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

259

"name": "A String", # The main part of the version name.

260

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

261

# If kind is not NORMAL, then the other fields are ignored.

262

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

263

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

268

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

269

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

270

# bash 4.1.2), there will be a Upgrade Note.

271

"package": "A String", # Required - The package this Upgrade is for.

272

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

273

# For a discussion of this in Debian/Ubuntu:

274

# http://serverfault.com/questions/604541/debian-packages-version-convention

275

# For a discussion of this in Redhat/Fedora/Centos:

276

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

277

"name": "A String", # The main part of the version name.

278

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

279

# If kind is not NORMAL, then the other fields are ignored.

280

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

281

"revision": "A String", # The iteration of the package build from the above version.

282

},

283

"distributions": [ # Metadata about the upgrade for each specific operating system.

284

{ # The Upgrade Distribution represents metadata about the Upgrade for each

285

# operating system (CPE). Some distributions have additional metadata around

286

# updates, classifying them into various categories and severities.

287

"cve": [ # The cve that would be resolved by this upgrade.

288

"A String",

289

],

290

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

291

# upstream operating system upgrade feed.

292

"severity": "A String", # The severity as specified by the upstream operating system.

293

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

294

# https://cpe.mitre.org/specification/.

},

],

},

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

299

# various channels.

300

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

301

"name": "A String", # The name of the package.

302

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

303

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

304

# e.g. Debian's jessie-backports dpkg mirror

305

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

306

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

307

# this distribution channel.

308

# For a discussion of this in Debian/Ubuntu:

309

# http://serverfault.com/questions/604541/debian-packages-version-convention

310

# For a discussion of this in Redhat/Fedora/Centos:

311

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

312

"name": "A String", # The main part of the version name.

313

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

314

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

315

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

316

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

317

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

318

"description": "A String", # The distribution channel-specific description of this package.

319

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

320

# denoting the package manager version distributing a package.

321

"url": "A String", # The distribution channel-specific homepage for this package.

322

"architecture": "A String", # The CPU architecture for which packages in this distribution

323

# channel were built

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

324

},

325

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

326

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

327

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

328

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

329

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

330

# a filter in list requests.

331

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

332

# exists in a provider's project. A `Discovery` occurrence is created in a

333

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

334

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

335

# note for a resource indicates that analysis hasn't started.

336

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

341

Should be of the form "providers/{provider_id}".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

342

@Deprecated

343

noteId: string, The ID to use for this note.

344

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

351

352

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

353

"relatedUrl": [ # URLs associated with this note

354

{ # Metadata for any related URL information

355

"url": "A String", # Specific URL to associate with the note

356

"label": "A String", # Label to describe usage of the URL

357

},

358

],

359

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

360

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

361

# relationship. Linked occurrences are derived from this or an

362

# equivalent image via:

363

# FROM <Basis.resource_url>

364

# Or an equivalent reference, e.g. a tag of the resource_url.

365

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

366

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

367

"A String",

368

],

369

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

370

# representation.

371

# This field can be used as a filter in list requests.

372

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

373

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

374

# Only the name of the final blob is kept.

375

# This field can be used as a filter in list requests.

376

},

377

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

378

# associated occurrence images.

379

},

380

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

381

# field can be used as a filter in list requests.

382

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

383

"resourceUri": [ # Resource URI for the artifact being deployed.

"A String",

],

},

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

388

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

389

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

390

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

391

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

392

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

393

# CN for a cert), or a reference to an external key (such as a reference to a

394

# key in Cloud Key Management Service).

395

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

396

# `key_id`

397

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

398

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

399

# findings are valid and unchanged. If `key_type` is empty, this defaults

400

# to PEM encoded public keys.

401

#

402

# This field may be empty if `key_id` references an external key.

403

#

404

# For Cloud Build based signatures, this is a PEM encoded public

405

# key. To verify the Cloud Build signature, place the contents of

406

# this field into a file (public.pem). The signature field is base64-decoded

407

# into its binary representation in signature.bin, and the provenance bytes

408

# from `BuildDetails` are base64-decoded into a binary representation in

409

# signed.bin. OpenSSL can then verify the signature:

410

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

411

},

412

"builderVersion": "A String", # Version of the builder which produced this Note.

413

},

414

"longDescription": "A String", # A detailed description of this `Note`.

415

"shortDescription": "A String", # A one sentence description of this `Note`.

416

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

417

# example, an organization might have one `AttestationAuthority` for "QA" and

418

# one for "build". This Note is intended to act strictly as a grouping

419

# mechanism for the attached Occurrences (Attestations). This grouping

420

# mechanism also provides a security boundary, since IAM ACLs gate the ability

421

# for a principle to attach an Occurrence to a given Note. It also provides a

422

# single point of lookup to find all attached Attestation Occurrences, even if

423

# they don't all live in the same project.

424

"hint": { # This submessage provides human-readable hints about the purpose of the

425

# AttestationAuthority. Because the name of a Note acts as its resource

426

# reference, it is important to disambiguate the canonical name of the Note

427

# (which might be a UUID for security purposes) from "readable" names more

428

# suitable for debug output. Note that these hints should NOT be used to

429

# look up AttestationAuthorities in security sensitive contexts, such as when

430

# looking up Attestations to verify.

431

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

432

},

433

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

434

"name": "A String", # The name of the note in the form

435

# "projects/{provider_project_id}/notes/{NOTE_ID}"

436

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

437

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

438

"severity": "A String", # Note provider assigned impact of the vulnerability

439

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

440

# vulnerability. One entry per (version range and cpe_uri) the

441

# package vulnerability has manifested in.

442

{ # Identifies all occurrences of this vulnerability in the package for a

443

# specific distro/location

444

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

445

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

446

# obsolete details.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

447

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

448

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

449

# format. Examples include distro or storage location for vulnerable jar.

450

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

451

"package": "A String", # The package being described.

452

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

453

# filter in list requests.

454

# For a discussion of this in Debian/Ubuntu:

455

# http://serverfault.com/questions/604541/debian-packages-version-convention

456

# For a discussion of this in Redhat/Fedora/Centos:

457

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

458

"name": "A String", # The main part of the version name.

459

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

460

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

461

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

462

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

463

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

464

},

465

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

466

# node.js packages etc)

467

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

468

# which the vulnerability manifests. Examples include distro or storage

469

# location for vulnerable jar.

470

# This field can be used as a filter in list requests.

471

"description": "A String", # A vendor-specific description of this note.

472

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

473

# For a discussion of this in Debian/Ubuntu:

474

# http://serverfault.com/questions/604541/debian-packages-version-convention

475

# For a discussion of this in Redhat/Fedora/Centos:

476

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

477

"name": "A String", # The main part of the version name.

478

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

479

# If kind is not NORMAL, then the other fields are ignored.

480

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

481

"revision": "A String", # The iteration of the package build from the above version.

482

},

483

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

484

"package": "A String", # The name of the package where the vulnerability was found.

485

# This field can be used as a filter in list requests.

486

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

487

# For a discussion of this in Debian/Ubuntu:

488

# http://serverfault.com/questions/604541/debian-packages-version-convention

489

# For a discussion of this in Redhat/Fedora/Centos:

490

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

491

"name": "A String", # The main part of the version name.

492

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

493

# If kind is not NORMAL, then the other fields are ignored.

494

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

495

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

500

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

501

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

502

# bash 4.1.2), there will be a Upgrade Note.

503

"package": "A String", # Required - The package this Upgrade is for.

504

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

505

# For a discussion of this in Debian/Ubuntu:

506

# http://serverfault.com/questions/604541/debian-packages-version-convention

507

# For a discussion of this in Redhat/Fedora/Centos:

508

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

509

"name": "A String", # The main part of the version name.

510

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

511

# If kind is not NORMAL, then the other fields are ignored.

512

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

513

"revision": "A String", # The iteration of the package build from the above version.

514

},

515

"distributions": [ # Metadata about the upgrade for each specific operating system.

516

{ # The Upgrade Distribution represents metadata about the Upgrade for each

517

# operating system (CPE). Some distributions have additional metadata around

518

# updates, classifying them into various categories and severities.

519

"cve": [ # The cve that would be resolved by this upgrade.

520

"A String",

521

],

522

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

523

# upstream operating system upgrade feed.

524

"severity": "A String", # The severity as specified by the upstream operating system.

525

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

526

# https://cpe.mitre.org/specification/.

},

],

},

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

531

# various channels.

532

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

533

"name": "A String", # The name of the package.

534

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

535

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

536

# e.g. Debian's jessie-backports dpkg mirror

537

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

538

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

539

# this distribution channel.

540

# For a discussion of this in Debian/Ubuntu:

541

# http://serverfault.com/questions/604541/debian-packages-version-convention

542

# For a discussion of this in Redhat/Fedora/Centos:

543

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

544

"name": "A String", # The main part of the version name.

545

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

546

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

547

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

548

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

549

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

550

"description": "A String", # The distribution channel-specific description of this package.

551

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

552

# denoting the package manager version distributing a package.

553

"url": "A String", # The distribution channel-specific homepage for this package.

554

"architecture": "A String", # The CPU architecture for which packages in this distribution

555

# channel were built

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

556

},

557

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

558

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

559

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

560

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

561

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

562

# a filter in list requests.

563

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

564

# exists in a provider's project. A `Discovery` occurrence is created in a

565

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

566

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

567

# note for a resource indicates that analysis hasn't started.

568

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}</pre>

</div>

<code class="details" id="delete">delete(name, x__xgafv=None)</code>

575

<pre>Deletes the given `Note` from the system.

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

579

"providers/{provider_id}/notes/{NOTE_ID}" (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

580

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

587

588

{ # A generic empty message that you can re-use to avoid defining duplicated

589

# empty messages in your APIs. A typical example is to use it as the request

590

# or the response type of an API method. For instance:

591

#

592

# service Foo {

593

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

594

# }

595

#

596

# The JSON representation for `Empty` is empty JSON object `{}`.

}</pre>

</div>

<code class="details" id="get">get(name, x__xgafv=None)</code>

602

<pre>Returns the requested `Note`.

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

606

"providers/{provider_id}/notes/{NOTE_ID}" (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

607

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

614

615

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

616

"relatedUrl": [ # URLs associated with this note

617

{ # Metadata for any related URL information

618

"url": "A String", # Specific URL to associate with the note

619

"label": "A String", # Label to describe usage of the URL

620

},

621

],

622

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

623

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

624

# relationship. Linked occurrences are derived from this or an

625

# equivalent image via:

626

# FROM <Basis.resource_url>

627

# Or an equivalent reference, e.g. a tag of the resource_url.

628

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

629

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

630

"A String",

631

],

632

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

633

# representation.

634

# This field can be used as a filter in list requests.

635

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

636

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

637

# Only the name of the final blob is kept.

638

# This field can be used as a filter in list requests.

639

},

640

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

641

# associated occurrence images.

642

},

643

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

644

# field can be used as a filter in list requests.

645

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

646

"resourceUri": [ # Resource URI for the artifact being deployed.

"A String",

],

},

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

651

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

652

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

653

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

654

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

655

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

656

# CN for a cert), or a reference to an external key (such as a reference to a

657

# key in Cloud Key Management Service).

658

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

659

# `key_id`

660

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

661

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

662

# findings are valid and unchanged. If `key_type` is empty, this defaults

663

# to PEM encoded public keys.

664

#

665

# This field may be empty if `key_id` references an external key.

666

#

667

# For Cloud Build based signatures, this is a PEM encoded public

668

# key. To verify the Cloud Build signature, place the contents of

669

# this field into a file (public.pem). The signature field is base64-decoded

670

# into its binary representation in signature.bin, and the provenance bytes

671

# from `BuildDetails` are base64-decoded into a binary representation in

672

# signed.bin. OpenSSL can then verify the signature:

673

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

674

},

675

"builderVersion": "A String", # Version of the builder which produced this Note.

676

},

677

"longDescription": "A String", # A detailed description of this `Note`.

678

"shortDescription": "A String", # A one sentence description of this `Note`.

679

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

680

# example, an organization might have one `AttestationAuthority` for "QA" and

681

# one for "build". This Note is intended to act strictly as a grouping

682

# mechanism for the attached Occurrences (Attestations). This grouping

683

# mechanism also provides a security boundary, since IAM ACLs gate the ability

684

# for a principle to attach an Occurrence to a given Note. It also provides a

685

# single point of lookup to find all attached Attestation Occurrences, even if

686

# they don't all live in the same project.

687

"hint": { # This submessage provides human-readable hints about the purpose of the

688

# AttestationAuthority. Because the name of a Note acts as its resource

689

# reference, it is important to disambiguate the canonical name of the Note

690

# (which might be a UUID for security purposes) from "readable" names more

691

# suitable for debug output. Note that these hints should NOT be used to

692

# look up AttestationAuthorities in security sensitive contexts, such as when

693

# looking up Attestations to verify.

694

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

695

},

696

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

697

"name": "A String", # The name of the note in the form

698

# "projects/{provider_project_id}/notes/{NOTE_ID}"

699

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

700

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

701

"severity": "A String", # Note provider assigned impact of the vulnerability

702

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

703

# vulnerability. One entry per (version range and cpe_uri) the

704

# package vulnerability has manifested in.

705

{ # Identifies all occurrences of this vulnerability in the package for a

706

# specific distro/location

707

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

708

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

709

# obsolete details.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

710

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

711

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

712

# format. Examples include distro or storage location for vulnerable jar.

713

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

714

"package": "A String", # The package being described.

715

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

716

# filter in list requests.

717

# For a discussion of this in Debian/Ubuntu:

718

# http://serverfault.com/questions/604541/debian-packages-version-convention

719

# For a discussion of this in Redhat/Fedora/Centos:

720

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

721

"name": "A String", # The main part of the version name.

722

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

723

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

724

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

725

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

726

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

727

},

728

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

729

# node.js packages etc)

730

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

731

# which the vulnerability manifests. Examples include distro or storage

732

# location for vulnerable jar.

733

# This field can be used as a filter in list requests.

734

"description": "A String", # A vendor-specific description of this note.

735

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

736

# For a discussion of this in Debian/Ubuntu:

737

# http://serverfault.com/questions/604541/debian-packages-version-convention

738

# For a discussion of this in Redhat/Fedora/Centos:

739

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

740

"name": "A String", # The main part of the version name.

741

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

742

# If kind is not NORMAL, then the other fields are ignored.

743

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

744

"revision": "A String", # The iteration of the package build from the above version.

745

},

746

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

747

"package": "A String", # The name of the package where the vulnerability was found.

748

# This field can be used as a filter in list requests.

749

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

750

# For a discussion of this in Debian/Ubuntu:

751

# http://serverfault.com/questions/604541/debian-packages-version-convention

752

# For a discussion of this in Redhat/Fedora/Centos:

753

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

754

"name": "A String", # The main part of the version name.

755

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

756

# If kind is not NORMAL, then the other fields are ignored.

757

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

758

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

763

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

764

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

765

# bash 4.1.2), there will be a Upgrade Note.

766

"package": "A String", # Required - The package this Upgrade is for.

767

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

768

# For a discussion of this in Debian/Ubuntu:

769

# http://serverfault.com/questions/604541/debian-packages-version-convention

770

# For a discussion of this in Redhat/Fedora/Centos:

771

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

772

"name": "A String", # The main part of the version name.

773

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

774

# If kind is not NORMAL, then the other fields are ignored.

775

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

776

"revision": "A String", # The iteration of the package build from the above version.

777

},

778

"distributions": [ # Metadata about the upgrade for each specific operating system.

779

{ # The Upgrade Distribution represents metadata about the Upgrade for each

780

# operating system (CPE). Some distributions have additional metadata around

781

# updates, classifying them into various categories and severities.

782

"cve": [ # The cve that would be resolved by this upgrade.

783

"A String",

784

],

785

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

786

# upstream operating system upgrade feed.

787

"severity": "A String", # The severity as specified by the upstream operating system.

788

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

789

# https://cpe.mitre.org/specification/.

},

],

},

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

794

# various channels.

795

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

796

"name": "A String", # The name of the package.

797

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

798

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

799

# e.g. Debian's jessie-backports dpkg mirror

800

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

801

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

802

# this distribution channel.

803

# For a discussion of this in Debian/Ubuntu:

804

# http://serverfault.com/questions/604541/debian-packages-version-convention

805

# For a discussion of this in Redhat/Fedora/Centos:

806

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

807

"name": "A String", # The main part of the version name.

808

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

809

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

810

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

811

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

812

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

813

"description": "A String", # The distribution channel-specific description of this package.

814

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

815

# denoting the package manager version distributing a package.

816

"url": "A String", # The distribution channel-specific homepage for this package.

817

"architecture": "A String", # The CPU architecture for which packages in this distribution

818

# channel were built

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

819

},

820

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

821

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

822

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

823

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

824

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

825

# a filter in list requests.

826

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

827

# exists in a provider's project. A `Discovery` occurrence is created in a

828

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

829

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

830

# note for a resource indicates that analysis hasn't started.

831

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}</pre>

</div>

<code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>

838

<pre>Gets the access control policy for a note or an `Occurrence` resource.

839

Requires `containeranalysis.notes.setIamPolicy` or

840

`containeranalysis.occurrences.setIamPolicy` permission if the resource is

841

a note or occurrence, respectively.

842

Attempting to call this method on a resource without the required

843

permission will result in a `PERMISSION_DENIED` error. Attempting to call

844

this method on a non-existent resource will result in a `NOT_FOUND` error

845

if the user has list permission on the project, or a `PERMISSION_DENIED`

846

error otherwise. The resource takes the following formats:

847

`projects/{PROJECT_ID}/occurrences/{OCCURRENCE_ID}` for occurrences and

848

projects/{PROJECT_ID}/notes/{NOTE_ID} for notes

849

850

Args:

851

resource: string, REQUIRED: The resource for which the policy is being requested.

852

See the operation documentation for the appropriate value for this field. (required)

853

body: object, The request body.

854

The object takes the form of:

855

856

{ # Request message for `GetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

857

"options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

858

# `GetIamPolicy`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

859

"requestedPolicyVersion": 42, # Optional. The policy format version to be returned.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

860

#

861

# Valid values are 0, 1, and 3. Requests specifying an invalid value will be

862

# rejected.

863

#

864

# Requests for policies with any conditional bindings must specify version 3.

865

# Policies without any conditional bindings may specify any valid value or

866

# leave the field unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

867

#

868

# To learn which resources support conditions in their IAM policies, see the

869

# [IAM

870

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

871

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

872

}

873

874

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

881

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

882

{ # An Identity and Access Management (IAM) policy, which specifies access

883

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

884

#

885

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

886

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

887

# `members` to a single `role`. Members can be user accounts, service accounts,

888

# Google groups, and domains (such as G Suite). A `role` is a named list of

889

# permissions; each `role` can be an IAM predefined role or a user-created

890

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

891

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

892

# For some types of Google Cloud resources, a `binding` can also specify a

893

# `condition`, which is a logical expression that allows access to a resource

894

# only if the expression evaluates to `true`. A condition can add constraints

895

# based on attributes of the request, the resource, or both. To learn which

896

# resources support conditions in their IAM policies, see the

897

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

898

#

899

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

900

#

901

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

902

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

903

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

904

# "role": "roles/resourcemanager.organizationAdmin",

905

# "members": [

906

# "user:mike@example.com",

907

# "group:admins@example.com",

908

# "domain:google.com",

909

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

910

# ]

911

# },

912

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

913

# "role": "roles/resourcemanager.organizationViewer",

914

# "members": [

915

# "user:eve@example.com"

916

# ],

917

# "condition": {

918

# "title": "expirable access",

919

# "description": "Does not grant access after Sep 2020",

920

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

921

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

922

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

923

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

924

# "etag": "BwWWja0YfJA=",

925

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

926

# }

927

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

928

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

933

# - group:admins@example.com

934

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

935

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

936

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

937

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

938

# - user:eve@example.com

939

# role: roles/resourcemanager.organizationViewer

940

# condition:

941

# title: expirable access

942

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

943

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

944

# - etag: BwWWja0YfJA=

945

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

946

#

947

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

948

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

949

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

950

# prevent simultaneous updates of a policy from overwriting each other.

951

# It is strongly suggested that systems make use of the `etag` in the

952

# read-modify-write cycle to perform policy updates in order to avoid race

953

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

954

# systems are expected to put that etag in the request to `setIamPolicy` to

955

# ensure that their change will be applied to the same version of the policy.

956

#

957

# **Important:** If you use IAM Conditions, you must include the `etag` field

958

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

959

# you to overwrite a version `3` policy with a version `1` policy, and all of

960

# the conditions in the version `3` policy are lost.

961

"version": 42, # Specifies the format of the policy.

962

#

963

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

964

# are rejected.

965

#

966

# Any operation that affects conditional role bindings must specify version

967

# `3`. This requirement applies to the following operations:

968

#

969

# * Getting a policy that includes a conditional role binding

970

# * Adding a conditional role binding to a policy

971

# * Changing a conditional role binding in a policy

972

# * Removing any role binding, with or without a condition, from a policy

973

# that includes conditions

974

#

975

# **Important:** If you use IAM Conditions, you must include the `etag` field

976

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

977

# you to overwrite a version `3` policy with a version `1` policy, and all of

978

# the conditions in the version `3` policy are lost.

979

#

980

# If a policy does not include any conditions, operations on that policy may

981

# specify any valid version or leave the field unset.

982

#

983

# To learn which resources support conditions in their IAM policies, see the

984

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

985

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

986

# `condition` that determines how and when the `bindings` are applied. Each

987

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

988

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

989

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

990

#

991

# If the condition evaluates to `true`, then this binding applies to the

992

# current request.

993

#

994

# If the condition evaluates to `false`, then this binding does not apply to

995

# the current request. However, a different role binding might grant the same

996

# role to one or more of the members in this binding.

997

#

998

# To learn which resources support conditions in their IAM policies, see the

999

# [IAM

1000

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1001

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1002

# are documented at https://github.com/google/cel-spec.

1003

#

1004

# Example (Comparison):

1005

#

1006

# title: "Summary size limit"

1007

# description: "Determines if a summary is less than 100 chars"

1008

# expression: "document.summary.size() < 100"

1009

#

1010

# Example (Equality):

1011

#

1012

# title: "Requestor is owner"

1013

# description: "Determines if requestor is the document owner"

1014

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1019

# description: "Determine whether the document should be publicly visible"

1020

# expression: "document.type != 'private' && document.type != 'internal'"

1021

#

1022

# Example (Data Manipulation):

1023

#

1024

# title: "Notification string"

1025

# description: "Create a notification string with a timestamp."

1026

# expression: "'New message received at ' + string(document.create_time)"

1027

#

1028

# The exact variables and functions that may be referenced within an expression

1029

# are determined by the service that evaluates it. See the service

1030

# documentation for additional information.

1031

"expression": "A String", # Textual representation of an expression in Common Expression Language

1032

# syntax.

1033

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1034

# its purpose. This can be used e.g. in UIs which allow to enter the

1035

# expression.

1036

"location": "A String", # Optional. String indicating the location of the expression for error

1037

# reporting, e.g. a file name and a position in the file.

1038

"description": "A String", # Optional. Description of the expression. This is a longer text which

1039

# describes the expression, e.g. when hovered over it in a UI.

1040

},

1041

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1042

# `members` can have the following values:

1043

#

1044

# * `allUsers`: A special identifier that represents anyone who is

1045

# on the internet; with or without a Google account.

1046

#

1047

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1048

# who is authenticated with a Google account or a service account.

1049

#

1050

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1051

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1052

#

1053

#

1054

# * `serviceAccount:{emailid}`: An email address that represents a service

1055

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1056

#

1057

# * `group:{emailid}`: An email address that represents a Google group.

1058

# For example, `admins@example.com`.

1059

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1060

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1061

# identifier) representing a user that has been recently deleted. For

1062

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1063

# recovered, this value reverts to `user:{emailid}` and the recovered user

1064

# retains the role in the binding.

1065

#

1066

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1067

# unique identifier) representing a service account that has been recently

1068

# deleted. For example,

1069

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1070

# If the service account is undeleted, this value reverts to

1071

# `serviceAccount:{emailid}` and the undeleted service account retains the

1072

# role in the binding.

1073

#

1074

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1075

# identifier) representing a Google group that has been recently

1076

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1077

# the group is recovered, this value reverts to `group:{emailid}` and the

1078

# recovered group retains the role in the binding.

1079

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1080

#

1081

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

1082

# users of that domain. For example, `google.com` or `example.com`.

1083

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1084

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1085

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1086

"role": "A String", # Role that is assigned to `members`.

1087

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1088

},

1089

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1094

<code class="details" id="list">list(parent, filter=None, name=None, pageToken=None, pageSize=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1095

<pre>Lists all `Notes` for a given project.

1096

1097

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1098

parent: string, This field contains the project Id for example: "projects/{PROJECT_ID}". (required)

1099

filter: string, The filter expression.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1100

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1101

"providers/{provider_id}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1102

@Deprecated

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1103

pageToken: string, Token to provide to skip to a particular spot in the list.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1104

pageSize: integer, Number of notes to return in the list.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1105

x__xgafv: string, V1 error format.

1106

Allowed values

1107

1 - v1 error format

1108

2 - v2 error format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1109

1110

Returns:

1111

An object of the form:

1112

1113

{ # Response including listed notes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1114

"notes": [ # The occurrences requested

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1115

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1116

"relatedUrl": [ # URLs associated with this note

1117

{ # Metadata for any related URL information

1118

"url": "A String", # Specific URL to associate with the note

1119

"label": "A String", # Label to describe usage of the URL

1120

},

1121

],

1122

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

1123

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

1124

# relationship. Linked occurrences are derived from this or an

1125

# equivalent image via:

1126

# FROM <Basis.resource_url>

1127

# Or an equivalent reference, e.g. a tag of the resource_url.

1128

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

1129

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

1130

"A String",

1131

],

1132

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

1133

# representation.

1134

# This field can be used as a filter in list requests.

1135

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

1136

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

1137

# Only the name of the final blob is kept.

1138

# This field can be used as a filter in list requests.

1139

},

1140

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

1141

# associated occurrence images.

1142

},

1143

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

1144

# field can be used as a filter in list requests.

1145

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

1146

"resourceUri": [ # Resource URI for the artifact being deployed.

"A String",

],

},

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1151

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1152

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1153

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1154

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

1155

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

1156

# CN for a cert), or a reference to an external key (such as a reference to a

1157

# key in Cloud Key Management Service).

1158

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

1159

# `key_id`

1160

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

1161

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1162

# findings are valid and unchanged. If `key_type` is empty, this defaults

1163

# to PEM encoded public keys.

1164

#

1165

# This field may be empty if `key_id` references an external key.

1166

#

1167

# For Cloud Build based signatures, this is a PEM encoded public

1168

# key. To verify the Cloud Build signature, place the contents of

1169

# this field into a file (public.pem). The signature field is base64-decoded

1170

# into its binary representation in signature.bin, and the provenance bytes

1171

# from `BuildDetails` are base64-decoded into a binary representation in

1172

# signed.bin. OpenSSL can then verify the signature:

1173

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1174

},

1175

"builderVersion": "A String", # Version of the builder which produced this Note.

1176

},

1177

"longDescription": "A String", # A detailed description of this `Note`.

1178

"shortDescription": "A String", # A one sentence description of this `Note`.

1179

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

1180

# example, an organization might have one `AttestationAuthority` for "QA" and

1181

# one for "build". This Note is intended to act strictly as a grouping

1182

# mechanism for the attached Occurrences (Attestations). This grouping

1183

# mechanism also provides a security boundary, since IAM ACLs gate the ability

1184

# for a principle to attach an Occurrence to a given Note. It also provides a

1185

# single point of lookup to find all attached Attestation Occurrences, even if

1186

# they don't all live in the same project.

1187

"hint": { # This submessage provides human-readable hints about the purpose of the

1188

# AttestationAuthority. Because the name of a Note acts as its resource

1189

# reference, it is important to disambiguate the canonical name of the Note

1190

# (which might be a UUID for security purposes) from "readable" names more

1191

# suitable for debug output. Note that these hints should NOT be used to

1192

# look up AttestationAuthorities in security sensitive contexts, such as when

1193

# looking up Attestations to verify.

1194

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1195

},

1196

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1197

"name": "A String", # The name of the note in the form

1198

# "projects/{provider_project_id}/notes/{NOTE_ID}"

1199

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

1200

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

1201

"severity": "A String", # Note provider assigned impact of the vulnerability

1202

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1203

# vulnerability. One entry per (version range and cpe_uri) the

1204

# package vulnerability has manifested in.

1205

{ # Identifies all occurrences of this vulnerability in the package for a

1206

# specific distro/location

1207

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1208

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1209

# obsolete details.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1210

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

1211

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1212

# format. Examples include distro or storage location for vulnerable jar.

1213

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1214

"package": "A String", # The package being described.

1215

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1216

# filter in list requests.

1217

# For a discussion of this in Debian/Ubuntu:

1218

# http://serverfault.com/questions/604541/debian-packages-version-convention

1219

# For a discussion of this in Redhat/Fedora/Centos:

1220

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1221

"name": "A String", # The main part of the version name.

1222

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1223

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1224

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1225

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1226

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1227

},

1228

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

1229

# node.js packages etc)

1230

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

1231

# which the vulnerability manifests. Examples include distro or storage

1232

# location for vulnerable jar.

1233

# This field can be used as a filter in list requests.

1234

"description": "A String", # A vendor-specific description of this note.

1235

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

1236

# For a discussion of this in Debian/Ubuntu:

1237

# http://serverfault.com/questions/604541/debian-packages-version-convention

1238

# For a discussion of this in Redhat/Fedora/Centos:

1239

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1240

"name": "A String", # The main part of the version name.

1241

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1242

# If kind is not NORMAL, then the other fields are ignored.

1243

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1244

"revision": "A String", # The iteration of the package build from the above version.

1245

},

1246

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

1247

"package": "A String", # The name of the package where the vulnerability was found.

1248

# This field can be used as a filter in list requests.

1249

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

1250

# For a discussion of this in Debian/Ubuntu:

1251

# http://serverfault.com/questions/604541/debian-packages-version-convention

1252

# For a discussion of this in Redhat/Fedora/Centos:

1253

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1254

"name": "A String", # The main part of the version name.

1255

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1256

# If kind is not NORMAL, then the other fields are ignored.

1257

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1258

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1263

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

1264

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

1265

# bash 4.1.2), there will be a Upgrade Note.

1266

"package": "A String", # Required - The package this Upgrade is for.

1267

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

1268

# For a discussion of this in Debian/Ubuntu:

1269

# http://serverfault.com/questions/604541/debian-packages-version-convention

1270

# For a discussion of this in Redhat/Fedora/Centos:

1271

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1272

"name": "A String", # The main part of the version name.

1273

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1274

# If kind is not NORMAL, then the other fields are ignored.

1275

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1276

"revision": "A String", # The iteration of the package build from the above version.

1277

},

1278

"distributions": [ # Metadata about the upgrade for each specific operating system.

1279

{ # The Upgrade Distribution represents metadata about the Upgrade for each

1280

# operating system (CPE). Some distributions have additional metadata around

1281

# updates, classifying them into various categories and severities.

1282

"cve": [ # The cve that would be resolved by this upgrade.

1283

"A String",

1284

],

1285

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

1286

# upstream operating system upgrade feed.

1287

"severity": "A String", # The severity as specified by the upstream operating system.

1288

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

1289

# https://cpe.mitre.org/specification/.

},

],

},

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1294

# various channels.

1295

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1296

"name": "A String", # The name of the package.

1297

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1298

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1299

# e.g. Debian's jessie-backports dpkg mirror

1300

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

1301

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1302

# this distribution channel.

1303

# For a discussion of this in Debian/Ubuntu:

1304

# http://serverfault.com/questions/604541/debian-packages-version-convention

1305

# For a discussion of this in Redhat/Fedora/Centos:

1306

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1307

"name": "A String", # The main part of the version name.

1308

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1309

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1310

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1311

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1312

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1313

"description": "A String", # The distribution channel-specific description of this package.

1314

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

1315

# denoting the package manager version distributing a package.

1316

"url": "A String", # The distribution channel-specific homepage for this package.

1317

"architecture": "A String", # The CPU architecture for which packages in this distribution

1318

# channel were built

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1319

},

1320

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1321

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1322

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1323

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1324

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

1325

# a filter in list requests.

1326

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

1327

# exists in a provider's project. A `Discovery` occurrence is created in a

1328

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1329

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1330

# note for a resource indicates that analysis hasn't started.

1331

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1332

},

1333

},

1334

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1335

"nextPageToken": "A String", # The next pagination token in the list response. It should be used as

1336

# page_token for the following request. An empty value means no more result.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

1342

<pre>Retrieves the next page of results.

1343

1344

Args:

1345

previous_request: The request for the previous page. (required)

1346

previous_response: The response from the request for the previous page. (required)

1347

1348

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1349

A request object that you can call 'execute()' on to request the next

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1350

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1355

<code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1356

<pre>Updates an existing `Note`.

Args:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1360

Should be of the form "projects/{provider_id}/notes/{note_id}". (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1361

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1362

The object takes the form of:

1363

1364

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1365

"relatedUrl": [ # URLs associated with this note

1366

{ # Metadata for any related URL information

1367

"url": "A String", # Specific URL to associate with the note

1368

"label": "A String", # Label to describe usage of the URL

1369

},

1370

],

1371

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

1372

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

1373

# relationship. Linked occurrences are derived from this or an

1374

# equivalent image via:

1375

# FROM <Basis.resource_url>

1376

# Or an equivalent reference, e.g. a tag of the resource_url.

1377

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

1378

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

1379

"A String",

1380

],

1381

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

1382

# representation.

1383

# This field can be used as a filter in list requests.

1384

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

1385

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

1386

# Only the name of the final blob is kept.

1387

# This field can be used as a filter in list requests.

1388

},

1389

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

1390

# associated occurrence images.

1391

},

1392

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

1393

# field can be used as a filter in list requests.

1394

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

1395

"resourceUri": [ # Resource URI for the artifact being deployed.

"A String",

],

},

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1400

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1401

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1402

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1403

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

1404

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

1405

# CN for a cert), or a reference to an external key (such as a reference to a

1406

# key in Cloud Key Management Service).

1407

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

1408

# `key_id`

1409

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

1410

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1411

# findings are valid and unchanged. If `key_type` is empty, this defaults

1412

# to PEM encoded public keys.

1413

#

1414

# This field may be empty if `key_id` references an external key.

1415

#

1416

# For Cloud Build based signatures, this is a PEM encoded public

1417

# key. To verify the Cloud Build signature, place the contents of

1418

# this field into a file (public.pem). The signature field is base64-decoded

1419

# into its binary representation in signature.bin, and the provenance bytes

1420

# from `BuildDetails` are base64-decoded into a binary representation in

1421

# signed.bin. OpenSSL can then verify the signature:

1422

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1423

},

1424

"builderVersion": "A String", # Version of the builder which produced this Note.

1425

},

1426

"longDescription": "A String", # A detailed description of this `Note`.

1427

"shortDescription": "A String", # A one sentence description of this `Note`.

1428

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

1429

# example, an organization might have one `AttestationAuthority` for "QA" and

1430

# one for "build". This Note is intended to act strictly as a grouping

1431

# mechanism for the attached Occurrences (Attestations). This grouping

1432

# mechanism also provides a security boundary, since IAM ACLs gate the ability

1433

# for a principle to attach an Occurrence to a given Note. It also provides a

1434

# single point of lookup to find all attached Attestation Occurrences, even if

1435

# they don't all live in the same project.

1436

"hint": { # This submessage provides human-readable hints about the purpose of the

1437

# AttestationAuthority. Because the name of a Note acts as its resource

1438

# reference, it is important to disambiguate the canonical name of the Note

1439

# (which might be a UUID for security purposes) from "readable" names more

1440

# suitable for debug output. Note that these hints should NOT be used to

1441

# look up AttestationAuthorities in security sensitive contexts, such as when

1442

# looking up Attestations to verify.

1443

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1444

},

1445

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1446

"name": "A String", # The name of the note in the form

1447

# "projects/{provider_project_id}/notes/{NOTE_ID}"

1448

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

1449

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

1450

"severity": "A String", # Note provider assigned impact of the vulnerability

1451

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1452

# vulnerability. One entry per (version range and cpe_uri) the

1453

# package vulnerability has manifested in.

1454

{ # Identifies all occurrences of this vulnerability in the package for a

1455

# specific distro/location

1456

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1457

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1458

# obsolete details.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1459

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

1460

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1461

# format. Examples include distro or storage location for vulnerable jar.

1462

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1463

"package": "A String", # The package being described.

1464

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1465

# filter in list requests.

1466

# For a discussion of this in Debian/Ubuntu:

1467

# http://serverfault.com/questions/604541/debian-packages-version-convention

1468

# For a discussion of this in Redhat/Fedora/Centos:

1469

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1470

"name": "A String", # The main part of the version name.

1471

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1472

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1473

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1474

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1475

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1476

},

1477

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

1478

# node.js packages etc)

1479

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

1480

# which the vulnerability manifests. Examples include distro or storage

1481

# location for vulnerable jar.

1482

# This field can be used as a filter in list requests.

1483

"description": "A String", # A vendor-specific description of this note.

1484

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

1485

# For a discussion of this in Debian/Ubuntu:

1486

# http://serverfault.com/questions/604541/debian-packages-version-convention

1487

# For a discussion of this in Redhat/Fedora/Centos:

1488

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1489

"name": "A String", # The main part of the version name.

1490

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1491

# If kind is not NORMAL, then the other fields are ignored.

1492

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1493

"revision": "A String", # The iteration of the package build from the above version.

1494

},

1495

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

1496

"package": "A String", # The name of the package where the vulnerability was found.

1497

# This field can be used as a filter in list requests.

1498

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

1499

# For a discussion of this in Debian/Ubuntu:

1500

# http://serverfault.com/questions/604541/debian-packages-version-convention

1501

# For a discussion of this in Redhat/Fedora/Centos:

1502

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1503

"name": "A String", # The main part of the version name.

1504

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1505

# If kind is not NORMAL, then the other fields are ignored.

1506

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1507

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1512

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

1513

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

1514

# bash 4.1.2), there will be a Upgrade Note.

1515

"package": "A String", # Required - The package this Upgrade is for.

1516

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

1517

# For a discussion of this in Debian/Ubuntu:

1518

# http://serverfault.com/questions/604541/debian-packages-version-convention

1519

# For a discussion of this in Redhat/Fedora/Centos:

1520

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1521

"name": "A String", # The main part of the version name.

1522

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1523

# If kind is not NORMAL, then the other fields are ignored.

1524

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1525

"revision": "A String", # The iteration of the package build from the above version.

1526

},

1527

"distributions": [ # Metadata about the upgrade for each specific operating system.

1528

{ # The Upgrade Distribution represents metadata about the Upgrade for each

1529

# operating system (CPE). Some distributions have additional metadata around

1530

# updates, classifying them into various categories and severities.

1531

"cve": [ # The cve that would be resolved by this upgrade.

1532

"A String",

1533

],

1534

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

1535

# upstream operating system upgrade feed.

1536

"severity": "A String", # The severity as specified by the upstream operating system.

1537

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

1538

# https://cpe.mitre.org/specification/.

},

],

},

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1543

# various channels.

1544

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1545

"name": "A String", # The name of the package.

1546

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1547

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1548

# e.g. Debian's jessie-backports dpkg mirror

1549

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

1550

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1551

# this distribution channel.

1552

# For a discussion of this in Debian/Ubuntu:

1553

# http://serverfault.com/questions/604541/debian-packages-version-convention

1554

# For a discussion of this in Redhat/Fedora/Centos:

1555

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1556

"name": "A String", # The main part of the version name.

1557

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1558

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1559

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1560

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1561

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1562

"description": "A String", # The distribution channel-specific description of this package.

1563

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

1564

# denoting the package manager version distributing a package.

1565

"url": "A String", # The distribution channel-specific homepage for this package.

1566

"architecture": "A String", # The CPU architecture for which packages in this distribution

1567

# channel were built

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1568

},

1569

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1570

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1571

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1572

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1573

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

1574

# a filter in list requests.

1575

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

1576

# exists in a provider's project. A `Discovery` occurrence is created in a

1577

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1578

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1579

# note for a resource indicates that analysis hasn't started.

1580

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}

updateMask: string, The fields to update.

1585

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1592

1593

{ # Provides a detailed description of a `Note`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1594

"relatedUrl": [ # URLs associated with this note

1595

{ # Metadata for any related URL information

1596

"url": "A String", # Specific URL to associate with the note

1597

"label": "A String", # Label to describe usage of the URL

1598

},

1599

],

1600

"expirationTime": "A String", # Time of expiration for this note, null if note does not expire.

1601

"baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.

1602

# relationship. Linked occurrences are derived from this or an

1603

# equivalent image via:

1604

# FROM <Basis.resource_url>

1605

# Or an equivalent reference, e.g. a tag of the resource_url.

1606

"fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.

1607

"v2Blob": [ # The ordered list of v2 blobs that represent a given image.

1608

"A String",

1609

],

1610

"v1Name": "A String", # The layer-id of the final layer in the Docker image's v1

1611

# representation.

1612

# This field can be used as a filter in list requests.

1613

"v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:

1614

# [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])

1615

# Only the name of the final blob is kept.

1616

# This field can be used as a filter in list requests.

1617

},

1618

"resourceUrl": "A String", # The resource_url for the resource representing the basis of

1619

# associated occurrence images.

1620

},

1621

"kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This

1622

# field can be used as a filter in list requests.

1623

"deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.

1624

"resourceUri": [ # Resource URI for the artifact being deployed.

"A String",

],

},

"buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1629

# the provenance message in linked BuildDetails.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1630

"signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1631

# `BuilderDetails`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1632

"keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key

1633

# stored in `public_key` (such as the Id or fingerprint for a PGP key, or the

1634

# CN for a cert), or a reference to an external key (such as a reference to a

1635

# key in Cloud Key Management Service).

1636

"keyType": "A String", # The type of the key, either stored in `public_key` or referenced in

1637

# `key_id`

1638

"signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.

1639

"publicKey": "A String", # Public key of the builder which can be used to verify that the related

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1640

# findings are valid and unchanged. If `key_type` is empty, this defaults

1641

# to PEM encoded public keys.

1642

#

1643

# This field may be empty if `key_id` references an external key.

1644

#

1645

# For Cloud Build based signatures, this is a PEM encoded public

1646

# key. To verify the Cloud Build signature, place the contents of

1647

# this field into a file (public.pem). The signature field is base64-decoded

1648

# into its binary representation in signature.bin, and the provenance bytes

1649

# from `BuildDetails` are base64-decoded into a binary representation in

1650

# signed.bin. OpenSSL can then verify the signature:

1651

# `openssl sha256 -verify public.pem -signature signature.bin signed.bin`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1652

},

1653

"builderVersion": "A String", # Version of the builder which produced this Note.

1654

},

1655

"longDescription": "A String", # A detailed description of this `Note`.

1656

"shortDescription": "A String", # A one sentence description of this `Note`.

1657

"attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.

1658

# example, an organization might have one `AttestationAuthority` for "QA" and

1659

# one for "build". This Note is intended to act strictly as a grouping

1660

# mechanism for the attached Occurrences (Attestations). This grouping

1661

# mechanism also provides a security boundary, since IAM ACLs gate the ability

1662

# for a principle to attach an Occurrence to a given Note. It also provides a

1663

# single point of lookup to find all attached Attestation Occurrences, even if

1664

# they don't all live in the same project.

1665

"hint": { # This submessage provides human-readable hints about the purpose of the

1666

# AttestationAuthority. Because the name of a Note acts as its resource

1667

# reference, it is important to disambiguate the canonical name of the Note

1668

# (which might be a UUID for security purposes) from "readable" names more

1669

# suitable for debug output. Note that these hints should NOT be used to

1670

# look up AttestationAuthorities in security sensitive contexts, such as when

1671

# looking up Attestations to verify.

1672

"humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1673

},

1674

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1675

"name": "A String", # The name of the note in the form

1676

# "projects/{provider_project_id}/notes/{NOTE_ID}"

1677

"vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.

1678

"cvssScore": 3.14, # The CVSS score for this Vulnerability.

1679

"severity": "A String", # Note provider assigned impact of the vulnerability

1680

"details": [ # All information about the package to specifically identify this

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1681

# vulnerability. One entry per (version range and cpe_uri) the

1682

# package vulnerability has manifested in.

1683

{ # Identifies all occurrences of this vulnerability in the package for a

1684

# specific distro/location

1685

# For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1686

"isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1687

# obsolete details.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1688

"fixedLocation": { # The location of the vulnerability # The fix for this specific package version.

1689

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1690

# format. Examples include distro or storage location for vulnerable jar.

1691

# This field can be used as a filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1692

"package": "A String", # The package being described.

1693

"version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1694

# filter in list requests.

1695

# For a discussion of this in Debian/Ubuntu:

1696

# http://serverfault.com/questions/604541/debian-packages-version-convention

1697

# For a discussion of this in Redhat/Fedora/Centos:

1698

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1699

"name": "A String", # The main part of the version name.

1700

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1701

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1702

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1703

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1704

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1705

},

1706

"packageType": "A String", # The type of package; whether native or non native(ruby gems,

1707

# node.js packages etc)

1708

"cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in

1709

# which the vulnerability manifests. Examples include distro or storage

1710

# location for vulnerable jar.

1711

# This field can be used as a filter in list requests.

1712

"description": "A String", # A vendor-specific description of this note.

1713

"minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.

1714

# For a discussion of this in Debian/Ubuntu:

1715

# http://serverfault.com/questions/604541/debian-packages-version-convention

1716

# For a discussion of this in Redhat/Fedora/Centos:

1717

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1718

"name": "A String", # The main part of the version name.

1719

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1720

# If kind is not NORMAL, then the other fields are ignored.

1721

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1722

"revision": "A String", # The iteration of the package build from the above version.

1723

},

1724

"severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.

1725

"package": "A String", # The name of the package where the vulnerability was found.

1726

# This field can be used as a filter in list requests.

1727

"maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.

1728

# For a discussion of this in Debian/Ubuntu:

1729

# http://serverfault.com/questions/604541/debian-packages-version-convention

1730

# For a discussion of this in Redhat/Fedora/Centos:

1731

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1732

"name": "A String", # The main part of the version name.

1733

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1734

# If kind is not NORMAL, then the other fields are ignored.

1735

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1736

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1741

"upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.

1742

# version. For each package version combination (i.e. bash 4.0, bash 4.1,

1743

# bash 4.1.2), there will be a Upgrade Note.

1744

"package": "A String", # Required - The package this Upgrade is for.

1745

"version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.

1746

# For a discussion of this in Debian/Ubuntu:

1747

# http://serverfault.com/questions/604541/debian-packages-version-convention

1748

# For a discussion of this in Redhat/Fedora/Centos:

1749

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

1750

"name": "A String", # The main part of the version name.

1751

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

1752

# If kind is not NORMAL, then the other fields are ignored.

1753

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1754

"revision": "A String", # The iteration of the package build from the above version.

1755

},

1756

"distributions": [ # Metadata about the upgrade for each specific operating system.

1757

{ # The Upgrade Distribution represents metadata about the Upgrade for each

1758

# operating system (CPE). Some distributions have additional metadata around

1759

# updates, classifying them into various categories and severities.

1760

"cve": [ # The cve that would be resolved by this upgrade.

1761

"A String",

1762

],

1763

"classification": "A String", # The operating system classification of this Upgrade, as specified by the

1764

# upstream operating system upgrade feed.

1765

"severity": "A String", # The severity as specified by the upstream operating system.

1766

"cpeUri": "A String", # Required - The specific operating system this metadata applies to. See

1767

# https://cpe.mitre.org/specification/.

},

],

},

"package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1772

# various channels.

1773

# e.g. glibc (aka libc6) is distributed by many, at various versions.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1774

"name": "A String", # The name of the package.

1775

"distribution": [ # The various channels by which a package is distributed.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1776

{ # This represents a particular channel of distribution for a given package.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1777

# e.g. Debian's jessie-backports dpkg mirror

1778

"maintainer": "A String", # A freeform string denoting the maintainer of this package.

1779

"latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1780

# this distribution channel.

1781

# For a discussion of this in Debian/Ubuntu:

1782

# http://serverfault.com/questions/604541/debian-packages-version-convention

1783

# For a discussion of this in Redhat/Fedora/Centos:

1784

# http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1785

"name": "A String", # The main part of the version name.

1786

"kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1787

# If kind is not NORMAL, then the other fields are ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1788

"epoch": 42, # Used to correct mistakes in the version numbering scheme.

1789

"revision": "A String", # The iteration of the package build from the above version.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1790

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1791

"description": "A String", # The distribution channel-specific description of this package.

1792

"cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)

1793

# denoting the package manager version distributing a package.

1794

"url": "A String", # The distribution channel-specific homepage for this package.

1795

"architecture": "A String", # The CPU architecture for which packages in this distribution

1796

# channel were built

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1797

},

1798

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1799

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1800

"createTime": "A String", # Output only. The time this note was created. This field can be used as a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1801

# filter in list requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1802

"updateTime": "A String", # Output only. The time this note was last updated. This field can be used as

1803

# a filter in list requests.

1804

"discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.

1805

# exists in a provider's project. A `Discovery` occurrence is created in a

1806

# consumer's project at the start of analysis. The occurrence's operation will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1807

# indicate the status of the analysis. Absence of an occurrence linked to this

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1808

# note for a resource indicates that analysis hasn't started.

1809

"analysisKind": "A String", # The kind of analysis that is handled by this discovery.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1815

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1816

<pre>Sets the access control policy on the specified `Note` or `Occurrence`.

1817

Requires `containeranalysis.notes.setIamPolicy` or

1818

`containeranalysis.occurrences.setIamPolicy` permission if the resource is

1819

a `Note` or an `Occurrence`, respectively.

1820

Attempting to call this method without these permissions will result in a `

1821

`PERMISSION_DENIED` error.

1822

Attempting to call this method on a non-existent resource will result in a

1823

`NOT_FOUND` error if the user has `containeranalysis.notes.list` permission

1824

on a `Note` or `containeranalysis.occurrences.list` on an `Occurrence`, or

1825

a `PERMISSION_DENIED` error otherwise. The resource takes the following

1826

formats: `projects/{projectid}/occurrences/{occurrenceid}` for occurrences

1827

and projects/{projectid}/notes/{noteid} for notes

1828

1829

Args:

1830

resource: string, REQUIRED: The resource for which the policy is being specified.

1831

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1832

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1833

The object takes the form of:

1834

1835

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1836

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1837

# the policy is limited to a few 10s of KB. An empty policy is a

1838

# valid policy but certain Cloud Platform services (such as Projects)

1839

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1840

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1841

#

1842

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1843

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1844

# `members` to a single `role`. Members can be user accounts, service accounts,

1845

# Google groups, and domains (such as G Suite). A `role` is a named list of

1846

# permissions; each `role` can be an IAM predefined role or a user-created

1847

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1848

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1849

# For some types of Google Cloud resources, a `binding` can also specify a

1850

# `condition`, which is a logical expression that allows access to a resource

1851

# only if the expression evaluates to `true`. A condition can add constraints

1852

# based on attributes of the request, the resource, or both. To learn which

1853

# resources support conditions in their IAM policies, see the

1854

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1855

#

1856

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1857

#

1858

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1859

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1860

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1861

# "role": "roles/resourcemanager.organizationAdmin",

1862

# "members": [

1863

# "user:mike@example.com",

1864

# "group:admins@example.com",

1865

# "domain:google.com",

1866

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1867

# ]

1868

# },

1869

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1870

# "role": "roles/resourcemanager.organizationViewer",

1871

# "members": [

1872

# "user:eve@example.com"

1873

# ],

1874

# "condition": {

1875

# "title": "expirable access",

1876

# "description": "Does not grant access after Sep 2020",

1877

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1878

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1879

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1880

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1881

# "etag": "BwWWja0YfJA=",

1882

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1883

# }

1884

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1885

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1890

# - group:admins@example.com

1891

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1892

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1893

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1894

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1895

# - user:eve@example.com

1896

# role: roles/resourcemanager.organizationViewer

1897

# condition:

1898

# title: expirable access

1899

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1900

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1901

# - etag: BwWWja0YfJA=

1902

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1903

#

1904

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1905

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1906

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1907

# prevent simultaneous updates of a policy from overwriting each other.

1908

# It is strongly suggested that systems make use of the `etag` in the

1909

# read-modify-write cycle to perform policy updates in order to avoid race

1910

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1911

# systems are expected to put that etag in the request to `setIamPolicy` to

1912

# ensure that their change will be applied to the same version of the policy.

1913

#

1914

# **Important:** If you use IAM Conditions, you must include the `etag` field

1915

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1916

# you to overwrite a version `3` policy with a version `1` policy, and all of

1917

# the conditions in the version `3` policy are lost.

1918

"version": 42, # Specifies the format of the policy.

1919

#

1920

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1921

# are rejected.

1922

#

1923

# Any operation that affects conditional role bindings must specify version

1924

# `3`. This requirement applies to the following operations:

1925

#

1926

# * Getting a policy that includes a conditional role binding

1927

# * Adding a conditional role binding to a policy

1928

# * Changing a conditional role binding in a policy

1929

# * Removing any role binding, with or without a condition, from a policy

1930

# that includes conditions

1931

#

1932

# **Important:** If you use IAM Conditions, you must include the `etag` field

1933

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1934

# you to overwrite a version `3` policy with a version `1` policy, and all of

1935

# the conditions in the version `3` policy are lost.

1936

#

1937

# If a policy does not include any conditions, operations on that policy may

1938

# specify any valid version or leave the field unset.

1939

#

1940

# To learn which resources support conditions in their IAM policies, see the

1941

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1942

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1943

# `condition` that determines how and when the `bindings` are applied. Each

1944

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1945

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1946

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

1947

#

1948

# If the condition evaluates to `true`, then this binding applies to the

1949

# current request.

1950

#

1951

# If the condition evaluates to `false`, then this binding does not apply to

1952

# the current request. However, a different role binding might grant the same

1953

# role to one or more of the members in this binding.

1954

#

1955

# To learn which resources support conditions in their IAM policies, see the

1956

# [IAM

1957

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1958

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1959

# are documented at https://github.com/google/cel-spec.

1960

#

1961

# Example (Comparison):

1962

#

1963

# title: "Summary size limit"

1964

# description: "Determines if a summary is less than 100 chars"

1965

# expression: "document.summary.size() < 100"

1966

#

1967

# Example (Equality):

1968

#

1969

# title: "Requestor is owner"

1970

# description: "Determines if requestor is the document owner"

1971

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1976

# description: "Determine whether the document should be publicly visible"

1977

# expression: "document.type != 'private' && document.type != 'internal'"

1978

#

1979

# Example (Data Manipulation):

1980

#

1981

# title: "Notification string"

1982

# description: "Create a notification string with a timestamp."

1983

# expression: "'New message received at ' + string(document.create_time)"

1984

#

1985

# The exact variables and functions that may be referenced within an expression

1986

# are determined by the service that evaluates it. See the service

1987

# documentation for additional information.

1988

"expression": "A String", # Textual representation of an expression in Common Expression Language

1989

# syntax.

1990

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1991

# its purpose. This can be used e.g. in UIs which allow to enter the

1992

# expression.

1993

"location": "A String", # Optional. String indicating the location of the expression for error

1994

# reporting, e.g. a file name and a position in the file.

1995

"description": "A String", # Optional. Description of the expression. This is a longer text which

1996

# describes the expression, e.g. when hovered over it in a UI.

1997

},

1998

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1999

# `members` can have the following values:

2000

#

2001

# * `allUsers`: A special identifier that represents anyone who is

2002

# on the internet; with or without a Google account.

2003

#

2004

# * `allAuthenticatedUsers`: A special identifier that represents anyone

2005

# who is authenticated with a Google account or a service account.

2006

#

2007

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2008

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2009

#

2010

#

2011

# * `serviceAccount:{emailid}`: An email address that represents a service

2012

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

2013

#

2014

# * `group:{emailid}`: An email address that represents a Google group.

2015

# For example, `admins@example.com`.

2016

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2017

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

2018

# identifier) representing a user that has been recently deleted. For

2019

# example, `alice@example.com?uid=123456789012345678901`. If the user is

2020

# recovered, this value reverts to `user:{emailid}` and the recovered user

2021

# retains the role in the binding.

2022

#

2023

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

2024

# unique identifier) representing a service account that has been recently

2025

# deleted. For example,

2026

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

2027

# If the service account is undeleted, this value reverts to

2028

# `serviceAccount:{emailid}` and the undeleted service account retains the

2029

# role in the binding.

2030

#

2031

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

2032

# identifier) representing a Google group that has been recently

2033

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

2034

# the group is recovered, this value reverts to `group:{emailid}` and the

2035

# recovered group retains the role in the binding.

2036

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2037

#

2038

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

2039

# users of that domain. For example, `google.com` or `example.com`.

2040

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2041

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2042

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2043

"role": "A String", # Role that is assigned to `members`.

2044

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2045

},

2046

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2047

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2048

}

2049

2050

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2057

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2058

{ # An Identity and Access Management (IAM) policy, which specifies access

2059

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2060

#

2061

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2062

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

2063

# `members` to a single `role`. Members can be user accounts, service accounts,

2064

# Google groups, and domains (such as G Suite). A `role` is a named list of

2065

# permissions; each `role` can be an IAM predefined role or a user-created

2066

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2067

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2068

# For some types of Google Cloud resources, a `binding` can also specify a

2069

# `condition`, which is a logical expression that allows access to a resource

2070

# only if the expression evaluates to `true`. A condition can add constraints

2071

# based on attributes of the request, the resource, or both. To learn which

2072

# resources support conditions in their IAM policies, see the

2073

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2074

#

2075

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2076

#

2077

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2078

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2079

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2080

# "role": "roles/resourcemanager.organizationAdmin",

2081

# "members": [

2082

# "user:mike@example.com",

2083

# "group:admins@example.com",

2084

# "domain:google.com",

2085

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2086

# ]

2087

# },

2088

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2089

# "role": "roles/resourcemanager.organizationViewer",

2090

# "members": [

2091

# "user:eve@example.com"

2092

# ],

2093

# "condition": {

2094

# "title": "expirable access",

2095

# "description": "Does not grant access after Sep 2020",

2096

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2097

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2098

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2099

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2100

# "etag": "BwWWja0YfJA=",

2101

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2102

# }

2103

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2104

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

2109

# - group:admins@example.com

2110

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2111

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

2112

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2113

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2114

# - user:eve@example.com

2115

# role: roles/resourcemanager.organizationViewer

2116

# condition:

2117

# title: expirable access

2118

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2119

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2120

# - etag: BwWWja0YfJA=

2121

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2122

#

2123

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2124

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2125

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

2126

# prevent simultaneous updates of a policy from overwriting each other.

2127

# It is strongly suggested that systems make use of the `etag` in the

2128

# read-modify-write cycle to perform policy updates in order to avoid race

2129

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

2130

# systems are expected to put that etag in the request to `setIamPolicy` to

2131

# ensure that their change will be applied to the same version of the policy.

2132

#

2133

# **Important:** If you use IAM Conditions, you must include the `etag` field

2134

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2135

# you to overwrite a version `3` policy with a version `1` policy, and all of

2136

# the conditions in the version `3` policy are lost.

2137

"version": 42, # Specifies the format of the policy.

2138

#

2139

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

2140

# are rejected.

2141

#

2142

# Any operation that affects conditional role bindings must specify version

2143

# `3`. This requirement applies to the following operations:

2144

#

2145

# * Getting a policy that includes a conditional role binding

2146

# * Adding a conditional role binding to a policy

2147

# * Changing a conditional role binding in a policy

2148

# * Removing any role binding, with or without a condition, from a policy

2149

# that includes conditions

2150

#

2151

# **Important:** If you use IAM Conditions, you must include the `etag` field

2152

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2153

# you to overwrite a version `3` policy with a version `1` policy, and all of

2154

# the conditions in the version `3` policy are lost.

2155

#

2156

# If a policy does not include any conditions, operations on that policy may

2157

# specify any valid version or leave the field unset.

2158

#

2159

# To learn which resources support conditions in their IAM policies, see the

2160

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

2161

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2162

# `condition` that determines how and when the `bindings` are applied. Each

2163

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2164

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2165

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

2166

#

2167

# If the condition evaluates to `true`, then this binding applies to the

2168

# current request.

2169

#

2170

# If the condition evaluates to `false`, then this binding does not apply to

2171

# the current request. However, a different role binding might grant the same

2172

# role to one or more of the members in this binding.

2173

#

2174

# To learn which resources support conditions in their IAM policies, see the

2175

# [IAM

2176

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

2177

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

2178

# are documented at https://github.com/google/cel-spec.

2179

#

2180

# Example (Comparison):

2181

#

2182

# title: "Summary size limit"

2183

# description: "Determines if a summary is less than 100 chars"

2184

# expression: "document.summary.size() < 100"

2185

#

2186

# Example (Equality):

2187

#

2188

# title: "Requestor is owner"

2189

# description: "Determines if requestor is the document owner"

2190

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

2195

# description: "Determine whether the document should be publicly visible"

2196

# expression: "document.type != 'private' && document.type != 'internal'"

2197

#

2198

# Example (Data Manipulation):

2199

#

2200

# title: "Notification string"

2201

# description: "Create a notification string with a timestamp."

2202

# expression: "'New message received at ' + string(document.create_time)"

2203

#

2204

# The exact variables and functions that may be referenced within an expression

2205

# are determined by the service that evaluates it. See the service

2206

# documentation for additional information.

2207

"expression": "A String", # Textual representation of an expression in Common Expression Language

2208

# syntax.

2209

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

2210

# its purpose. This can be used e.g. in UIs which allow to enter the

2211

# expression.

2212

"location": "A String", # Optional. String indicating the location of the expression for error

2213

# reporting, e.g. a file name and a position in the file.

2214

"description": "A String", # Optional. Description of the expression. This is a longer text which

2215

# describes the expression, e.g. when hovered over it in a UI.

2216

},

2217

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2218

# `members` can have the following values:

2219

#

2220

# * `allUsers`: A special identifier that represents anyone who is

2221

# on the internet; with or without a Google account.

2222

#

2223

# * `allAuthenticatedUsers`: A special identifier that represents anyone

2224

# who is authenticated with a Google account or a service account.

2225

#

2226

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2227

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2228

#

2229

#

2230

# * `serviceAccount:{emailid}`: An email address that represents a service

2231

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

2232

#

2233

# * `group:{emailid}`: An email address that represents a Google group.

2234

# For example, `admins@example.com`.

2235

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2236

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

2237

# identifier) representing a user that has been recently deleted. For

2238

# example, `alice@example.com?uid=123456789012345678901`. If the user is

2239

# recovered, this value reverts to `user:{emailid}` and the recovered user

2240

# retains the role in the binding.

2241

#

2242

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

2243

# unique identifier) representing a service account that has been recently

2244

# deleted. For example,

2245

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

2246

# If the service account is undeleted, this value reverts to

2247

# `serviceAccount:{emailid}` and the undeleted service account retains the

2248

# role in the binding.

2249

#

2250

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

2251

# identifier) representing a Google group that has been recently

2252

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

2253

# the group is recovered, this value reverts to `group:{emailid}` and the

2254

# recovered group retains the role in the binding.

2255

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2256

#

2257

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

2258

# users of that domain. For example, `google.com` or `example.com`.

2259

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2260

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2261

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2262

"role": "A String", # Role that is assigned to `members`.

2263

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2264

},

2265

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2270

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2271

<pre>Returns the permissions that a caller has on the specified note or

2272

occurrence resource. Requires list permission on the project (for example,

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2273

"storage.objects.list" on the containing bucket for testing permission of

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2274

an object). Attempting to call this method on a non-existent resource will

2275

result in a `NOT_FOUND` error if the user has list permission on the

2276

project, or a `PERMISSION_DENIED` error otherwise. The resource takes the

2277

following formats: `projects/{PROJECT_ID}/occurrences/{OCCURRENCE_ID}` for

2278

`Occurrences` and `projects/{PROJECT_ID}/notes/{NOTE_ID}` for `Notes`

2279

2280

Args:

2281

resource: string, REQUIRED: The resource for which the policy detail is being requested.

2282

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2283

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2284

The object takes the form of:

2285

2286

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2287

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

2288

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2289

# information see

2290

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2291

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2302

2303

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2304

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2305

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2306

"A String",

Bu Sun Kim