Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / google-api-python-client / dd49464a6262c0d1f71efcf11f131e2f591fe5f6 / . / docs / dyn / containeranalysis_v1alpha1.projects.occurrences.html
blob: 493eac1e21735eced8f569114734563d86cf712c [file] [log] [blame]
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
75<h1><a href="containeranalysis_v1alpha1.html">Container Analysis API</a> . <a href="containeranalysis_v1alpha1.projects.html">projects</a> . <a href="containeranalysis_v1alpha1.projects.occurrences.html">occurrences</a></h1>
76<h2>Instance Methods</h2>
77<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]78 <code><a href="#create">create(parent, body=None, name=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]79<p class="firstline">Creates a new `Occurrence`. Use this method to create `Occurrences`</p>
80<p class="toc_element">
81 <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
82<p class="firstline">Deletes the given `Occurrence` from the system. Use this when</p>
83<p class="toc_element">
84 <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
85<p class="firstline">Returns the requested `Occurrence`.</p>
86<p class="toc_element">
87 <code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
88<p class="firstline">Gets the access control policy for a note or an `Occurrence` resource.</p>
89<p class="toc_element">
90 <code><a href="#getNotes">getNotes(name, x__xgafv=None)</a></code></p>
91<p class="firstline">Gets the `Note` attached to the given `Occurrence`.</p>
92<p class="toc_element">
93 <code><a href="#getVulnerabilitySummary">getVulnerabilitySummary(parent, x__xgafv=None, filter=None)</a></code></p>
94<p class="firstline">Gets a summary of the number and severity of occurrences.</p>
95<p class="toc_element">
96 <code><a href="#list">list(parent, kind=None, name=None, pageToken=None, x__xgafv=None, pageSize=None, filter=None)</a></code></p>
97<p class="firstline">Lists active `Occurrences` for a given project matching the filters.</p>
98<p class="toc_element">
99 <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
100<p class="firstline">Retrieves the next page of results.</p>
101<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]102 <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]103<p class="firstline">Updates an existing occurrence.</p>
104<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]105 <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]106<p class="firstline">Sets the access control policy on the specified `Note` or `Occurrence`.</p>
107<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]108 <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]109<p class="firstline">Returns the permissions that a caller has on the specified note or</p>
110<h3>Method Details</h3>
111<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]112 <code class="details" id="create">create(parent, body=None, name=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]113 <pre>Creates a new `Occurrence`. Use this method to create `Occurrences`
114for a resource.
115
116Args:
117 parent: string, This field contains the project Id for example: "projects/{project_id}" (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]118 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]119 The object takes the form of:
120
121{ # `Occurrence` includes information about analysis occurrences for an image.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]122 "vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.
123 # to fix it.
124 "packageIssue": [ # The set of affected locations and their fixes (if available) within
125 # the associated resource.
126 { # This message wraps a location affected by a vulnerability and its
127 # associated fix (if one is available).
128 "severityName": "A String",
129 "affectedLocation": { # The location of the vulnerability # The location of the vulnerability.
130 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
131 # format. Examples include distro or storage location for vulnerable jar.
132 # This field can be used as a filter in list requests.
133 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
134 # filter in list requests.
135 # For a discussion of this in Debian/Ubuntu:
136 # http://serverfault.com/questions/604541/debian-packages-version-convention
137 # For a discussion of this in Redhat/Fedora/Centos:
138 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
139 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
140 "name": "A String", # The main part of the version name.
141 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
142 # If kind is not NORMAL, then the other fields are ignored.
143 "revision": "A String", # The iteration of the package build from the above version.
144 },
145 "package": "A String", # The package being described.
146 },
147 "fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.
148 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
149 # format. Examples include distro or storage location for vulnerable jar.
150 # This field can be used as a filter in list requests.
151 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
152 # filter in list requests.
153 # For a discussion of this in Debian/Ubuntu:
154 # http://serverfault.com/questions/604541/debian-packages-version-convention
155 # For a discussion of this in Redhat/Fedora/Centos:
156 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
157 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
158 "name": "A String", # The main part of the version name.
159 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
160 # If kind is not NORMAL, then the other fields are ignored.
161 "revision": "A String", # The iteration of the package build from the above version.
162 },
163 "package": "A String", # The package being described.
164 },
165 },
166 ],
167 "type": "A String", # The type of package; whether native or non native(ruby gems,
168 # node.js packages etc)
169 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
170 # scale of 0-10 where 0 indicates low severity and 10 indicates high
171 # severity.
172 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
173 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is
174 # available and note provider assigned severity when distro has not yet
175 # assigned a severity for this vulnerability.
176 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]177 "resource": { # #
178 # The resource for which the `Occurrence` applies.
179 # Resource is an entity that can have metadata. E.g., a Docker image.
180 "contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.
181 "type": "A String", # The type of hash that was performed.
182 "value": "A String", # The hash value.
183 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]184 "name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]185 "uri": "A String", # The unique URI of the resource. E.g.,
186 # "https://gcr.io/project/image@sha256:foo" for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]187 },
188 "updateTime": "A String", # Output only. The time this `Occurrence` was last updated.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]189 "upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.
190 # specific upgrade. This presence is supplied via local sources (i.e. it is
191 # present in the mirror and the running system has noticed its availability).
192 "distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system
193 # for the resource_url. This allows efficient filtering, as well as
194 # making it easier to use the occurrence.
195 # operating system (CPE). Some distributions have additional metadata around
196 # updates, classifying them into various categories and severities.
197 "cpeUri": "A String", # Required - The specific operating system this metadata applies to. See
198 # https://cpe.mitre.org/specification/.
199 "cve": [ # The cve that would be resolved by this upgrade.
200 "A String",
201 ],
202 "severity": "A String", # The severity as specified by the upstream operating system.
203 "classification": "A String", # The operating system classification of this Upgrade, as specified by the
204 # upstream operating system upgrade feed.
205 },
206 "parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.
207 # For a discussion of this in Debian/Ubuntu:
208 # http://serverfault.com/questions/604541/debian-packages-version-convention
209 # For a discussion of this in Redhat/Fedora/Centos:
210 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
211 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
212 "name": "A String", # The main part of the version name.
213 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
214 # If kind is not NORMAL, then the other fields are ignored.
215 "revision": "A String", # The iteration of the package build from the above version.
216 },
217 "package": "A String", # Required - The package this Upgrade is for.
218 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]219 "installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.
220 # a system.
221 "location": [ # All of the places within the filesystem versions of this package
222 # have been found.
223 { # An occurrence of a particular package installation found within a
224 # system's filesystem.
225 # e.g. glibc was found in /var/lib/dpkg/status
226 "path": "A String", # The path from which we gathered that this package/version is installed.
227 "cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)
228 # denoting the package manager version distributing a package.
229 "version": { # Version contains structured information about the version of the package. # The version installed at this location.
230 # For a discussion of this in Debian/Ubuntu:
231 # http://serverfault.com/questions/604541/debian-packages-version-convention
232 # For a discussion of this in Redhat/Fedora/Centos:
233 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]234 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
235 "name": "A String", # The main part of the version name.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]236 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
237 # If kind is not NORMAL, then the other fields are ignored.
238 "revision": "A String", # The iteration of the package build from the above version.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]239 },
240 },
241 ],
242 "name": "A String", # Output only. The name of the installed package.
243 },
244 "name": "A String", # Output only. The name of the `Occurrence` in the form
245 # "projects/{project_id}/occurrences/{OCCURRENCE_ID}"
246 "kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are
247 # specified. This field can be used as a filter in list requests.
248 "buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.
249 "provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance
250 # details about the build from source to completion.
251 "finishTime": "A String", # Time at which execution of the build was finished.
252 "commands": [ # Commands requested by the build.
253 { # Command describes a step performed as part of the build pipeline.
254 "waitFor": [ # The ID(s) of the Command(s) that this Command depends on.
255 "A String",
256 ],
257 "name": "A String", # Name of the command, as presented on the command line, or if the command is
258 # packaged as a Docker container, as presented to `docker pull`.
259 "args": [ # Command-line arguments used when executing this Command.
260 "A String",
261 ],
262 "env": [ # Environment variables set before running this Command.
263 "A String",
264 ],
265 "id": "A String", # Optional unique identifier for this Command, used in wait_for to reference
266 # this Command as a dependency.
267 "dir": "A String", # Working directory (relative to project source root) used when running
268 # this Command.
269 },
270 ],
271 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
272 "artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this
273 # location.
274 # Google Cloud Storage.
275 "generation": "A String", # Google Cloud Storage generation for the object.
276 "object": "A String", # Google Cloud Storage object containing source.
277 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
278 # Requirements]
279 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
280 },
281 "repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.
282 # Repository.
283 "projectId": "A String", # ID of the project that owns the repo.
284 "branchName": "A String", # Name of the branch to build.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]285 "commitSha": "A String", # Explicit commit SHA to build.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]286 "tagName": "A String", # Name of the tag to build.
287 "repoName": "A String", # Name of the repo.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]288 },
289 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
290 # source integrity was maintained in the build.
291 #
292 # The keys to this map are file paths used as build source and the values
293 # contain the hash values for those files.
294 #
295 # If the build source came in a single package such as a gzipped tarfile
296 # (.tar.gz), the FileHash will be for the single path to that file.
297 "a_key": { # Container message for hashes of byte content of files, used in Source
298 # messages to verify integrity of source input to the build.
299 "fileHash": [ # Collection of file hashes.
300 { # Container message for hash values.
301 "type": "A String", # The type of hash that was performed.
302 "value": "A String", # The hash value.
303 },
304 ],
305 },
306 },
307 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
308 # these locations, in the case where the source repository had multiple
309 # remotes or submodules. This list will not include the context specified in
310 # the context field.
311 { # A SourceContext is a reference to a tree of files. A SourceContext together
312 # with a path point to a unique revision of a single file or directory.
313 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
314 # repository (e.g., GitHub).
315 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]316 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]317 },
318 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
319 # Source Repo.
320 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
321 "kind": "A String", # The alias kind.
322 "name": "A String", # The alias name.
323 },
324 "revisionId": "A String", # A revision ID.
325 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]326 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]327 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
328 # winged-cargo-31) and a repo name within that project.
329 "projectId": "A String", # The ID of the project.
330 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
331 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]332 },
333 },
334 "labels": { # Labels with user defined metadata.
335 "a_key": "A String",
336 },
337 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
338 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
339 "kind": "A String", # The alias kind.
340 "name": "A String", # The alias name.
341 },
342 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]343 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]344 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
345 # "project/subproject" is a valid project name. The "repo name" is
346 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]347 },
348 },
349 ],
350 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
351 # with a path point to a unique revision of a single file or directory.
352 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
353 # repository (e.g., GitHub).
354 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]355 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]356 },
357 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
358 # Source Repo.
359 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
360 "kind": "A String", # The alias kind.
361 "name": "A String", # The alias name.
362 },
363 "revisionId": "A String", # A revision ID.
364 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]365 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]366 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
367 # winged-cargo-31) and a repo name within that project.
368 "projectId": "A String", # The ID of the project.
369 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
370 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]371 },
372 },
373 "labels": { # Labels with user defined metadata.
374 "a_key": "A String",
375 },
376 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
377 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
378 "kind": "A String", # The alias kind.
379 "name": "A String", # The alias name.
380 },
381 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]382 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]383 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
384 # "project/subproject" is a valid project name. The "repo name" is
385 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]386 },
387 },
388 "storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud
389 # Storage.
390 # Google Cloud Storage.
391 "generation": "A String", # Google Cloud Storage generation for the object.
392 "object": "A String", # Google Cloud Storage object containing source.
393 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
394 # Requirements]
395 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
396 },
397 },
398 "buildOptions": { # Special options applied to this build. This is a catch-all field where
399 # build providers can enter any desired additional details.
400 "a_key": "A String",
401 },
402 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
403 # user's e-mail address at the time the build was initiated; this address may
404 # not represent the same end-user for all time.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]405 "projectId": "A String", # ID of the project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]406 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
407 "createTime": "A String", # Time at which the build was created.
408 "builtArtifacts": [ # Output of the build.
409 { # Artifact describes a build product.
410 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
411 # container.
412 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
413 # like gcr.io/projectID/imagename@sha256:123456
414 "name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in
415 # the case of a container build, the name used to push the container image to
416 # Google Container Registry, as presented to `docker push`.
417 #
418 # This field is deprecated in favor of the plural `names` field; it continues
419 # to exist here to allow existing BuildProvenance serialized to json in
420 # google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to
421 # deserialize back into proto.
422 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
423 # the case of a container build, the name used to push the container image to
424 # Google Container Registry, as presented to `docker push`. Note that a
425 # single Artifact ID can have multiple names, for example if two tags are
426 # applied to one image.
427 "A String",
428 ],
429 },
430 ],
431 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
432 "startTime": "A String", # Time at which execution of the build was started.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]433 "logsBucket": "A String", # Google Cloud Storage bucket where logs were written.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]434 "id": "A String", # Unique identifier of the build.
435 },
436 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
437 # `BuildSignature` in the corresponding Result. After verifying the
438 # signature, `provenance_bytes` can be unmarshalled and compared to the
439 # provenance to confirm that it is unchanged. A base64-encoded string
440 # representation of the provenance bytes is used for the signature in order
441 # to interoperate with openssl which expects this format for signature
442 # verification.
443 #
444 # The serialized form is captured both to avoid ambiguity in how the
445 # provenance is marshalled to json as well to prevent incompatibilities with
446 # future changes.
447 },
448 "discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.
449 "analysisStatus": "A String", # The status of discovery for the resource.
450 "operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.
451 # This field is deprecated, do not use.
452 # network API call.
453 "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
454 # different programming environments, including REST APIs and RPC APIs. It is
455 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
456 # three pieces of data: error code, error message, and error details.
457 #
458 # You can find out more about this error model and how to work with it in the
459 # [API Design Guide](https://cloud.google.com/apis/design/errors).
460 "message": "A String", # A developer-facing error message, which should be in English. Any
461 # user-facing error message should be localized and sent in the
462 # google.rpc.Status.details field, or localized by the client.
463 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
464 "details": [ # A list of messages that carry the error details. There is a common set of
465 # message types for APIs to use.
466 {
467 "a_key": "", # Properties of the object. Contains field @type with type URL.
468 },
469 ],
470 },
471 "done": True or False, # If the value is `false`, it means the operation is still in progress.
472 # If `true`, the operation is completed, and either `error` or `response` is
473 # available.
474 "response": { # The normal response of the operation in case of success. If the original
475 # method returns no data on success, such as `Delete`, the response is
476 # `google.protobuf.Empty`. If the original method is standard
477 # `Get`/`Create`/`Update`, the response should be the resource. For other
478 # methods, the response should have the type `XxxResponse`, where `Xxx`
479 # is the original method name. For example, if the original method name
480 # is `TakeSnapshot()`, the inferred response type is
481 # `TakeSnapshotResponse`.
482 "a_key": "", # Properties of the object. Contains field @type with type URL.
483 },
484 "name": "A String", # The server-assigned name, which is only unique within the same service that
485 # originally returns it. If you use the default HTTP mapping, the
486 # `name` should be a resource name ending with `operations/{unique_id}`.
487 "metadata": { # Service-specific metadata associated with the operation. It typically
488 # contains progress information and common metadata such as create time.
489 # Some services might not provide such metadata. Any method that returns a
490 # long-running operation should document the metadata type, if any.
491 "a_key": "", # Properties of the object. Contains field @type with type URL.
492 },
493 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]494 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
495 "cpe": "A String", # The CPE of the resource being scanned.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]496 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
497 # details to show to the user. The LocalizedMessage output only and
498 # populated by the API.
499 # different programming environments, including REST APIs and RPC APIs. It is
500 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
501 # three pieces of data: error code, error message, and error details.
502 #
503 # You can find out more about this error model and how to work with it in the
504 # [API Design Guide](https://cloud.google.com/apis/design/errors).
505 "message": "A String", # A developer-facing error message, which should be in English. Any
506 # user-facing error message should be localized and sent in the
507 # google.rpc.Status.details field, or localized by the client.
508 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
509 "details": [ # A list of messages that carry the error details. There is a common set of
510 # message types for APIs to use.
511 {
512 "a_key": "", # Properties of the object. Contains field @type with type URL.
513 },
514 ],
515 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]516 },
517 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.
518 # Attestation can be verified using the attached signature. If the verifier
519 # trusts the public key of the signer, then verifying the signature is
520 # sufficient to establish trust. In this circumstance, the
521 # AttestationAuthority to which this Attestation is attached is primarily
522 # useful for look-up (how to find this Attestation if you already know the
523 # Authority and artifact to be verified) and intent (which authority was this
524 # attestation intended to sign for).
525 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.
526 # This message only supports `ATTACHED` signatures, where the payload that is
527 # signed is included alongside the signature itself in the same file.
528 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
529 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
530 # 160-bit fingerprint, expressed as a 40 character hexadecimal string. See
531 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
532 # Implementations may choose to acknowledge "LONG", "SHORT", or other
533 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
534 # In gpg, the full fingerprint can be retrieved from the `fpr` field
535 # returned when calling --list-keys with --with-colons. For example:
536 # ```
537 # gpg --with-colons --with-fingerprint --force-v4-certs \
538 # --list-keys attester@example.com
539 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]540 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]541 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
542 # ```
543 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
544 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
545 # The verifier must ensure that the provided type is one that the verifier
546 # supports, and that the attestation payload is a valid instantiation of that
547 # type (for example by validating a JSON schema).
548 "signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or
549 # equivalent. Since this message only supports attached signatures, the
550 # payload that was signed must be attached. While the signature format
551 # supported is dependent on the verification implementation, currently only
552 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
553 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
554 # --output=signature.gpg payload.json` will create the signature content
555 # expected in this field in `signature.gpg` for the `payload.json`
556 # attestation payload.
557 },
558 },
559 "noteName": "A String", # An analysis note associated with this image, in the form
560 # "providers/{provider_id}/notes/{NOTE_ID}"
561 # This field can be used as a filter in list requests.
562 "deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.
563 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the
564 # deployable field with the same name.
565 "A String",
566 ],
567 "userEmail": "A String", # Identity of the user that triggered this deployment.
568 "address": "A String", # Address of the runtime element hosting this deployment.
569 "platform": "A String", # Platform hosting this deployment.
570 "deployTime": "A String", # Beginning of the lifetime of this deployment.
571 "undeployTime": "A String", # End of the lifetime of this deployment.
572 "config": "A String", # Configuration used to create this deployment.
573 },
574 "remediation": "A String", # A description of actions that can be taken to remedy the `Note`
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]575 "resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`
576 # applies. For example, https://gcr.io/project/image@sha256:foo This field
577 # can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]578 "createTime": "A String", # Output only. The time this `Occurrence` was created.
579 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis
580 # in the associated note.
581 # DockerImage relationship. This image would be produced from a Dockerfile
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]582 # with FROM &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]583 "distance": 42, # Output only. The number of layers by which this image differs from the
584 # associated image basis.
585 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
586 # occurrence.
587 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
588 # "distance" and is ordered with [distance] being the layer immediately
589 # following the base image and [1] being the final layer.
590 { # Layer holds metadata specific to a layer of a Docker image.
591 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
592 "directive": "A String", # The recovered Dockerfile directive used to construct this layer.
593 },
594 ],
595 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.
596 "v1Name": "A String", # The layer-id of the final layer in the Docker image's v1
597 # representation.
598 # This field can be used as a filter in list requests.
599 "v2Blob": [ # The ordered list of v2 blobs that represent a given image.
600 "A String",
601 ],
602 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
603 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
604 # Only the name of the final blob is kept.
605 # This field can be used as a filter in list requests.
606 },
607 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]608}
609
610 name: string, The name of the project. Should be of the form "projects/{project_id}".
611@Deprecated
612 x__xgafv: string, V1 error format.
613 Allowed values
614 1 - v1 error format
615 2 - v2 error format
616
617Returns:
618 An object of the form:
619
620 { # `Occurrence` includes information about analysis occurrences for an image.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]621 "vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.
622 # to fix it.
623 "packageIssue": [ # The set of affected locations and their fixes (if available) within
624 # the associated resource.
625 { # This message wraps a location affected by a vulnerability and its
626 # associated fix (if one is available).
627 "severityName": "A String",
628 "affectedLocation": { # The location of the vulnerability # The location of the vulnerability.
629 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
630 # format. Examples include distro or storage location for vulnerable jar.
631 # This field can be used as a filter in list requests.
632 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
633 # filter in list requests.
634 # For a discussion of this in Debian/Ubuntu:
635 # http://serverfault.com/questions/604541/debian-packages-version-convention
636 # For a discussion of this in Redhat/Fedora/Centos:
637 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
638 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
639 "name": "A String", # The main part of the version name.
640 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
641 # If kind is not NORMAL, then the other fields are ignored.
642 "revision": "A String", # The iteration of the package build from the above version.
643 },
644 "package": "A String", # The package being described.
645 },
646 "fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.
647 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
648 # format. Examples include distro or storage location for vulnerable jar.
649 # This field can be used as a filter in list requests.
650 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
651 # filter in list requests.
652 # For a discussion of this in Debian/Ubuntu:
653 # http://serverfault.com/questions/604541/debian-packages-version-convention
654 # For a discussion of this in Redhat/Fedora/Centos:
655 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
656 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
657 "name": "A String", # The main part of the version name.
658 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
659 # If kind is not NORMAL, then the other fields are ignored.
660 "revision": "A String", # The iteration of the package build from the above version.
661 },
662 "package": "A String", # The package being described.
663 },
664 },
665 ],
666 "type": "A String", # The type of package; whether native or non native(ruby gems,
667 # node.js packages etc)
668 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
669 # scale of 0-10 where 0 indicates low severity and 10 indicates high
670 # severity.
671 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
672 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is
673 # available and note provider assigned severity when distro has not yet
674 # assigned a severity for this vulnerability.
675 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]676 "resource": { # #
677 # The resource for which the `Occurrence` applies.
678 # Resource is an entity that can have metadata. E.g., a Docker image.
679 "contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.
680 "type": "A String", # The type of hash that was performed.
681 "value": "A String", # The hash value.
682 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]683 "name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]684 "uri": "A String", # The unique URI of the resource. E.g.,
685 # "https://gcr.io/project/image@sha256:foo" for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]686 },
687 "updateTime": "A String", # Output only. The time this `Occurrence` was last updated.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]688 "upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.
689 # specific upgrade. This presence is supplied via local sources (i.e. it is
690 # present in the mirror and the running system has noticed its availability).
691 "distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system
692 # for the resource_url. This allows efficient filtering, as well as
693 # making it easier to use the occurrence.
694 # operating system (CPE). Some distributions have additional metadata around
695 # updates, classifying them into various categories and severities.
696 "cpeUri": "A String", # Required - The specific operating system this metadata applies to. See
697 # https://cpe.mitre.org/specification/.
698 "cve": [ # The cve that would be resolved by this upgrade.
699 "A String",
700 ],
701 "severity": "A String", # The severity as specified by the upstream operating system.
702 "classification": "A String", # The operating system classification of this Upgrade, as specified by the
703 # upstream operating system upgrade feed.
704 },
705 "parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.
706 # For a discussion of this in Debian/Ubuntu:
707 # http://serverfault.com/questions/604541/debian-packages-version-convention
708 # For a discussion of this in Redhat/Fedora/Centos:
709 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
710 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
711 "name": "A String", # The main part of the version name.
712 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
713 # If kind is not NORMAL, then the other fields are ignored.
714 "revision": "A String", # The iteration of the package build from the above version.
715 },
716 "package": "A String", # Required - The package this Upgrade is for.
717 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]718 "installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.
719 # a system.
720 "location": [ # All of the places within the filesystem versions of this package
721 # have been found.
722 { # An occurrence of a particular package installation found within a
723 # system's filesystem.
724 # e.g. glibc was found in /var/lib/dpkg/status
725 "path": "A String", # The path from which we gathered that this package/version is installed.
726 "cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)
727 # denoting the package manager version distributing a package.
728 "version": { # Version contains structured information about the version of the package. # The version installed at this location.
729 # For a discussion of this in Debian/Ubuntu:
730 # http://serverfault.com/questions/604541/debian-packages-version-convention
731 # For a discussion of this in Redhat/Fedora/Centos:
732 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]733 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
734 "name": "A String", # The main part of the version name.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]735 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
736 # If kind is not NORMAL, then the other fields are ignored.
737 "revision": "A String", # The iteration of the package build from the above version.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]738 },
739 },
740 ],
741 "name": "A String", # Output only. The name of the installed package.
742 },
743 "name": "A String", # Output only. The name of the `Occurrence` in the form
744 # "projects/{project_id}/occurrences/{OCCURRENCE_ID}"
745 "kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are
746 # specified. This field can be used as a filter in list requests.
747 "buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.
748 "provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance
749 # details about the build from source to completion.
750 "finishTime": "A String", # Time at which execution of the build was finished.
751 "commands": [ # Commands requested by the build.
752 { # Command describes a step performed as part of the build pipeline.
753 "waitFor": [ # The ID(s) of the Command(s) that this Command depends on.
754 "A String",
755 ],
756 "name": "A String", # Name of the command, as presented on the command line, or if the command is
757 # packaged as a Docker container, as presented to `docker pull`.
758 "args": [ # Command-line arguments used when executing this Command.
759 "A String",
760 ],
761 "env": [ # Environment variables set before running this Command.
762 "A String",
763 ],
764 "id": "A String", # Optional unique identifier for this Command, used in wait_for to reference
765 # this Command as a dependency.
766 "dir": "A String", # Working directory (relative to project source root) used when running
767 # this Command.
768 },
769 ],
770 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
771 "artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this
772 # location.
773 # Google Cloud Storage.
774 "generation": "A String", # Google Cloud Storage generation for the object.
775 "object": "A String", # Google Cloud Storage object containing source.
776 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
777 # Requirements]
778 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
779 },
780 "repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.
781 # Repository.
782 "projectId": "A String", # ID of the project that owns the repo.
783 "branchName": "A String", # Name of the branch to build.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]784 "commitSha": "A String", # Explicit commit SHA to build.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]785 "tagName": "A String", # Name of the tag to build.
786 "repoName": "A String", # Name of the repo.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]787 },
788 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
789 # source integrity was maintained in the build.
790 #
791 # The keys to this map are file paths used as build source and the values
792 # contain the hash values for those files.
793 #
794 # If the build source came in a single package such as a gzipped tarfile
795 # (.tar.gz), the FileHash will be for the single path to that file.
796 "a_key": { # Container message for hashes of byte content of files, used in Source
797 # messages to verify integrity of source input to the build.
798 "fileHash": [ # Collection of file hashes.
799 { # Container message for hash values.
800 "type": "A String", # The type of hash that was performed.
801 "value": "A String", # The hash value.
802 },
803 ],
804 },
805 },
806 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
807 # these locations, in the case where the source repository had multiple
808 # remotes or submodules. This list will not include the context specified in
809 # the context field.
810 { # A SourceContext is a reference to a tree of files. A SourceContext together
811 # with a path point to a unique revision of a single file or directory.
812 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
813 # repository (e.g., GitHub).
814 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]815 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]816 },
817 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
818 # Source Repo.
819 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
820 "kind": "A String", # The alias kind.
821 "name": "A String", # The alias name.
822 },
823 "revisionId": "A String", # A revision ID.
824 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]825 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]826 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
827 # winged-cargo-31) and a repo name within that project.
828 "projectId": "A String", # The ID of the project.
829 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
830 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]831 },
832 },
833 "labels": { # Labels with user defined metadata.
834 "a_key": "A String",
835 },
836 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
837 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
838 "kind": "A String", # The alias kind.
839 "name": "A String", # The alias name.
840 },
841 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]842 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]843 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
844 # "project/subproject" is a valid project name. The "repo name" is
845 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]846 },
847 },
848 ],
849 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
850 # with a path point to a unique revision of a single file or directory.
851 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
852 # repository (e.g., GitHub).
853 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]854 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]855 },
856 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
857 # Source Repo.
858 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
859 "kind": "A String", # The alias kind.
860 "name": "A String", # The alias name.
861 },
862 "revisionId": "A String", # A revision ID.
863 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]864 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]865 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
866 # winged-cargo-31) and a repo name within that project.
867 "projectId": "A String", # The ID of the project.
868 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
869 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]870 },
871 },
872 "labels": { # Labels with user defined metadata.
873 "a_key": "A String",
874 },
875 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
876 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
877 "kind": "A String", # The alias kind.
878 "name": "A String", # The alias name.
879 },
880 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]881 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]882 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
883 # "project/subproject" is a valid project name. The "repo name" is
884 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]885 },
886 },
887 "storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud
888 # Storage.
889 # Google Cloud Storage.
890 "generation": "A String", # Google Cloud Storage generation for the object.
891 "object": "A String", # Google Cloud Storage object containing source.
892 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
893 # Requirements]
894 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
895 },
896 },
897 "buildOptions": { # Special options applied to this build. This is a catch-all field where
898 # build providers can enter any desired additional details.
899 "a_key": "A String",
900 },
901 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
902 # user's e-mail address at the time the build was initiated; this address may
903 # not represent the same end-user for all time.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]904 "projectId": "A String", # ID of the project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]905 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
906 "createTime": "A String", # Time at which the build was created.
907 "builtArtifacts": [ # Output of the build.
908 { # Artifact describes a build product.
909 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
910 # container.
911 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
912 # like gcr.io/projectID/imagename@sha256:123456
913 "name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in
914 # the case of a container build, the name used to push the container image to
915 # Google Container Registry, as presented to `docker push`.
916 #
917 # This field is deprecated in favor of the plural `names` field; it continues
918 # to exist here to allow existing BuildProvenance serialized to json in
919 # google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to
920 # deserialize back into proto.
921 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
922 # the case of a container build, the name used to push the container image to
923 # Google Container Registry, as presented to `docker push`. Note that a
924 # single Artifact ID can have multiple names, for example if two tags are
925 # applied to one image.
926 "A String",
927 ],
928 },
929 ],
930 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
931 "startTime": "A String", # Time at which execution of the build was started.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]932 "logsBucket": "A String", # Google Cloud Storage bucket where logs were written.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]933 "id": "A String", # Unique identifier of the build.
934 },
935 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
936 # `BuildSignature` in the corresponding Result. After verifying the
937 # signature, `provenance_bytes` can be unmarshalled and compared to the
938 # provenance to confirm that it is unchanged. A base64-encoded string
939 # representation of the provenance bytes is used for the signature in order
940 # to interoperate with openssl which expects this format for signature
941 # verification.
942 #
943 # The serialized form is captured both to avoid ambiguity in how the
944 # provenance is marshalled to json as well to prevent incompatibilities with
945 # future changes.
946 },
947 "discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.
948 "analysisStatus": "A String", # The status of discovery for the resource.
949 "operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.
950 # This field is deprecated, do not use.
951 # network API call.
952 "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
953 # different programming environments, including REST APIs and RPC APIs. It is
954 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
955 # three pieces of data: error code, error message, and error details.
956 #
957 # You can find out more about this error model and how to work with it in the
958 # [API Design Guide](https://cloud.google.com/apis/design/errors).
959 "message": "A String", # A developer-facing error message, which should be in English. Any
960 # user-facing error message should be localized and sent in the
961 # google.rpc.Status.details field, or localized by the client.
962 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
963 "details": [ # A list of messages that carry the error details. There is a common set of
964 # message types for APIs to use.
965 {
966 "a_key": "", # Properties of the object. Contains field @type with type URL.
967 },
968 ],
969 },
970 "done": True or False, # If the value is `false`, it means the operation is still in progress.
971 # If `true`, the operation is completed, and either `error` or `response` is
972 # available.
973 "response": { # The normal response of the operation in case of success. If the original
974 # method returns no data on success, such as `Delete`, the response is
975 # `google.protobuf.Empty`. If the original method is standard
976 # `Get`/`Create`/`Update`, the response should be the resource. For other
977 # methods, the response should have the type `XxxResponse`, where `Xxx`
978 # is the original method name. For example, if the original method name
979 # is `TakeSnapshot()`, the inferred response type is
980 # `TakeSnapshotResponse`.
981 "a_key": "", # Properties of the object. Contains field @type with type URL.
982 },
983 "name": "A String", # The server-assigned name, which is only unique within the same service that
984 # originally returns it. If you use the default HTTP mapping, the
985 # `name` should be a resource name ending with `operations/{unique_id}`.
986 "metadata": { # Service-specific metadata associated with the operation. It typically
987 # contains progress information and common metadata such as create time.
988 # Some services might not provide such metadata. Any method that returns a
989 # long-running operation should document the metadata type, if any.
990 "a_key": "", # Properties of the object. Contains field @type with type URL.
991 },
992 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]993 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
994 "cpe": "A String", # The CPE of the resource being scanned.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]995 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
996 # details to show to the user. The LocalizedMessage output only and
997 # populated by the API.
998 # different programming environments, including REST APIs and RPC APIs. It is
999 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
1000 # three pieces of data: error code, error message, and error details.
1001 #
1002 # You can find out more about this error model and how to work with it in the
1003 # [API Design Guide](https://cloud.google.com/apis/design/errors).
1004 "message": "A String", # A developer-facing error message, which should be in English. Any
1005 # user-facing error message should be localized and sent in the
1006 # google.rpc.Status.details field, or localized by the client.
1007 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
1008 "details": [ # A list of messages that carry the error details. There is a common set of
1009 # message types for APIs to use.
1010 {
1011 "a_key": "", # Properties of the object. Contains field @type with type URL.
1012 },
1013 ],
1014 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1015 },
1016 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.
1017 # Attestation can be verified using the attached signature. If the verifier
1018 # trusts the public key of the signer, then verifying the signature is
1019 # sufficient to establish trust. In this circumstance, the
1020 # AttestationAuthority to which this Attestation is attached is primarily
1021 # useful for look-up (how to find this Attestation if you already know the
1022 # Authority and artifact to be verified) and intent (which authority was this
1023 # attestation intended to sign for).
1024 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.
1025 # This message only supports `ATTACHED` signatures, where the payload that is
1026 # signed is included alongside the signature itself in the same file.
1027 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
1028 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
1029 # 160-bit fingerprint, expressed as a 40 character hexadecimal string. See
1030 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
1031 # Implementations may choose to acknowledge "LONG", "SHORT", or other
1032 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
1033 # In gpg, the full fingerprint can be retrieved from the `fpr` field
1034 # returned when calling --list-keys with --with-colons. For example:
1035 # ```
1036 # gpg --with-colons --with-fingerprint --force-v4-certs \
1037 # --list-keys attester@example.com
1038 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1039 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1040 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
1041 # ```
1042 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
1043 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
1044 # The verifier must ensure that the provided type is one that the verifier
1045 # supports, and that the attestation payload is a valid instantiation of that
1046 # type (for example by validating a JSON schema).
1047 "signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or
1048 # equivalent. Since this message only supports attached signatures, the
1049 # payload that was signed must be attached. While the signature format
1050 # supported is dependent on the verification implementation, currently only
1051 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
1052 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
1053 # --output=signature.gpg payload.json` will create the signature content
1054 # expected in this field in `signature.gpg` for the `payload.json`
1055 # attestation payload.
1056 },
1057 },
1058 "noteName": "A String", # An analysis note associated with this image, in the form
1059 # "providers/{provider_id}/notes/{NOTE_ID}"
1060 # This field can be used as a filter in list requests.
1061 "deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.
1062 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the
1063 # deployable field with the same name.
1064 "A String",
1065 ],
1066 "userEmail": "A String", # Identity of the user that triggered this deployment.
1067 "address": "A String", # Address of the runtime element hosting this deployment.
1068 "platform": "A String", # Platform hosting this deployment.
1069 "deployTime": "A String", # Beginning of the lifetime of this deployment.
1070 "undeployTime": "A String", # End of the lifetime of this deployment.
1071 "config": "A String", # Configuration used to create this deployment.
1072 },
1073 "remediation": "A String", # A description of actions that can be taken to remedy the `Note`
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1074 "resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`
1075 # applies. For example, https://gcr.io/project/image@sha256:foo This field
1076 # can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1077 "createTime": "A String", # Output only. The time this `Occurrence` was created.
1078 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis
1079 # in the associated note.
1080 # DockerImage relationship. This image would be produced from a Dockerfile
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1081 # with FROM &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1082 "distance": 42, # Output only. The number of layers by which this image differs from the
1083 # associated image basis.
1084 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
1085 # occurrence.
1086 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
1087 # "distance" and is ordered with [distance] being the layer immediately
1088 # following the base image and [1] being the final layer.
1089 { # Layer holds metadata specific to a layer of a Docker image.
1090 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
1091 "directive": "A String", # The recovered Dockerfile directive used to construct this layer.
1092 },
1093 ],
1094 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.
1095 "v1Name": "A String", # The layer-id of the final layer in the Docker image's v1
1096 # representation.
1097 # This field can be used as a filter in list requests.
1098 "v2Blob": [ # The ordered list of v2 blobs that represent a given image.
1099 "A String",
1100 ],
1101 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
1102 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
1103 # Only the name of the final blob is kept.
1104 # This field can be used as a filter in list requests.
1105 },
1106 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1107 }</pre>
1108</div>
1109
1110<div class="method">
1111 <code class="details" id="delete">delete(name, x__xgafv=None)</code>
1112 <pre>Deletes the given `Occurrence` from the system. Use this when
1113an `Occurrence` is no longer applicable for the given resource.
1114
1115Args:
1116 name: string, The name of the occurrence in the form of
1117"projects/{project_id}/occurrences/{OCCURRENCE_ID}" (required)
1118 x__xgafv: string, V1 error format.
1119 Allowed values
1120 1 - v1 error format
1121 2 - v2 error format
1122
1123Returns:
1124 An object of the form:
1125
1126 { # A generic empty message that you can re-use to avoid defining duplicated
1127 # empty messages in your APIs. A typical example is to use it as the request
1128 # or the response type of an API method. For instance:
1129 #
1130 # service Foo {
1131 # rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
1132 # }
1133 #
1134 # The JSON representation for `Empty` is empty JSON object `{}`.
1135 }</pre>
1136</div>
1137
1138<div class="method">
1139 <code class="details" id="get">get(name, x__xgafv=None)</code>
1140 <pre>Returns the requested `Occurrence`.
1141
1142Args:
1143 name: string, The name of the occurrence of the form
1144"projects/{project_id}/occurrences/{OCCURRENCE_ID}" (required)
1145 x__xgafv: string, V1 error format.
1146 Allowed values
1147 1 - v1 error format
1148 2 - v2 error format
1149
1150Returns:
1151 An object of the form:
1152
1153 { # `Occurrence` includes information about analysis occurrences for an image.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1154 "vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.
1155 # to fix it.
1156 "packageIssue": [ # The set of affected locations and their fixes (if available) within
1157 # the associated resource.
1158 { # This message wraps a location affected by a vulnerability and its
1159 # associated fix (if one is available).
1160 "severityName": "A String",
1161 "affectedLocation": { # The location of the vulnerability # The location of the vulnerability.
1162 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
1163 # format. Examples include distro or storage location for vulnerable jar.
1164 # This field can be used as a filter in list requests.
1165 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
1166 # filter in list requests.
1167 # For a discussion of this in Debian/Ubuntu:
1168 # http://serverfault.com/questions/604541/debian-packages-version-convention
1169 # For a discussion of this in Redhat/Fedora/Centos:
1170 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
1171 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1172 "name": "A String", # The main part of the version name.
1173 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
1174 # If kind is not NORMAL, then the other fields are ignored.
1175 "revision": "A String", # The iteration of the package build from the above version.
1176 },
1177 "package": "A String", # The package being described.
1178 },
1179 "fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.
1180 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
1181 # format. Examples include distro or storage location for vulnerable jar.
1182 # This field can be used as a filter in list requests.
1183 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
1184 # filter in list requests.
1185 # For a discussion of this in Debian/Ubuntu:
1186 # http://serverfault.com/questions/604541/debian-packages-version-convention
1187 # For a discussion of this in Redhat/Fedora/Centos:
1188 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
1189 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1190 "name": "A String", # The main part of the version name.
1191 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
1192 # If kind is not NORMAL, then the other fields are ignored.
1193 "revision": "A String", # The iteration of the package build from the above version.
1194 },
1195 "package": "A String", # The package being described.
1196 },
1197 },
1198 ],
1199 "type": "A String", # The type of package; whether native or non native(ruby gems,
1200 # node.js packages etc)
1201 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
1202 # scale of 0-10 where 0 indicates low severity and 10 indicates high
1203 # severity.
1204 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
1205 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is
1206 # available and note provider assigned severity when distro has not yet
1207 # assigned a severity for this vulnerability.
1208 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1209 "resource": { # #
1210 # The resource for which the `Occurrence` applies.
1211 # Resource is an entity that can have metadata. E.g., a Docker image.
1212 "contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.
1213 "type": "A String", # The type of hash that was performed.
1214 "value": "A String", # The hash value.
1215 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1216 "name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1217 "uri": "A String", # The unique URI of the resource. E.g.,
1218 # "https://gcr.io/project/image@sha256:foo" for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1219 },
1220 "updateTime": "A String", # Output only. The time this `Occurrence` was last updated.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1221 "upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.
1222 # specific upgrade. This presence is supplied via local sources (i.e. it is
1223 # present in the mirror and the running system has noticed its availability).
1224 "distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system
1225 # for the resource_url. This allows efficient filtering, as well as
1226 # making it easier to use the occurrence.
1227 # operating system (CPE). Some distributions have additional metadata around
1228 # updates, classifying them into various categories and severities.
1229 "cpeUri": "A String", # Required - The specific operating system this metadata applies to. See
1230 # https://cpe.mitre.org/specification/.
1231 "cve": [ # The cve that would be resolved by this upgrade.
1232 "A String",
1233 ],
1234 "severity": "A String", # The severity as specified by the upstream operating system.
1235 "classification": "A String", # The operating system classification of this Upgrade, as specified by the
1236 # upstream operating system upgrade feed.
1237 },
1238 "parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.
1239 # For a discussion of this in Debian/Ubuntu:
1240 # http://serverfault.com/questions/604541/debian-packages-version-convention
1241 # For a discussion of this in Redhat/Fedora/Centos:
1242 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
1243 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1244 "name": "A String", # The main part of the version name.
1245 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
1246 # If kind is not NORMAL, then the other fields are ignored.
1247 "revision": "A String", # The iteration of the package build from the above version.
1248 },
1249 "package": "A String", # Required - The package this Upgrade is for.
1250 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1251 "installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.
1252 # a system.
1253 "location": [ # All of the places within the filesystem versions of this package
1254 # have been found.
1255 { # An occurrence of a particular package installation found within a
1256 # system's filesystem.
1257 # e.g. glibc was found in /var/lib/dpkg/status
1258 "path": "A String", # The path from which we gathered that this package/version is installed.
1259 "cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)
1260 # denoting the package manager version distributing a package.
1261 "version": { # Version contains structured information about the version of the package. # The version installed at this location.
1262 # For a discussion of this in Debian/Ubuntu:
1263 # http://serverfault.com/questions/604541/debian-packages-version-convention
1264 # For a discussion of this in Redhat/Fedora/Centos:
1265 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1266 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1267 "name": "A String", # The main part of the version name.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1268 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
1269 # If kind is not NORMAL, then the other fields are ignored.
1270 "revision": "A String", # The iteration of the package build from the above version.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1271 },
1272 },
1273 ],
1274 "name": "A String", # Output only. The name of the installed package.
1275 },
1276 "name": "A String", # Output only. The name of the `Occurrence` in the form
1277 # "projects/{project_id}/occurrences/{OCCURRENCE_ID}"
1278 "kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are
1279 # specified. This field can be used as a filter in list requests.
1280 "buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.
1281 "provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance
1282 # details about the build from source to completion.
1283 "finishTime": "A String", # Time at which execution of the build was finished.
1284 "commands": [ # Commands requested by the build.
1285 { # Command describes a step performed as part of the build pipeline.
1286 "waitFor": [ # The ID(s) of the Command(s) that this Command depends on.
1287 "A String",
1288 ],
1289 "name": "A String", # Name of the command, as presented on the command line, or if the command is
1290 # packaged as a Docker container, as presented to `docker pull`.
1291 "args": [ # Command-line arguments used when executing this Command.
1292 "A String",
1293 ],
1294 "env": [ # Environment variables set before running this Command.
1295 "A String",
1296 ],
1297 "id": "A String", # Optional unique identifier for this Command, used in wait_for to reference
1298 # this Command as a dependency.
1299 "dir": "A String", # Working directory (relative to project source root) used when running
1300 # this Command.
1301 },
1302 ],
1303 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
1304 "artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this
1305 # location.
1306 # Google Cloud Storage.
1307 "generation": "A String", # Google Cloud Storage generation for the object.
1308 "object": "A String", # Google Cloud Storage object containing source.
1309 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
1310 # Requirements]
1311 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
1312 },
1313 "repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.
1314 # Repository.
1315 "projectId": "A String", # ID of the project that owns the repo.
1316 "branchName": "A String", # Name of the branch to build.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1317 "commitSha": "A String", # Explicit commit SHA to build.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1318 "tagName": "A String", # Name of the tag to build.
1319 "repoName": "A String", # Name of the repo.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1320 },
1321 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
1322 # source integrity was maintained in the build.
1323 #
1324 # The keys to this map are file paths used as build source and the values
1325 # contain the hash values for those files.
1326 #
1327 # If the build source came in a single package such as a gzipped tarfile
1328 # (.tar.gz), the FileHash will be for the single path to that file.
1329 "a_key": { # Container message for hashes of byte content of files, used in Source
1330 # messages to verify integrity of source input to the build.
1331 "fileHash": [ # Collection of file hashes.
1332 { # Container message for hash values.
1333 "type": "A String", # The type of hash that was performed.
1334 "value": "A String", # The hash value.
1335 },
1336 ],
1337 },
1338 },
1339 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
1340 # these locations, in the case where the source repository had multiple
1341 # remotes or submodules. This list will not include the context specified in
1342 # the context field.
1343 { # A SourceContext is a reference to a tree of files. A SourceContext together
1344 # with a path point to a unique revision of a single file or directory.
1345 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
1346 # repository (e.g., GitHub).
1347 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1348 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1349 },
1350 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
1351 # Source Repo.
1352 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
1353 "kind": "A String", # The alias kind.
1354 "name": "A String", # The alias name.
1355 },
1356 "revisionId": "A String", # A revision ID.
1357 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1358 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1359 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
1360 # winged-cargo-31) and a repo name within that project.
1361 "projectId": "A String", # The ID of the project.
1362 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
1363 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1364 },
1365 },
1366 "labels": { # Labels with user defined metadata.
1367 "a_key": "A String",
1368 },
1369 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
1370 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
1371 "kind": "A String", # The alias kind.
1372 "name": "A String", # The alias name.
1373 },
1374 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1375 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1376 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
1377 # "project/subproject" is a valid project name. The "repo name" is
1378 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1379 },
1380 },
1381 ],
1382 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
1383 # with a path point to a unique revision of a single file or directory.
1384 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
1385 # repository (e.g., GitHub).
1386 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1387 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1388 },
1389 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
1390 # Source Repo.
1391 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
1392 "kind": "A String", # The alias kind.
1393 "name": "A String", # The alias name.
1394 },
1395 "revisionId": "A String", # A revision ID.
1396 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1397 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1398 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
1399 # winged-cargo-31) and a repo name within that project.
1400 "projectId": "A String", # The ID of the project.
1401 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
1402 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1403 },
1404 },
1405 "labels": { # Labels with user defined metadata.
1406 "a_key": "A String",
1407 },
1408 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
1409 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
1410 "kind": "A String", # The alias kind.
1411 "name": "A String", # The alias name.
1412 },
1413 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1414 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1415 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
1416 # "project/subproject" is a valid project name. The "repo name" is
1417 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1418 },
1419 },
1420 "storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud
1421 # Storage.
1422 # Google Cloud Storage.
1423 "generation": "A String", # Google Cloud Storage generation for the object.
1424 "object": "A String", # Google Cloud Storage object containing source.
1425 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
1426 # Requirements]
1427 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
1428 },
1429 },
1430 "buildOptions": { # Special options applied to this build. This is a catch-all field where
1431 # build providers can enter any desired additional details.
1432 "a_key": "A String",
1433 },
1434 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
1435 # user's e-mail address at the time the build was initiated; this address may
1436 # not represent the same end-user for all time.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1437 "projectId": "A String", # ID of the project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1438 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
1439 "createTime": "A String", # Time at which the build was created.
1440 "builtArtifacts": [ # Output of the build.
1441 { # Artifact describes a build product.
1442 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
1443 # container.
1444 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
1445 # like gcr.io/projectID/imagename@sha256:123456
1446 "name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in
1447 # the case of a container build, the name used to push the container image to
1448 # Google Container Registry, as presented to `docker push`.
1449 #
1450 # This field is deprecated in favor of the plural `names` field; it continues
1451 # to exist here to allow existing BuildProvenance serialized to json in
1452 # google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to
1453 # deserialize back into proto.
1454 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
1455 # the case of a container build, the name used to push the container image to
1456 # Google Container Registry, as presented to `docker push`. Note that a
1457 # single Artifact ID can have multiple names, for example if two tags are
1458 # applied to one image.
1459 "A String",
1460 ],
1461 },
1462 ],
1463 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
1464 "startTime": "A String", # Time at which execution of the build was started.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1465 "logsBucket": "A String", # Google Cloud Storage bucket where logs were written.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1466 "id": "A String", # Unique identifier of the build.
1467 },
1468 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
1469 # `BuildSignature` in the corresponding Result. After verifying the
1470 # signature, `provenance_bytes` can be unmarshalled and compared to the
1471 # provenance to confirm that it is unchanged. A base64-encoded string
1472 # representation of the provenance bytes is used for the signature in order
1473 # to interoperate with openssl which expects this format for signature
1474 # verification.
1475 #
1476 # The serialized form is captured both to avoid ambiguity in how the
1477 # provenance is marshalled to json as well to prevent incompatibilities with
1478 # future changes.
1479 },
1480 "discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.
1481 "analysisStatus": "A String", # The status of discovery for the resource.
1482 "operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.
1483 # This field is deprecated, do not use.
1484 # network API call.
1485 "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
1486 # different programming environments, including REST APIs and RPC APIs. It is
1487 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
1488 # three pieces of data: error code, error message, and error details.
1489 #
1490 # You can find out more about this error model and how to work with it in the
1491 # [API Design Guide](https://cloud.google.com/apis/design/errors).
1492 "message": "A String", # A developer-facing error message, which should be in English. Any
1493 # user-facing error message should be localized and sent in the
1494 # google.rpc.Status.details field, or localized by the client.
1495 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
1496 "details": [ # A list of messages that carry the error details. There is a common set of
1497 # message types for APIs to use.
1498 {
1499 "a_key": "", # Properties of the object. Contains field @type with type URL.
1500 },
1501 ],
1502 },
1503 "done": True or False, # If the value is `false`, it means the operation is still in progress.
1504 # If `true`, the operation is completed, and either `error` or `response` is
1505 # available.
1506 "response": { # The normal response of the operation in case of success. If the original
1507 # method returns no data on success, such as `Delete`, the response is
1508 # `google.protobuf.Empty`. If the original method is standard
1509 # `Get`/`Create`/`Update`, the response should be the resource. For other
1510 # methods, the response should have the type `XxxResponse`, where `Xxx`
1511 # is the original method name. For example, if the original method name
1512 # is `TakeSnapshot()`, the inferred response type is
1513 # `TakeSnapshotResponse`.
1514 "a_key": "", # Properties of the object. Contains field @type with type URL.
1515 },
1516 "name": "A String", # The server-assigned name, which is only unique within the same service that
1517 # originally returns it. If you use the default HTTP mapping, the
1518 # `name` should be a resource name ending with `operations/{unique_id}`.
1519 "metadata": { # Service-specific metadata associated with the operation. It typically
1520 # contains progress information and common metadata such as create time.
1521 # Some services might not provide such metadata. Any method that returns a
1522 # long-running operation should document the metadata type, if any.
1523 "a_key": "", # Properties of the object. Contains field @type with type URL.
1524 },
1525 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1526 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
1527 "cpe": "A String", # The CPE of the resource being scanned.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1528 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
1529 # details to show to the user. The LocalizedMessage output only and
1530 # populated by the API.
1531 # different programming environments, including REST APIs and RPC APIs. It is
1532 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
1533 # three pieces of data: error code, error message, and error details.
1534 #
1535 # You can find out more about this error model and how to work with it in the
1536 # [API Design Guide](https://cloud.google.com/apis/design/errors).
1537 "message": "A String", # A developer-facing error message, which should be in English. Any
1538 # user-facing error message should be localized and sent in the
1539 # google.rpc.Status.details field, or localized by the client.
1540 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
1541 "details": [ # A list of messages that carry the error details. There is a common set of
1542 # message types for APIs to use.
1543 {
1544 "a_key": "", # Properties of the object. Contains field @type with type URL.
1545 },
1546 ],
1547 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1548 },
1549 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.
1550 # Attestation can be verified using the attached signature. If the verifier
1551 # trusts the public key of the signer, then verifying the signature is
1552 # sufficient to establish trust. In this circumstance, the
1553 # AttestationAuthority to which this Attestation is attached is primarily
1554 # useful for look-up (how to find this Attestation if you already know the
1555 # Authority and artifact to be verified) and intent (which authority was this
1556 # attestation intended to sign for).
1557 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.
1558 # This message only supports `ATTACHED` signatures, where the payload that is
1559 # signed is included alongside the signature itself in the same file.
1560 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
1561 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
1562 # 160-bit fingerprint, expressed as a 40 character hexadecimal string. See
1563 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
1564 # Implementations may choose to acknowledge "LONG", "SHORT", or other
1565 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
1566 # In gpg, the full fingerprint can be retrieved from the `fpr` field
1567 # returned when calling --list-keys with --with-colons. For example:
1568 # ```
1569 # gpg --with-colons --with-fingerprint --force-v4-certs \
1570 # --list-keys attester@example.com
1571 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1572 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1573 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
1574 # ```
1575 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
1576 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
1577 # The verifier must ensure that the provided type is one that the verifier
1578 # supports, and that the attestation payload is a valid instantiation of that
1579 # type (for example by validating a JSON schema).
1580 "signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or
1581 # equivalent. Since this message only supports attached signatures, the
1582 # payload that was signed must be attached. While the signature format
1583 # supported is dependent on the verification implementation, currently only
1584 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
1585 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
1586 # --output=signature.gpg payload.json` will create the signature content
1587 # expected in this field in `signature.gpg` for the `payload.json`
1588 # attestation payload.
1589 },
1590 },
1591 "noteName": "A String", # An analysis note associated with this image, in the form
1592 # "providers/{provider_id}/notes/{NOTE_ID}"
1593 # This field can be used as a filter in list requests.
1594 "deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.
1595 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the
1596 # deployable field with the same name.
1597 "A String",
1598 ],
1599 "userEmail": "A String", # Identity of the user that triggered this deployment.
1600 "address": "A String", # Address of the runtime element hosting this deployment.
1601 "platform": "A String", # Platform hosting this deployment.
1602 "deployTime": "A String", # Beginning of the lifetime of this deployment.
1603 "undeployTime": "A String", # End of the lifetime of this deployment.
1604 "config": "A String", # Configuration used to create this deployment.
1605 },
1606 "remediation": "A String", # A description of actions that can be taken to remedy the `Note`
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1607 "resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`
1608 # applies. For example, https://gcr.io/project/image@sha256:foo This field
1609 # can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1610 "createTime": "A String", # Output only. The time this `Occurrence` was created.
1611 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis
1612 # in the associated note.
1613 # DockerImage relationship. This image would be produced from a Dockerfile
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1614 # with FROM &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1615 "distance": 42, # Output only. The number of layers by which this image differs from the
1616 # associated image basis.
1617 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
1618 # occurrence.
1619 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
1620 # "distance" and is ordered with [distance] being the layer immediately
1621 # following the base image and [1] being the final layer.
1622 { # Layer holds metadata specific to a layer of a Docker image.
1623 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
1624 "directive": "A String", # The recovered Dockerfile directive used to construct this layer.
1625 },
1626 ],
1627 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.
1628 "v1Name": "A String", # The layer-id of the final layer in the Docker image's v1
1629 # representation.
1630 # This field can be used as a filter in list requests.
1631 "v2Blob": [ # The ordered list of v2 blobs that represent a given image.
1632 "A String",
1633 ],
1634 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
1635 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
1636 # Only the name of the final blob is kept.
1637 # This field can be used as a filter in list requests.
1638 },
1639 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1640 }</pre>
1641</div>
1642
1643<div class="method">
1644 <code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>
1645 <pre>Gets the access control policy for a note or an `Occurrence` resource.
1646Requires `containeranalysis.notes.setIamPolicy` or
1647`containeranalysis.occurrences.setIamPolicy` permission if the resource is
1648a note or occurrence, respectively.
1649Attempting to call this method on a resource without the required
1650permission will result in a `PERMISSION_DENIED` error. Attempting to call
1651this method on a non-existent resource will result in a `NOT_FOUND` error
1652if the user has list permission on the project, or a `PERMISSION_DENIED`
1653error otherwise. The resource takes the following formats:
1654`projects/{PROJECT_ID}/occurrences/{OCCURRENCE_ID}` for occurrences and
1655projects/{PROJECT_ID}/notes/{NOTE_ID} for notes
1656
1657Args:
1658 resource: string, REQUIRED: The resource for which the policy is being requested.
1659See the operation documentation for the appropriate value for this field. (required)
1660 body: object, The request body.
1661 The object takes the form of:
1662
1663{ # Request message for `GetIamPolicy` method.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1664 "options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to
1665 # `GetIamPolicy`.
1666 "requestedPolicyVersion": 42, # Optional. The policy format version to be returned.
1667 #
1668 # Valid values are 0, 1, and 3. Requests specifying an invalid value will be
1669 # rejected.
1670 #
1671 # Requests for policies with any conditional bindings must specify version 3.
1672 # Policies without any conditional bindings may specify any valid value or
1673 # leave the field unset.
1674 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1675 }
1676
1677 x__xgafv: string, V1 error format.
1678 Allowed values
1679 1 - v1 error format
1680 2 - v2 error format
1681
1682Returns:
1683 An object of the form:
1684
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1685 { # An Identity and Access Management (IAM) policy, which specifies access
1686 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1687 #
1688 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1689 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
1690 # `members` to a single `role`. Members can be user accounts, service accounts,
1691 # Google groups, and domains (such as G Suite). A `role` is a named list of
1692 # permissions; each `role` can be an IAM predefined role or a user-created
1693 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1694 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1695 # Optionally, a `binding` can specify a `condition`, which is a logical
1696 # expression that allows access to a resource only if the expression evaluates
1697 # to `true`. A condition can add constraints based on attributes of the
1698 # request, the resource, or both.
1699 #
1700 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1701 #
1702 # {
1703 # "bindings": [
1704 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1705 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1706 # "members": [
1707 # "user:mike@example.com",
1708 # "group:admins@example.com",
1709 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1710 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1711 # ]
1712 # },
1713 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1714 # "role": "roles/resourcemanager.organizationViewer",
1715 # "members": ["user:eve@example.com"],
1716 # "condition": {
1717 # "title": "expirable access",
1718 # "description": "Does not grant access after Sep 2020",
1719 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
1720 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1721 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1722 # ],
1723 # "etag": "BwWWja0YfJA=",
1724 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1725 # }
1726 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1727 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1728 #
1729 # bindings:
1730 # - members:
1731 # - user:mike@example.com
1732 # - group:admins@example.com
1733 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1734 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
1735 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1736 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1737 # - user:eve@example.com
1738 # role: roles/resourcemanager.organizationViewer
1739 # condition:
1740 # title: expirable access
1741 # description: Does not grant access after Sep 2020
1742 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
1743 # - etag: BwWWja0YfJA=
1744 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1745 #
1746 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1747 # [IAM documentation](https://cloud.google.com/iam/docs/).
1748 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
1749 # `condition` that determines how and when the `bindings` are applied. Each
1750 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1751 { # Associates `members` with a `role`.
1752 "role": "A String", # Role that is assigned to `members`.
1753 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
1754 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
1755 # `members` can have the following values:
1756 #
1757 # * `allUsers`: A special identifier that represents anyone who is
1758 # on the internet; with or without a Google account.
1759 #
1760 # * `allAuthenticatedUsers`: A special identifier that represents anyone
1761 # who is authenticated with a Google account or a service account.
1762 #
1763 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1764 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1765 #
1766 #
1767 # * `serviceAccount:{emailid}`: An email address that represents a service
1768 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
1769 #
1770 # * `group:{emailid}`: An email address that represents a Google group.
1771 # For example, `admins@example.com`.
1772 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1773 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
1774 # identifier) representing a user that has been recently deleted. For
1775 # example, `alice@example.com?uid=123456789012345678901`. If the user is
1776 # recovered, this value reverts to `user:{emailid}` and the recovered user
1777 # retains the role in the binding.
1778 #
1779 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
1780 # unique identifier) representing a service account that has been recently
1781 # deleted. For example,
1782 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
1783 # If the service account is undeleted, this value reverts to
1784 # `serviceAccount:{emailid}` and the undeleted service account retains the
1785 # role in the binding.
1786 #
1787 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
1788 # identifier) representing a Google group that has been recently
1789 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
1790 # the group is recovered, this value reverts to `group:{emailid}` and the
1791 # recovered group retains the role in the binding.
1792 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1793 #
1794 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
1795 # users of that domain. For example, `google.com` or `example.com`.
1796 #
1797 "A String",
1798 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1799 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1800 # NOTE: An unsatisfied condition will not allow user access via current
1801 # binding. Different bindings, including their conditions, are examined
1802 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1803 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
1804 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1805 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1806 # Example (Comparison):
1807 #
1808 # title: "Summary size limit"
1809 # description: "Determines if a summary is less than 100 chars"
1810 # expression: "document.summary.size() &lt; 100"
1811 #
1812 # Example (Equality):
1813 #
1814 # title: "Requestor is owner"
1815 # description: "Determines if requestor is the document owner"
1816 # expression: "document.owner == request.auth.claims.email"
1817 #
1818 # Example (Logic):
1819 #
1820 # title: "Public documents"
1821 # description: "Determine whether the document should be publicly visible"
1822 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
1823 #
1824 # Example (Data Manipulation):
1825 #
1826 # title: "Notification string"
1827 # description: "Create a notification string with a timestamp."
1828 # expression: "'New message received at ' + string(document.create_time)"
1829 #
1830 # The exact variables and functions that may be referenced within an expression
1831 # are determined by the service that evaluates it. See the service
1832 # documentation for additional information.
1833 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1834 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1835 "expression": "A String", # Textual representation of an expression in Common Expression Language
1836 # syntax.
1837 "location": "A String", # Optional. String indicating the location of the expression for error
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1838 # reporting, e.g. a file name and a position in the file.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1839 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1840 # its purpose. This can be used e.g. in UIs which allow to enter the
1841 # expression.
1842 },
1843 },
1844 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1845 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
1846 # prevent simultaneous updates of a policy from overwriting each other.
1847 # It is strongly suggested that systems make use of the `etag` in the
1848 # read-modify-write cycle to perform policy updates in order to avoid race
1849 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
1850 # systems are expected to put that etag in the request to `setIamPolicy` to
1851 # ensure that their change will be applied to the same version of the policy.
1852 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1853 # **Important:** If you use IAM Conditions, you must include the `etag` field
1854 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
1855 # you to overwrite a version `3` policy with a version `1` policy, and all of
1856 # the conditions in the version `3` policy are lost.
1857 "version": 42, # Specifies the format of the policy.
1858 #
1859 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
1860 # are rejected.
1861 #
1862 # Any operation that affects conditional role bindings must specify version
1863 # `3`. This requirement applies to the following operations:
1864 #
1865 # * Getting a policy that includes a conditional role binding
1866 # * Adding a conditional role binding to a policy
1867 # * Changing a conditional role binding in a policy
1868 # * Removing any role binding, with or without a condition, from a policy
1869 # that includes conditions
1870 #
1871 # **Important:** If you use IAM Conditions, you must include the `etag` field
1872 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
1873 # you to overwrite a version `3` policy with a version `1` policy, and all of
1874 # the conditions in the version `3` policy are lost.
1875 #
1876 # If a policy does not include any conditions, operations on that policy may
1877 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1878 }</pre>
1879</div>
1880
1881<div class="method">
1882 <code class="details" id="getNotes">getNotes(name, x__xgafv=None)</code>
1883 <pre>Gets the `Note` attached to the given `Occurrence`.
1884
1885Args:
1886 name: string, The name of the occurrence in the form
1887"projects/{project_id}/occurrences/{OCCURRENCE_ID}" (required)
1888 x__xgafv: string, V1 error format.
1889 Allowed values
1890 1 - v1 error format
1891 2 - v2 error format
1892
1893Returns:
1894 An object of the form:
1895
1896 { # Provides a detailed description of a `Note`.
1897 "buildType": { # Note holding the version of the provider's builder and the signature of # Build provenance type for a verifiable build.
1898 # the provenance message in linked BuildDetails.
1899 "builderVersion": "A String", # Version of the builder which produced this Note.
1900 "signature": { # Message encapsulating the signature of the verified build. # Signature of the build in Occurrences pointing to the Note containing this
1901 # `BuilderDetails`.
1902 "publicKey": "A String", # Public key of the builder which can be used to verify that the related
1903 # findings are valid and unchanged. If `key_type` is empty, this defaults
1904 # to PEM encoded public keys.
1905 #
1906 # This field may be empty if `key_id` references an external key.
1907 #
1908 # For Cloud Build based signatures, this is a PEM encoded public
1909 # key. To verify the Cloud Build signature, place the contents of
1910 # this field into a file (public.pem). The signature field is base64-decoded
1911 # into its binary representation in signature.bin, and the provenance bytes
1912 # from `BuildDetails` are base64-decoded into a binary representation in
1913 # signed.bin. OpenSSL can then verify the signature:
1914 # `openssl sha256 -verify public.pem -signature signature.bin signed.bin`
1915 "keyType": "A String", # The type of the key, either stored in `public_key` or referenced in
1916 # `key_id`
1917 "keyId": "A String", # An Id for the key used to sign. This could be either an Id for the key
1918 # stored in `public_key` (such as the Id or fingerprint for a PGP key, or the
1919 # CN for a cert), or a reference to an external key (such as a reference to a
1920 # key in Cloud Key Management Service).
1921 "signature": "A String", # Signature of the related `BuildProvenance`, encoded in a base64 string.
1922 },
1923 },
1924 "kind": "A String", # Output only. This explicitly denotes which kind of note is specified. This
1925 # field can be used as a filter in list requests.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1926 "upgrade": { # An Upgrade Note represents a potential upgrade of a package to a given # A note describing an upgrade.
1927 # version. For each package version combination (i.e. bash 4.0, bash 4.1,
1928 # bash 4.1.2), there will be a Upgrade Note.
1929 "version": { # Version contains structured information about the version of the package. # Required - The version of the package in machine + human readable form.
1930 # For a discussion of this in Debian/Ubuntu:
1931 # http://serverfault.com/questions/604541/debian-packages-version-convention
1932 # For a discussion of this in Redhat/Fedora/Centos:
1933 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
1934 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1935 "name": "A String", # The main part of the version name.
1936 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
1937 # If kind is not NORMAL, then the other fields are ignored.
1938 "revision": "A String", # The iteration of the package build from the above version.
1939 },
1940 "distributions": [ # Metadata about the upgrade for each specific operating system.
1941 { # The Upgrade Distribution represents metadata about the Upgrade for each
1942 # operating system (CPE). Some distributions have additional metadata around
1943 # updates, classifying them into various categories and severities.
1944 "cpeUri": "A String", # Required - The specific operating system this metadata applies to. See
1945 # https://cpe.mitre.org/specification/.
1946 "cve": [ # The cve that would be resolved by this upgrade.
1947 "A String",
1948 ],
1949 "severity": "A String", # The severity as specified by the upstream operating system.
1950 "classification": "A String", # The operating system classification of this Upgrade, as specified by the
1951 # upstream operating system upgrade feed.
1952 },
1953 ],
1954 "package": "A String", # Required - The package this Upgrade is for.
1955 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1956 "name": "A String", # The name of the note in the form
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1957 # "projects/{provider_project_id}/notes/{NOTE_ID}"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1958 "vulnerabilityType": { # VulnerabilityType provides metadata about a security vulnerability. # A package vulnerability type of note.
1959 "cvssScore": 3.14, # The CVSS score for this Vulnerability.
1960 "severity": "A String", # Note provider assigned impact of the vulnerability
1961 "details": [ # All information about the package to specifically identify this
1962 # vulnerability. One entry per (version range and cpe_uri) the
1963 # package vulnerability has manifested in.
1964 { # Identifies all occurrences of this vulnerability in the package for a
1965 # specific distro/location
1966 # For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2
1967 "severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.
1968 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in
1969 # which the vulnerability manifests. Examples include distro or storage
1970 # location for vulnerable jar.
1971 # This field can be used as a filter in list requests.
1972 "description": "A String", # A vendor-specific description of this note.
1973 "minAffectedVersion": { # Version contains structured information about the version of the package. # The min version of the package in which the vulnerability exists.
1974 # For a discussion of this in Debian/Ubuntu:
1975 # http://serverfault.com/questions/604541/debian-packages-version-convention
1976 # For a discussion of this in Redhat/Fedora/Centos:
1977 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1978 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1979 "name": "A String", # The main part of the version name.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1980 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
1981 # If kind is not NORMAL, then the other fields are ignored.
1982 "revision": "A String", # The iteration of the package build from the above version.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1983 },
1984 "package": "A String", # The name of the package where the vulnerability was found.
1985 # This field can be used as a filter in list requests.
1986 "packageType": "A String", # The type of package; whether native or non native(ruby gems,
1987 # node.js packages etc)
1988 "isObsolete": True or False, # Whether this Detail is obsolete. Occurrences are expected not to point to
1989 # obsolete details.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1990 "maxAffectedVersion": { # Version contains structured information about the version of the package. # The max version of the package in which the vulnerability exists.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1991 # For a discussion of this in Debian/Ubuntu:
1992 # http://serverfault.com/questions/604541/debian-packages-version-convention
1993 # For a discussion of this in Redhat/Fedora/Centos:
1994 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1995 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1996 "name": "A String", # The main part of the version name.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1997 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
1998 # If kind is not NORMAL, then the other fields are ignored.
1999 "revision": "A String", # The iteration of the package build from the above version.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2000 },
2001 "fixedLocation": { # The location of the vulnerability # The fix for this specific package version.
2002 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
2003 # format. Examples include distro or storage location for vulnerable jar.
2004 # This field can be used as a filter in list requests.
2005 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
2006 # filter in list requests.
2007 # For a discussion of this in Debian/Ubuntu:
2008 # http://serverfault.com/questions/604541/debian-packages-version-convention
2009 # For a discussion of this in Redhat/Fedora/Centos:
2010 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2011 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2012 "name": "A String", # The main part of the version name.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2013 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
2014 # If kind is not NORMAL, then the other fields are ignored.
2015 "revision": "A String", # The iteration of the package build from the above version.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2016 },
2017 "package": "A String", # The package being described.
2018 },
2019 },
2020 ],
2021 },
2022 "package": { # This represents a particular package that is distributed over # A note describing a package hosted by various package managers.
2023 # various channels.
2024 # e.g. glibc (aka libc6) is distributed by many, at various versions.
2025 "distribution": [ # The various channels by which a package is distributed.
2026 { # This represents a particular channel of distribution for a given package.
2027 # e.g. Debian's jessie-backports dpkg mirror
2028 "cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)
2029 # denoting the package manager version distributing a package.
2030 "maintainer": "A String", # A freeform string denoting the maintainer of this package.
2031 "description": "A String", # The distribution channel-specific description of this package.
2032 "url": "A String", # The distribution channel-specific homepage for this package.
2033 "architecture": "A String", # The CPU architecture for which packages in this distribution
2034 # channel were built
2035 "latestVersion": { # Version contains structured information about the version of the package. # The latest available version of this package in
2036 # this distribution channel.
2037 # For a discussion of this in Debian/Ubuntu:
2038 # http://serverfault.com/questions/604541/debian-packages-version-convention
2039 # For a discussion of this in Redhat/Fedora/Centos:
2040 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2041 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2042 "name": "A String", # The main part of the version name.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2043 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
2044 # If kind is not NORMAL, then the other fields are ignored.
2045 "revision": "A String", # The iteration of the package build from the above version.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2046 },
2047 },
2048 ],
2049 "name": "A String", # The name of the package.
2050 },
2051 "updateTime": "A String", # Output only. The time this note was last updated. This field can be used as
2052 # a filter in list requests.
2053 "relatedUrl": [ # URLs associated with this note
2054 { # Metadata for any related URL information
2055 "url": "A String", # Specific URL to associate with the note
2056 "label": "A String", # Label to describe usage of the URL
2057 },
2058 ],
2059 "longDescription": "A String", # A detailed description of this `Note`.
2060 "attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.
2061 # example, an organization might have one `AttestationAuthority` for "QA" and
2062 # one for "build". This Note is intended to act strictly as a grouping
2063 # mechanism for the attached Occurrences (Attestations). This grouping
2064 # mechanism also provides a security boundary, since IAM ACLs gate the ability
2065 # for a principle to attach an Occurrence to a given Note. It also provides a
2066 # single point of lookup to find all attached Attestation Occurrences, even if
2067 # they don't all live in the same project.
2068 "hint": { # This submessage provides human-readable hints about the purpose of the
2069 # AttestationAuthority. Because the name of a Note acts as its resource
2070 # reference, it is important to disambiguate the canonical name of the Note
2071 # (which might be a UUID for security purposes) from "readable" names more
2072 # suitable for debug output. Note that these hints should NOT be used to
2073 # look up AttestationAuthorities in security sensitive contexts, such as when
2074 # looking up Attestations to verify.
2075 "humanReadableName": "A String", # The human readable name of this Attestation Authority, for example "qa".
2076 },
2077 },
2078 "baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.
2079 # relationship. Linked occurrences are derived from this or an
2080 # equivalent image via:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2081 # FROM &lt;Basis.resource_url&gt;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2082 # Or an equivalent reference, e.g. a tag of the resource_url.
2083 "resourceUrl": "A String", # The resource_url for the resource representing the basis of
2084 # associated occurrence images.
2085 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the base image.
2086 "v1Name": "A String", # The layer-id of the final layer in the Docker image's v1
2087 # representation.
2088 # This field can be used as a filter in list requests.
2089 "v2Blob": [ # The ordered list of v2 blobs that represent a given image.
2090 "A String",
2091 ],
2092 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
2093 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
2094 # Only the name of the final blob is kept.
2095 # This field can be used as a filter in list requests.
2096 },
2097 },
2098 "expirationTime": "A String", # Time of expiration for this note, null if note does not expire.
2099 "deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.
2100 "resourceUri": [ # Resource URI for the artifact being deployed.
2101 "A String",
2102 ],
2103 },
2104 "shortDescription": "A String", # A one sentence description of this `Note`.
2105 "createTime": "A String", # Output only. The time this note was created. This field can be used as a
2106 # filter in list requests.
2107 "discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing a provider/analysis type.
2108 # exists in a provider's project. A `Discovery` occurrence is created in a
2109 # consumer's project at the start of analysis. The occurrence's operation will
2110 # indicate the status of the analysis. Absence of an occurrence linked to this
2111 # note for a resource indicates that analysis hasn't started.
2112 "analysisKind": "A String", # The kind of analysis that is handled by this discovery.
2113 },
2114 }</pre>
2115</div>
2116
2117<div class="method">
2118 <code class="details" id="getVulnerabilitySummary">getVulnerabilitySummary(parent, x__xgafv=None, filter=None)</code>
2119 <pre>Gets a summary of the number and severity of occurrences.
2120
2121Args:
2122 parent: string, This contains the project Id for example: projects/{project_id} (required)
2123 x__xgafv: string, V1 error format.
2124 Allowed values
2125 1 - v1 error format
2126 2 - v2 error format
2127 filter: string, The filter expression.
2128
2129Returns:
2130 An object of the form:
2131
2132 { # A summary of how many vulnz occurrences there are per severity type.
2133 # counts by groups, or if we should have different summary messages
2134 # like this.
2135 "counts": [ # A map of how many occurrences were found for each severity.
2136 { # The number of occurrences created for a specific severity.
2137 "count": "A String", # The number of occurrences with the severity.
2138 "severity": "A String", # The severity of the occurrences.
2139 },
2140 ],
2141 }</pre>
2142</div>
2143
2144<div class="method">
2145 <code class="details" id="list">list(parent, kind=None, name=None, pageToken=None, x__xgafv=None, pageSize=None, filter=None)</code>
2146 <pre>Lists active `Occurrences` for a given project matching the filters.
2147
2148Args:
2149 parent: string, This contains the project Id for example: projects/{project_id}. (required)
2150 kind: string, The kind of occurrences to filter on.
2151 name: string, The name field contains the project Id. For example:
2152"projects/{project_id}
2153@Deprecated
2154 pageToken: string, Token to provide to skip to a particular spot in the list.
2155 x__xgafv: string, V1 error format.
2156 Allowed values
2157 1 - v1 error format
2158 2 - v2 error format
2159 pageSize: integer, Number of occurrences to return in the list.
2160 filter: string, The filter expression.
2161
2162Returns:
2163 An object of the form:
2164
2165 { # Response including listed active occurrences.
2166 "nextPageToken": "A String", # The next pagination token in the list response. It should be used as
2167 # `page_token` for the following request. An empty value means no more
2168 # results.
2169 "occurrences": [ # The occurrences requested.
2170 { # `Occurrence` includes information about analysis occurrences for an image.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2171 "vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.
2172 # to fix it.
2173 "packageIssue": [ # The set of affected locations and their fixes (if available) within
2174 # the associated resource.
2175 { # This message wraps a location affected by a vulnerability and its
2176 # associated fix (if one is available).
2177 "severityName": "A String",
2178 "affectedLocation": { # The location of the vulnerability # The location of the vulnerability.
2179 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
2180 # format. Examples include distro or storage location for vulnerable jar.
2181 # This field can be used as a filter in list requests.
2182 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
2183 # filter in list requests.
2184 # For a discussion of this in Debian/Ubuntu:
2185 # http://serverfault.com/questions/604541/debian-packages-version-convention
2186 # For a discussion of this in Redhat/Fedora/Centos:
2187 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
2188 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2189 "name": "A String", # The main part of the version name.
2190 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
2191 # If kind is not NORMAL, then the other fields are ignored.
2192 "revision": "A String", # The iteration of the package build from the above version.
2193 },
2194 "package": "A String", # The package being described.
2195 },
2196 "fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.
2197 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
2198 # format. Examples include distro or storage location for vulnerable jar.
2199 # This field can be used as a filter in list requests.
2200 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
2201 # filter in list requests.
2202 # For a discussion of this in Debian/Ubuntu:
2203 # http://serverfault.com/questions/604541/debian-packages-version-convention
2204 # For a discussion of this in Redhat/Fedora/Centos:
2205 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
2206 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2207 "name": "A String", # The main part of the version name.
2208 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
2209 # If kind is not NORMAL, then the other fields are ignored.
2210 "revision": "A String", # The iteration of the package build from the above version.
2211 },
2212 "package": "A String", # The package being described.
2213 },
2214 },
2215 ],
2216 "type": "A String", # The type of package; whether native or non native(ruby gems,
2217 # node.js packages etc)
2218 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
2219 # scale of 0-10 where 0 indicates low severity and 10 indicates high
2220 # severity.
2221 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
2222 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is
2223 # available and note provider assigned severity when distro has not yet
2224 # assigned a severity for this vulnerability.
2225 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2226 "resource": { # #
2227 # The resource for which the `Occurrence` applies.
2228 # Resource is an entity that can have metadata. E.g., a Docker image.
2229 "contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.
2230 "type": "A String", # The type of hash that was performed.
2231 "value": "A String", # The hash value.
2232 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2233 "name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2234 "uri": "A String", # The unique URI of the resource. E.g.,
2235 # "https://gcr.io/project/image@sha256:foo" for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2236 },
2237 "updateTime": "A String", # Output only. The time this `Occurrence` was last updated.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2238 "upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.
2239 # specific upgrade. This presence is supplied via local sources (i.e. it is
2240 # present in the mirror and the running system has noticed its availability).
2241 "distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system
2242 # for the resource_url. This allows efficient filtering, as well as
2243 # making it easier to use the occurrence.
2244 # operating system (CPE). Some distributions have additional metadata around
2245 # updates, classifying them into various categories and severities.
2246 "cpeUri": "A String", # Required - The specific operating system this metadata applies to. See
2247 # https://cpe.mitre.org/specification/.
2248 "cve": [ # The cve that would be resolved by this upgrade.
2249 "A String",
2250 ],
2251 "severity": "A String", # The severity as specified by the upstream operating system.
2252 "classification": "A String", # The operating system classification of this Upgrade, as specified by the
2253 # upstream operating system upgrade feed.
2254 },
2255 "parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.
2256 # For a discussion of this in Debian/Ubuntu:
2257 # http://serverfault.com/questions/604541/debian-packages-version-convention
2258 # For a discussion of this in Redhat/Fedora/Centos:
2259 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
2260 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2261 "name": "A String", # The main part of the version name.
2262 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
2263 # If kind is not NORMAL, then the other fields are ignored.
2264 "revision": "A String", # The iteration of the package build from the above version.
2265 },
2266 "package": "A String", # Required - The package this Upgrade is for.
2267 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2268 "installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.
2269 # a system.
2270 "location": [ # All of the places within the filesystem versions of this package
2271 # have been found.
2272 { # An occurrence of a particular package installation found within a
2273 # system's filesystem.
2274 # e.g. glibc was found in /var/lib/dpkg/status
2275 "path": "A String", # The path from which we gathered that this package/version is installed.
2276 "cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)
2277 # denoting the package manager version distributing a package.
2278 "version": { # Version contains structured information about the version of the package. # The version installed at this location.
2279 # For a discussion of this in Debian/Ubuntu:
2280 # http://serverfault.com/questions/604541/debian-packages-version-convention
2281 # For a discussion of this in Redhat/Fedora/Centos:
2282 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2283 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2284 "name": "A String", # The main part of the version name.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2285 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
2286 # If kind is not NORMAL, then the other fields are ignored.
2287 "revision": "A String", # The iteration of the package build from the above version.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2288 },
2289 },
2290 ],
2291 "name": "A String", # Output only. The name of the installed package.
2292 },
2293 "name": "A String", # Output only. The name of the `Occurrence` in the form
2294 # "projects/{project_id}/occurrences/{OCCURRENCE_ID}"
2295 "kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are
2296 # specified. This field can be used as a filter in list requests.
2297 "buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.
2298 "provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance
2299 # details about the build from source to completion.
2300 "finishTime": "A String", # Time at which execution of the build was finished.
2301 "commands": [ # Commands requested by the build.
2302 { # Command describes a step performed as part of the build pipeline.
2303 "waitFor": [ # The ID(s) of the Command(s) that this Command depends on.
2304 "A String",
2305 ],
2306 "name": "A String", # Name of the command, as presented on the command line, or if the command is
2307 # packaged as a Docker container, as presented to `docker pull`.
2308 "args": [ # Command-line arguments used when executing this Command.
2309 "A String",
2310 ],
2311 "env": [ # Environment variables set before running this Command.
2312 "A String",
2313 ],
2314 "id": "A String", # Optional unique identifier for this Command, used in wait_for to reference
2315 # this Command as a dependency.
2316 "dir": "A String", # Working directory (relative to project source root) used when running
2317 # this Command.
2318 },
2319 ],
2320 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
2321 "artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this
2322 # location.
2323 # Google Cloud Storage.
2324 "generation": "A String", # Google Cloud Storage generation for the object.
2325 "object": "A String", # Google Cloud Storage object containing source.
2326 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
2327 # Requirements]
2328 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
2329 },
2330 "repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.
2331 # Repository.
2332 "projectId": "A String", # ID of the project that owns the repo.
2333 "branchName": "A String", # Name of the branch to build.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2334 "commitSha": "A String", # Explicit commit SHA to build.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2335 "tagName": "A String", # Name of the tag to build.
2336 "repoName": "A String", # Name of the repo.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2337 },
2338 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
2339 # source integrity was maintained in the build.
2340 #
2341 # The keys to this map are file paths used as build source and the values
2342 # contain the hash values for those files.
2343 #
2344 # If the build source came in a single package such as a gzipped tarfile
2345 # (.tar.gz), the FileHash will be for the single path to that file.
2346 "a_key": { # Container message for hashes of byte content of files, used in Source
2347 # messages to verify integrity of source input to the build.
2348 "fileHash": [ # Collection of file hashes.
2349 { # Container message for hash values.
2350 "type": "A String", # The type of hash that was performed.
2351 "value": "A String", # The hash value.
2352 },
2353 ],
2354 },
2355 },
2356 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
2357 # these locations, in the case where the source repository had multiple
2358 # remotes or submodules. This list will not include the context specified in
2359 # the context field.
2360 { # A SourceContext is a reference to a tree of files. A SourceContext together
2361 # with a path point to a unique revision of a single file or directory.
2362 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
2363 # repository (e.g., GitHub).
2364 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2365 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2366 },
2367 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
2368 # Source Repo.
2369 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2370 "kind": "A String", # The alias kind.
2371 "name": "A String", # The alias name.
2372 },
2373 "revisionId": "A String", # A revision ID.
2374 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2375 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2376 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
2377 # winged-cargo-31) and a repo name within that project.
2378 "projectId": "A String", # The ID of the project.
2379 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
2380 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2381 },
2382 },
2383 "labels": { # Labels with user defined metadata.
2384 "a_key": "A String",
2385 },
2386 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
2387 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2388 "kind": "A String", # The alias kind.
2389 "name": "A String", # The alias name.
2390 },
2391 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2392 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2393 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
2394 # "project/subproject" is a valid project name. The "repo name" is
2395 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2396 },
2397 },
2398 ],
2399 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
2400 # with a path point to a unique revision of a single file or directory.
2401 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
2402 # repository (e.g., GitHub).
2403 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2404 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2405 },
2406 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
2407 # Source Repo.
2408 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2409 "kind": "A String", # The alias kind.
2410 "name": "A String", # The alias name.
2411 },
2412 "revisionId": "A String", # A revision ID.
2413 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2414 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2415 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
2416 # winged-cargo-31) and a repo name within that project.
2417 "projectId": "A String", # The ID of the project.
2418 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
2419 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2420 },
2421 },
2422 "labels": { # Labels with user defined metadata.
2423 "a_key": "A String",
2424 },
2425 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
2426 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2427 "kind": "A String", # The alias kind.
2428 "name": "A String", # The alias name.
2429 },
2430 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2431 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2432 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
2433 # "project/subproject" is a valid project name. The "repo name" is
2434 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2435 },
2436 },
2437 "storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud
2438 # Storage.
2439 # Google Cloud Storage.
2440 "generation": "A String", # Google Cloud Storage generation for the object.
2441 "object": "A String", # Google Cloud Storage object containing source.
2442 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
2443 # Requirements]
2444 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
2445 },
2446 },
2447 "buildOptions": { # Special options applied to this build. This is a catch-all field where
2448 # build providers can enter any desired additional details.
2449 "a_key": "A String",
2450 },
2451 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
2452 # user's e-mail address at the time the build was initiated; this address may
2453 # not represent the same end-user for all time.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2454 "projectId": "A String", # ID of the project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2455 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
2456 "createTime": "A String", # Time at which the build was created.
2457 "builtArtifacts": [ # Output of the build.
2458 { # Artifact describes a build product.
2459 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
2460 # container.
2461 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
2462 # like gcr.io/projectID/imagename@sha256:123456
2463 "name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in
2464 # the case of a container build, the name used to push the container image to
2465 # Google Container Registry, as presented to `docker push`.
2466 #
2467 # This field is deprecated in favor of the plural `names` field; it continues
2468 # to exist here to allow existing BuildProvenance serialized to json in
2469 # google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to
2470 # deserialize back into proto.
2471 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
2472 # the case of a container build, the name used to push the container image to
2473 # Google Container Registry, as presented to `docker push`. Note that a
2474 # single Artifact ID can have multiple names, for example if two tags are
2475 # applied to one image.
2476 "A String",
2477 ],
2478 },
2479 ],
2480 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
2481 "startTime": "A String", # Time at which execution of the build was started.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2482 "logsBucket": "A String", # Google Cloud Storage bucket where logs were written.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2483 "id": "A String", # Unique identifier of the build.
2484 },
2485 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
2486 # `BuildSignature` in the corresponding Result. After verifying the
2487 # signature, `provenance_bytes` can be unmarshalled and compared to the
2488 # provenance to confirm that it is unchanged. A base64-encoded string
2489 # representation of the provenance bytes is used for the signature in order
2490 # to interoperate with openssl which expects this format for signature
2491 # verification.
2492 #
2493 # The serialized form is captured both to avoid ambiguity in how the
2494 # provenance is marshalled to json as well to prevent incompatibilities with
2495 # future changes.
2496 },
2497 "discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.
2498 "analysisStatus": "A String", # The status of discovery for the resource.
2499 "operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.
2500 # This field is deprecated, do not use.
2501 # network API call.
2502 "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
2503 # different programming environments, including REST APIs and RPC APIs. It is
2504 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
2505 # three pieces of data: error code, error message, and error details.
2506 #
2507 # You can find out more about this error model and how to work with it in the
2508 # [API Design Guide](https://cloud.google.com/apis/design/errors).
2509 "message": "A String", # A developer-facing error message, which should be in English. Any
2510 # user-facing error message should be localized and sent in the
2511 # google.rpc.Status.details field, or localized by the client.
2512 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
2513 "details": [ # A list of messages that carry the error details. There is a common set of
2514 # message types for APIs to use.
2515 {
2516 "a_key": "", # Properties of the object. Contains field @type with type URL.
2517 },
2518 ],
2519 },
2520 "done": True or False, # If the value is `false`, it means the operation is still in progress.
2521 # If `true`, the operation is completed, and either `error` or `response` is
2522 # available.
2523 "response": { # The normal response of the operation in case of success. If the original
2524 # method returns no data on success, such as `Delete`, the response is
2525 # `google.protobuf.Empty`. If the original method is standard
2526 # `Get`/`Create`/`Update`, the response should be the resource. For other
2527 # methods, the response should have the type `XxxResponse`, where `Xxx`
2528 # is the original method name. For example, if the original method name
2529 # is `TakeSnapshot()`, the inferred response type is
2530 # `TakeSnapshotResponse`.
2531 "a_key": "", # Properties of the object. Contains field @type with type URL.
2532 },
2533 "name": "A String", # The server-assigned name, which is only unique within the same service that
2534 # originally returns it. If you use the default HTTP mapping, the
2535 # `name` should be a resource name ending with `operations/{unique_id}`.
2536 "metadata": { # Service-specific metadata associated with the operation. It typically
2537 # contains progress information and common metadata such as create time.
2538 # Some services might not provide such metadata. Any method that returns a
2539 # long-running operation should document the metadata type, if any.
2540 "a_key": "", # Properties of the object. Contains field @type with type URL.
2541 },
2542 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2543 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
2544 "cpe": "A String", # The CPE of the resource being scanned.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2545 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
2546 # details to show to the user. The LocalizedMessage output only and
2547 # populated by the API.
2548 # different programming environments, including REST APIs and RPC APIs. It is
2549 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
2550 # three pieces of data: error code, error message, and error details.
2551 #
2552 # You can find out more about this error model and how to work with it in the
2553 # [API Design Guide](https://cloud.google.com/apis/design/errors).
2554 "message": "A String", # A developer-facing error message, which should be in English. Any
2555 # user-facing error message should be localized and sent in the
2556 # google.rpc.Status.details field, or localized by the client.
2557 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
2558 "details": [ # A list of messages that carry the error details. There is a common set of
2559 # message types for APIs to use.
2560 {
2561 "a_key": "", # Properties of the object. Contains field @type with type URL.
2562 },
2563 ],
2564 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2565 },
2566 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.
2567 # Attestation can be verified using the attached signature. If the verifier
2568 # trusts the public key of the signer, then verifying the signature is
2569 # sufficient to establish trust. In this circumstance, the
2570 # AttestationAuthority to which this Attestation is attached is primarily
2571 # useful for look-up (how to find this Attestation if you already know the
2572 # Authority and artifact to be verified) and intent (which authority was this
2573 # attestation intended to sign for).
2574 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.
2575 # This message only supports `ATTACHED` signatures, where the payload that is
2576 # signed is included alongside the signature itself in the same file.
2577 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
2578 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
2579 # 160-bit fingerprint, expressed as a 40 character hexadecimal string. See
2580 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
2581 # Implementations may choose to acknowledge "LONG", "SHORT", or other
2582 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
2583 # In gpg, the full fingerprint can be retrieved from the `fpr` field
2584 # returned when calling --list-keys with --with-colons. For example:
2585 # ```
2586 # gpg --with-colons --with-fingerprint --force-v4-certs \
2587 # --list-keys attester@example.com
2588 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2589 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2590 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
2591 # ```
2592 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
2593 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
2594 # The verifier must ensure that the provided type is one that the verifier
2595 # supports, and that the attestation payload is a valid instantiation of that
2596 # type (for example by validating a JSON schema).
2597 "signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or
2598 # equivalent. Since this message only supports attached signatures, the
2599 # payload that was signed must be attached. While the signature format
2600 # supported is dependent on the verification implementation, currently only
2601 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
2602 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
2603 # --output=signature.gpg payload.json` will create the signature content
2604 # expected in this field in `signature.gpg` for the `payload.json`
2605 # attestation payload.
2606 },
2607 },
2608 "noteName": "A String", # An analysis note associated with this image, in the form
2609 # "providers/{provider_id}/notes/{NOTE_ID}"
2610 # This field can be used as a filter in list requests.
2611 "deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.
2612 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the
2613 # deployable field with the same name.
2614 "A String",
2615 ],
2616 "userEmail": "A String", # Identity of the user that triggered this deployment.
2617 "address": "A String", # Address of the runtime element hosting this deployment.
2618 "platform": "A String", # Platform hosting this deployment.
2619 "deployTime": "A String", # Beginning of the lifetime of this deployment.
2620 "undeployTime": "A String", # End of the lifetime of this deployment.
2621 "config": "A String", # Configuration used to create this deployment.
2622 },
2623 "remediation": "A String", # A description of actions that can be taken to remedy the `Note`
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2624 "resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`
2625 # applies. For example, https://gcr.io/project/image@sha256:foo This field
2626 # can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2627 "createTime": "A String", # Output only. The time this `Occurrence` was created.
2628 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis
2629 # in the associated note.
2630 # DockerImage relationship. This image would be produced from a Dockerfile
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2631 # with FROM &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2632 "distance": 42, # Output only. The number of layers by which this image differs from the
2633 # associated image basis.
2634 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
2635 # occurrence.
2636 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
2637 # "distance" and is ordered with [distance] being the layer immediately
2638 # following the base image and [1] being the final layer.
2639 { # Layer holds metadata specific to a layer of a Docker image.
2640 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
2641 "directive": "A String", # The recovered Dockerfile directive used to construct this layer.
2642 },
2643 ],
2644 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.
2645 "v1Name": "A String", # The layer-id of the final layer in the Docker image's v1
2646 # representation.
2647 # This field can be used as a filter in list requests.
2648 "v2Blob": [ # The ordered list of v2 blobs that represent a given image.
2649 "A String",
2650 ],
2651 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
2652 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
2653 # Only the name of the final blob is kept.
2654 # This field can be used as a filter in list requests.
2655 },
2656 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2657 },
2658 ],
2659 }</pre>
2660</div>
2661
2662<div class="method">
2663 <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
2664 <pre>Retrieves the next page of results.
2665
2666Args:
2667 previous_request: The request for the previous page. (required)
2668 previous_response: The response from the request for the previous page. (required)
2669
2670Returns:
2671 A request object that you can call 'execute()' on to request the next
2672 page. Returns None if there are no more items in the collection.
2673 </pre>
2674</div>
2675
2676<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2677 <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2678 <pre>Updates an existing occurrence.
2679
2680Args:
2681 name: string, The name of the occurrence.
2682Should be of the form "projects/{project_id}/occurrences/{OCCURRENCE_ID}". (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2683 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2684 The object takes the form of:
2685
2686{ # `Occurrence` includes information about analysis occurrences for an image.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2687 "vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.
2688 # to fix it.
2689 "packageIssue": [ # The set of affected locations and their fixes (if available) within
2690 # the associated resource.
2691 { # This message wraps a location affected by a vulnerability and its
2692 # associated fix (if one is available).
2693 "severityName": "A String",
2694 "affectedLocation": { # The location of the vulnerability # The location of the vulnerability.
2695 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
2696 # format. Examples include distro or storage location for vulnerable jar.
2697 # This field can be used as a filter in list requests.
2698 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
2699 # filter in list requests.
2700 # For a discussion of this in Debian/Ubuntu:
2701 # http://serverfault.com/questions/604541/debian-packages-version-convention
2702 # For a discussion of this in Redhat/Fedora/Centos:
2703 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
2704 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2705 "name": "A String", # The main part of the version name.
2706 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
2707 # If kind is not NORMAL, then the other fields are ignored.
2708 "revision": "A String", # The iteration of the package build from the above version.
2709 },
2710 "package": "A String", # The package being described.
2711 },
2712 "fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.
2713 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
2714 # format. Examples include distro or storage location for vulnerable jar.
2715 # This field can be used as a filter in list requests.
2716 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
2717 # filter in list requests.
2718 # For a discussion of this in Debian/Ubuntu:
2719 # http://serverfault.com/questions/604541/debian-packages-version-convention
2720 # For a discussion of this in Redhat/Fedora/Centos:
2721 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
2722 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2723 "name": "A String", # The main part of the version name.
2724 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
2725 # If kind is not NORMAL, then the other fields are ignored.
2726 "revision": "A String", # The iteration of the package build from the above version.
2727 },
2728 "package": "A String", # The package being described.
2729 },
2730 },
2731 ],
2732 "type": "A String", # The type of package; whether native or non native(ruby gems,
2733 # node.js packages etc)
2734 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
2735 # scale of 0-10 where 0 indicates low severity and 10 indicates high
2736 # severity.
2737 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
2738 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is
2739 # available and note provider assigned severity when distro has not yet
2740 # assigned a severity for this vulnerability.
2741 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2742 "resource": { # #
2743 # The resource for which the `Occurrence` applies.
2744 # Resource is an entity that can have metadata. E.g., a Docker image.
2745 "contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.
2746 "type": "A String", # The type of hash that was performed.
2747 "value": "A String", # The hash value.
2748 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2749 "name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2750 "uri": "A String", # The unique URI of the resource. E.g.,
2751 # "https://gcr.io/project/image@sha256:foo" for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2752 },
2753 "updateTime": "A String", # Output only. The time this `Occurrence` was last updated.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2754 "upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.
2755 # specific upgrade. This presence is supplied via local sources (i.e. it is
2756 # present in the mirror and the running system has noticed its availability).
2757 "distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system
2758 # for the resource_url. This allows efficient filtering, as well as
2759 # making it easier to use the occurrence.
2760 # operating system (CPE). Some distributions have additional metadata around
2761 # updates, classifying them into various categories and severities.
2762 "cpeUri": "A String", # Required - The specific operating system this metadata applies to. See
2763 # https://cpe.mitre.org/specification/.
2764 "cve": [ # The cve that would be resolved by this upgrade.
2765 "A String",
2766 ],
2767 "severity": "A String", # The severity as specified by the upstream operating system.
2768 "classification": "A String", # The operating system classification of this Upgrade, as specified by the
2769 # upstream operating system upgrade feed.
2770 },
2771 "parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.
2772 # For a discussion of this in Debian/Ubuntu:
2773 # http://serverfault.com/questions/604541/debian-packages-version-convention
2774 # For a discussion of this in Redhat/Fedora/Centos:
2775 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
2776 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2777 "name": "A String", # The main part of the version name.
2778 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
2779 # If kind is not NORMAL, then the other fields are ignored.
2780 "revision": "A String", # The iteration of the package build from the above version.
2781 },
2782 "package": "A String", # Required - The package this Upgrade is for.
2783 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2784 "installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.
2785 # a system.
2786 "location": [ # All of the places within the filesystem versions of this package
2787 # have been found.
2788 { # An occurrence of a particular package installation found within a
2789 # system's filesystem.
2790 # e.g. glibc was found in /var/lib/dpkg/status
2791 "path": "A String", # The path from which we gathered that this package/version is installed.
2792 "cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)
2793 # denoting the package manager version distributing a package.
2794 "version": { # Version contains structured information about the version of the package. # The version installed at this location.
2795 # For a discussion of this in Debian/Ubuntu:
2796 # http://serverfault.com/questions/604541/debian-packages-version-convention
2797 # For a discussion of this in Redhat/Fedora/Centos:
2798 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2799 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2800 "name": "A String", # The main part of the version name.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2801 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
2802 # If kind is not NORMAL, then the other fields are ignored.
2803 "revision": "A String", # The iteration of the package build from the above version.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2804 },
2805 },
2806 ],
2807 "name": "A String", # Output only. The name of the installed package.
2808 },
2809 "name": "A String", # Output only. The name of the `Occurrence` in the form
2810 # "projects/{project_id}/occurrences/{OCCURRENCE_ID}"
2811 "kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are
2812 # specified. This field can be used as a filter in list requests.
2813 "buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.
2814 "provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance
2815 # details about the build from source to completion.
2816 "finishTime": "A String", # Time at which execution of the build was finished.
2817 "commands": [ # Commands requested by the build.
2818 { # Command describes a step performed as part of the build pipeline.
2819 "waitFor": [ # The ID(s) of the Command(s) that this Command depends on.
2820 "A String",
2821 ],
2822 "name": "A String", # Name of the command, as presented on the command line, or if the command is
2823 # packaged as a Docker container, as presented to `docker pull`.
2824 "args": [ # Command-line arguments used when executing this Command.
2825 "A String",
2826 ],
2827 "env": [ # Environment variables set before running this Command.
2828 "A String",
2829 ],
2830 "id": "A String", # Optional unique identifier for this Command, used in wait_for to reference
2831 # this Command as a dependency.
2832 "dir": "A String", # Working directory (relative to project source root) used when running
2833 # this Command.
2834 },
2835 ],
2836 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
2837 "artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this
2838 # location.
2839 # Google Cloud Storage.
2840 "generation": "A String", # Google Cloud Storage generation for the object.
2841 "object": "A String", # Google Cloud Storage object containing source.
2842 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
2843 # Requirements]
2844 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
2845 },
2846 "repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.
2847 # Repository.
2848 "projectId": "A String", # ID of the project that owns the repo.
2849 "branchName": "A String", # Name of the branch to build.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2850 "commitSha": "A String", # Explicit commit SHA to build.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2851 "tagName": "A String", # Name of the tag to build.
2852 "repoName": "A String", # Name of the repo.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2853 },
2854 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
2855 # source integrity was maintained in the build.
2856 #
2857 # The keys to this map are file paths used as build source and the values
2858 # contain the hash values for those files.
2859 #
2860 # If the build source came in a single package such as a gzipped tarfile
2861 # (.tar.gz), the FileHash will be for the single path to that file.
2862 "a_key": { # Container message for hashes of byte content of files, used in Source
2863 # messages to verify integrity of source input to the build.
2864 "fileHash": [ # Collection of file hashes.
2865 { # Container message for hash values.
2866 "type": "A String", # The type of hash that was performed.
2867 "value": "A String", # The hash value.
2868 },
2869 ],
2870 },
2871 },
2872 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
2873 # these locations, in the case where the source repository had multiple
2874 # remotes or submodules. This list will not include the context specified in
2875 # the context field.
2876 { # A SourceContext is a reference to a tree of files. A SourceContext together
2877 # with a path point to a unique revision of a single file or directory.
2878 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
2879 # repository (e.g., GitHub).
2880 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2881 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2882 },
2883 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
2884 # Source Repo.
2885 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2886 "kind": "A String", # The alias kind.
2887 "name": "A String", # The alias name.
2888 },
2889 "revisionId": "A String", # A revision ID.
2890 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2891 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2892 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
2893 # winged-cargo-31) and a repo name within that project.
2894 "projectId": "A String", # The ID of the project.
2895 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
2896 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2897 },
2898 },
2899 "labels": { # Labels with user defined metadata.
2900 "a_key": "A String",
2901 },
2902 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
2903 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2904 "kind": "A String", # The alias kind.
2905 "name": "A String", # The alias name.
2906 },
2907 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2908 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2909 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
2910 # "project/subproject" is a valid project name. The "repo name" is
2911 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2912 },
2913 },
2914 ],
2915 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
2916 # with a path point to a unique revision of a single file or directory.
2917 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
2918 # repository (e.g., GitHub).
2919 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2920 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2921 },
2922 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
2923 # Source Repo.
2924 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2925 "kind": "A String", # The alias kind.
2926 "name": "A String", # The alias name.
2927 },
2928 "revisionId": "A String", # A revision ID.
2929 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2930 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2931 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
2932 # winged-cargo-31) and a repo name within that project.
2933 "projectId": "A String", # The ID of the project.
2934 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
2935 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2936 },
2937 },
2938 "labels": { # Labels with user defined metadata.
2939 "a_key": "A String",
2940 },
2941 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
2942 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2943 "kind": "A String", # The alias kind.
2944 "name": "A String", # The alias name.
2945 },
2946 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2947 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2948 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
2949 # "project/subproject" is a valid project name. The "repo name" is
2950 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2951 },
2952 },
2953 "storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud
2954 # Storage.
2955 # Google Cloud Storage.
2956 "generation": "A String", # Google Cloud Storage generation for the object.
2957 "object": "A String", # Google Cloud Storage object containing source.
2958 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
2959 # Requirements]
2960 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
2961 },
2962 },
2963 "buildOptions": { # Special options applied to this build. This is a catch-all field where
2964 # build providers can enter any desired additional details.
2965 "a_key": "A String",
2966 },
2967 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
2968 # user's e-mail address at the time the build was initiated; this address may
2969 # not represent the same end-user for all time.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2970 "projectId": "A String", # ID of the project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2971 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
2972 "createTime": "A String", # Time at which the build was created.
2973 "builtArtifacts": [ # Output of the build.
2974 { # Artifact describes a build product.
2975 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
2976 # container.
2977 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
2978 # like gcr.io/projectID/imagename@sha256:123456
2979 "name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in
2980 # the case of a container build, the name used to push the container image to
2981 # Google Container Registry, as presented to `docker push`.
2982 #
2983 # This field is deprecated in favor of the plural `names` field; it continues
2984 # to exist here to allow existing BuildProvenance serialized to json in
2985 # google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to
2986 # deserialize back into proto.
2987 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
2988 # the case of a container build, the name used to push the container image to
2989 # Google Container Registry, as presented to `docker push`. Note that a
2990 # single Artifact ID can have multiple names, for example if two tags are
2991 # applied to one image.
2992 "A String",
2993 ],
2994 },
2995 ],
2996 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
2997 "startTime": "A String", # Time at which execution of the build was started.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2998 "logsBucket": "A String", # Google Cloud Storage bucket where logs were written.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2999 "id": "A String", # Unique identifier of the build.
3000 },
3001 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
3002 # `BuildSignature` in the corresponding Result. After verifying the
3003 # signature, `provenance_bytes` can be unmarshalled and compared to the
3004 # provenance to confirm that it is unchanged. A base64-encoded string
3005 # representation of the provenance bytes is used for the signature in order
3006 # to interoperate with openssl which expects this format for signature
3007 # verification.
3008 #
3009 # The serialized form is captured both to avoid ambiguity in how the
3010 # provenance is marshalled to json as well to prevent incompatibilities with
3011 # future changes.
3012 },
3013 "discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.
3014 "analysisStatus": "A String", # The status of discovery for the resource.
3015 "operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.
3016 # This field is deprecated, do not use.
3017 # network API call.
3018 "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
3019 # different programming environments, including REST APIs and RPC APIs. It is
3020 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
3021 # three pieces of data: error code, error message, and error details.
3022 #
3023 # You can find out more about this error model and how to work with it in the
3024 # [API Design Guide](https://cloud.google.com/apis/design/errors).
3025 "message": "A String", # A developer-facing error message, which should be in English. Any
3026 # user-facing error message should be localized and sent in the
3027 # google.rpc.Status.details field, or localized by the client.
3028 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
3029 "details": [ # A list of messages that carry the error details. There is a common set of
3030 # message types for APIs to use.
3031 {
3032 "a_key": "", # Properties of the object. Contains field @type with type URL.
3033 },
3034 ],
3035 },
3036 "done": True or False, # If the value is `false`, it means the operation is still in progress.
3037 # If `true`, the operation is completed, and either `error` or `response` is
3038 # available.
3039 "response": { # The normal response of the operation in case of success. If the original
3040 # method returns no data on success, such as `Delete`, the response is
3041 # `google.protobuf.Empty`. If the original method is standard
3042 # `Get`/`Create`/`Update`, the response should be the resource. For other
3043 # methods, the response should have the type `XxxResponse`, where `Xxx`
3044 # is the original method name. For example, if the original method name
3045 # is `TakeSnapshot()`, the inferred response type is
3046 # `TakeSnapshotResponse`.
3047 "a_key": "", # Properties of the object. Contains field @type with type URL.
3048 },
3049 "name": "A String", # The server-assigned name, which is only unique within the same service that
3050 # originally returns it. If you use the default HTTP mapping, the
3051 # `name` should be a resource name ending with `operations/{unique_id}`.
3052 "metadata": { # Service-specific metadata associated with the operation. It typically
3053 # contains progress information and common metadata such as create time.
3054 # Some services might not provide such metadata. Any method that returns a
3055 # long-running operation should document the metadata type, if any.
3056 "a_key": "", # Properties of the object. Contains field @type with type URL.
3057 },
3058 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3059 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
3060 "cpe": "A String", # The CPE of the resource being scanned.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3061 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
3062 # details to show to the user. The LocalizedMessage output only and
3063 # populated by the API.
3064 # different programming environments, including REST APIs and RPC APIs. It is
3065 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
3066 # three pieces of data: error code, error message, and error details.
3067 #
3068 # You can find out more about this error model and how to work with it in the
3069 # [API Design Guide](https://cloud.google.com/apis/design/errors).
3070 "message": "A String", # A developer-facing error message, which should be in English. Any
3071 # user-facing error message should be localized and sent in the
3072 # google.rpc.Status.details field, or localized by the client.
3073 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
3074 "details": [ # A list of messages that carry the error details. There is a common set of
3075 # message types for APIs to use.
3076 {
3077 "a_key": "", # Properties of the object. Contains field @type with type URL.
3078 },
3079 ],
3080 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3081 },
3082 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.
3083 # Attestation can be verified using the attached signature. If the verifier
3084 # trusts the public key of the signer, then verifying the signature is
3085 # sufficient to establish trust. In this circumstance, the
3086 # AttestationAuthority to which this Attestation is attached is primarily
3087 # useful for look-up (how to find this Attestation if you already know the
3088 # Authority and artifact to be verified) and intent (which authority was this
3089 # attestation intended to sign for).
3090 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.
3091 # This message only supports `ATTACHED` signatures, where the payload that is
3092 # signed is included alongside the signature itself in the same file.
3093 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
3094 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
3095 # 160-bit fingerprint, expressed as a 40 character hexadecimal string. See
3096 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
3097 # Implementations may choose to acknowledge "LONG", "SHORT", or other
3098 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
3099 # In gpg, the full fingerprint can be retrieved from the `fpr` field
3100 # returned when calling --list-keys with --with-colons. For example:
3101 # ```
3102 # gpg --with-colons --with-fingerprint --force-v4-certs \
3103 # --list-keys attester@example.com
3104 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3105 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3106 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
3107 # ```
3108 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
3109 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
3110 # The verifier must ensure that the provided type is one that the verifier
3111 # supports, and that the attestation payload is a valid instantiation of that
3112 # type (for example by validating a JSON schema).
3113 "signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or
3114 # equivalent. Since this message only supports attached signatures, the
3115 # payload that was signed must be attached. While the signature format
3116 # supported is dependent on the verification implementation, currently only
3117 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
3118 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
3119 # --output=signature.gpg payload.json` will create the signature content
3120 # expected in this field in `signature.gpg` for the `payload.json`
3121 # attestation payload.
3122 },
3123 },
3124 "noteName": "A String", # An analysis note associated with this image, in the form
3125 # "providers/{provider_id}/notes/{NOTE_ID}"
3126 # This field can be used as a filter in list requests.
3127 "deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.
3128 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the
3129 # deployable field with the same name.
3130 "A String",
3131 ],
3132 "userEmail": "A String", # Identity of the user that triggered this deployment.
3133 "address": "A String", # Address of the runtime element hosting this deployment.
3134 "platform": "A String", # Platform hosting this deployment.
3135 "deployTime": "A String", # Beginning of the lifetime of this deployment.
3136 "undeployTime": "A String", # End of the lifetime of this deployment.
3137 "config": "A String", # Configuration used to create this deployment.
3138 },
3139 "remediation": "A String", # A description of actions that can be taken to remedy the `Note`
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3140 "resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`
3141 # applies. For example, https://gcr.io/project/image@sha256:foo This field
3142 # can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3143 "createTime": "A String", # Output only. The time this `Occurrence` was created.
3144 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis
3145 # in the associated note.
3146 # DockerImage relationship. This image would be produced from a Dockerfile
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3147 # with FROM &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3148 "distance": 42, # Output only. The number of layers by which this image differs from the
3149 # associated image basis.
3150 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
3151 # occurrence.
3152 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
3153 # "distance" and is ordered with [distance] being the layer immediately
3154 # following the base image and [1] being the final layer.
3155 { # Layer holds metadata specific to a layer of a Docker image.
3156 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
3157 "directive": "A String", # The recovered Dockerfile directive used to construct this layer.
3158 },
3159 ],
3160 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.
3161 "v1Name": "A String", # The layer-id of the final layer in the Docker image's v1
3162 # representation.
3163 # This field can be used as a filter in list requests.
3164 "v2Blob": [ # The ordered list of v2 blobs that represent a given image.
3165 "A String",
3166 ],
3167 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
3168 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
3169 # Only the name of the final blob is kept.
3170 # This field can be used as a filter in list requests.
3171 },
3172 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3173}
3174
3175 updateMask: string, The fields to update.
3176 x__xgafv: string, V1 error format.
3177 Allowed values
3178 1 - v1 error format
3179 2 - v2 error format
3180
3181Returns:
3182 An object of the form:
3183
3184 { # `Occurrence` includes information about analysis occurrences for an image.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3185 "vulnerabilityDetails": { # Used by Occurrence to point to where the vulnerability exists and how # Details of a security vulnerability note.
3186 # to fix it.
3187 "packageIssue": [ # The set of affected locations and their fixes (if available) within
3188 # the associated resource.
3189 { # This message wraps a location affected by a vulnerability and its
3190 # associated fix (if one is available).
3191 "severityName": "A String",
3192 "affectedLocation": { # The location of the vulnerability # The location of the vulnerability.
3193 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
3194 # format. Examples include distro or storage location for vulnerable jar.
3195 # This field can be used as a filter in list requests.
3196 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
3197 # filter in list requests.
3198 # For a discussion of this in Debian/Ubuntu:
3199 # http://serverfault.com/questions/604541/debian-packages-version-convention
3200 # For a discussion of this in Redhat/Fedora/Centos:
3201 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
3202 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3203 "name": "A String", # The main part of the version name.
3204 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
3205 # If kind is not NORMAL, then the other fields are ignored.
3206 "revision": "A String", # The iteration of the package build from the above version.
3207 },
3208 "package": "A String", # The package being described.
3209 },
3210 "fixedLocation": { # The location of the vulnerability # The location of the available fix for vulnerability.
3211 "cpeUri": "A String", # The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
3212 # format. Examples include distro or storage location for vulnerable jar.
3213 # This field can be used as a filter in list requests.
3214 "version": { # Version contains structured information about the version of the package. # The version of the package being described. This field can be used as a
3215 # filter in list requests.
3216 # For a discussion of this in Debian/Ubuntu:
3217 # http://serverfault.com/questions/604541/debian-packages-version-convention
3218 # For a discussion of this in Redhat/Fedora/Centos:
3219 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
3220 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3221 "name": "A String", # The main part of the version name.
3222 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
3223 # If kind is not NORMAL, then the other fields are ignored.
3224 "revision": "A String", # The iteration of the package build from the above version.
3225 },
3226 "package": "A String", # The package being described.
3227 },
3228 },
3229 ],
3230 "type": "A String", # The type of package; whether native or non native(ruby gems,
3231 # node.js packages etc)
3232 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
3233 # scale of 0-10 where 0 indicates low severity and 10 indicates high
3234 # severity.
3235 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
3236 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when that is
3237 # available and note provider assigned severity when distro has not yet
3238 # assigned a severity for this vulnerability.
3239 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3240 "resource": { # #
3241 # The resource for which the `Occurrence` applies.
3242 # Resource is an entity that can have metadata. E.g., a Docker image.
3243 "contentHash": { # Container message for hash values. # The hash of the resource content. E.g., the Docker digest.
3244 "type": "A String", # The type of hash that was performed.
3245 "value": "A String", # The hash value.
3246 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3247 "name": "A String", # The name of the resource. E.g., the name of a Docker image - "Debian".
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3248 "uri": "A String", # The unique URI of the resource. E.g.,
3249 # "https://gcr.io/project/image@sha256:foo" for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3250 },
3251 "updateTime": "A String", # Output only. The time this `Occurrence` was last updated.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3252 "upgrade": { # An Upgrade Occurrence represents that a specific resource_url could install a # Describes an upgrade.
3253 # specific upgrade. This presence is supplied via local sources (i.e. it is
3254 # present in the mirror and the running system has noticed its availability).
3255 "distribution": { # The Upgrade Distribution represents metadata about the Upgrade for each # Metadata about the upgrade for available for the specific operating system
3256 # for the resource_url. This allows efficient filtering, as well as
3257 # making it easier to use the occurrence.
3258 # operating system (CPE). Some distributions have additional metadata around
3259 # updates, classifying them into various categories and severities.
3260 "cpeUri": "A String", # Required - The specific operating system this metadata applies to. See
3261 # https://cpe.mitre.org/specification/.
3262 "cve": [ # The cve that would be resolved by this upgrade.
3263 "A String",
3264 ],
3265 "severity": "A String", # The severity as specified by the upstream operating system.
3266 "classification": "A String", # The operating system classification of this Upgrade, as specified by the
3267 # upstream operating system upgrade feed.
3268 },
3269 "parsedVersion": { # Version contains structured information about the version of the package. # Required - The version of the package in a machine + human readable form.
3270 # For a discussion of this in Debian/Ubuntu:
3271 # http://serverfault.com/questions/604541/debian-packages-version-convention
3272 # For a discussion of this in Redhat/Fedora/Centos:
3273 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
3274 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3275 "name": "A String", # The main part of the version name.
3276 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
3277 # If kind is not NORMAL, then the other fields are ignored.
3278 "revision": "A String", # The iteration of the package build from the above version.
3279 },
3280 "package": "A String", # Required - The package this Upgrade is for.
3281 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3282 "installation": { # This represents how a particular software package may be installed on # Describes the installation of a package on the linked resource.
3283 # a system.
3284 "location": [ # All of the places within the filesystem versions of this package
3285 # have been found.
3286 { # An occurrence of a particular package installation found within a
3287 # system's filesystem.
3288 # e.g. glibc was found in /var/lib/dpkg/status
3289 "path": "A String", # The path from which we gathered that this package/version is installed.
3290 "cpeUri": "A String", # The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)
3291 # denoting the package manager version distributing a package.
3292 "version": { # Version contains structured information about the version of the package. # The version installed at this location.
3293 # For a discussion of this in Debian/Ubuntu:
3294 # http://serverfault.com/questions/604541/debian-packages-version-convention
3295 # For a discussion of this in Redhat/Fedora/Centos:
3296 # http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3297 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3298 "name": "A String", # The main part of the version name.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3299 "kind": "A String", # Distinguish between sentinel MIN/MAX versions and normal versions.
3300 # If kind is not NORMAL, then the other fields are ignored.
3301 "revision": "A String", # The iteration of the package build from the above version.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3302 },
3303 },
3304 ],
3305 "name": "A String", # Output only. The name of the installed package.
3306 },
3307 "name": "A String", # Output only. The name of the `Occurrence` in the form
3308 # "projects/{project_id}/occurrences/{OCCURRENCE_ID}"
3309 "kind": "A String", # Output only. This explicitly denotes which of the `Occurrence` details are
3310 # specified. This field can be used as a filter in list requests.
3311 "buildDetails": { # Message encapsulating build provenance details. # Build details for a verifiable build.
3312 "provenance": { # Provenance of a build. Contains all information needed to verify the full # The actual provenance
3313 # details about the build from source to completion.
3314 "finishTime": "A String", # Time at which execution of the build was finished.
3315 "commands": [ # Commands requested by the build.
3316 { # Command describes a step performed as part of the build pipeline.
3317 "waitFor": [ # The ID(s) of the Command(s) that this Command depends on.
3318 "A String",
3319 ],
3320 "name": "A String", # Name of the command, as presented on the command line, or if the command is
3321 # packaged as a Docker container, as presented to `docker pull`.
3322 "args": [ # Command-line arguments used when executing this Command.
3323 "A String",
3324 ],
3325 "env": [ # Environment variables set before running this Command.
3326 "A String",
3327 ],
3328 "id": "A String", # Optional unique identifier for this Command, used in wait_for to reference
3329 # this Command as a dependency.
3330 "dir": "A String", # Working directory (relative to project source root) used when running
3331 # this Command.
3332 },
3333 ],
3334 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
3335 "artifactStorageSource": { # StorageSource describes the location of the source in an archive file in # If provided, the input binary artifacts for the build came from this
3336 # location.
3337 # Google Cloud Storage.
3338 "generation": "A String", # Google Cloud Storage generation for the object.
3339 "object": "A String", # Google Cloud Storage object containing source.
3340 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
3341 # Requirements]
3342 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
3343 },
3344 "repoSource": { # RepoSource describes the location of the source in a Google Cloud Source # If provided, get source from this location in a Cloud Repo.
3345 # Repository.
3346 "projectId": "A String", # ID of the project that owns the repo.
3347 "branchName": "A String", # Name of the branch to build.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3348 "commitSha": "A String", # Explicit commit SHA to build.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3349 "tagName": "A String", # Name of the tag to build.
3350 "repoName": "A String", # Name of the repo.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3351 },
3352 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
3353 # source integrity was maintained in the build.
3354 #
3355 # The keys to this map are file paths used as build source and the values
3356 # contain the hash values for those files.
3357 #
3358 # If the build source came in a single package such as a gzipped tarfile
3359 # (.tar.gz), the FileHash will be for the single path to that file.
3360 "a_key": { # Container message for hashes of byte content of files, used in Source
3361 # messages to verify integrity of source input to the build.
3362 "fileHash": [ # Collection of file hashes.
3363 { # Container message for hash values.
3364 "type": "A String", # The type of hash that was performed.
3365 "value": "A String", # The hash value.
3366 },
3367 ],
3368 },
3369 },
3370 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
3371 # these locations, in the case where the source repository had multiple
3372 # remotes or submodules. This list will not include the context specified in
3373 # the context field.
3374 { # A SourceContext is a reference to a tree of files. A SourceContext together
3375 # with a path point to a unique revision of a single file or directory.
3376 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
3377 # repository (e.g., GitHub).
3378 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3379 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3380 },
3381 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
3382 # Source Repo.
3383 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
3384 "kind": "A String", # The alias kind.
3385 "name": "A String", # The alias name.
3386 },
3387 "revisionId": "A String", # A revision ID.
3388 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3389 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3390 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
3391 # winged-cargo-31) and a repo name within that project.
3392 "projectId": "A String", # The ID of the project.
3393 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
3394 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3395 },
3396 },
3397 "labels": { # Labels with user defined metadata.
3398 "a_key": "A String",
3399 },
3400 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
3401 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
3402 "kind": "A String", # The alias kind.
3403 "name": "A String", # The alias name.
3404 },
3405 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3406 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3407 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
3408 # "project/subproject" is a valid project name. The "repo name" is
3409 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3410 },
3411 },
3412 ],
3413 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
3414 # with a path point to a unique revision of a single file or directory.
3415 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
3416 # repository (e.g., GitHub).
3417 "url": "A String", # Git repository URL.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3418 "revisionId": "A String", # Required. Git commit hash.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3419 },
3420 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
3421 # Source Repo.
3422 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
3423 "kind": "A String", # The alias kind.
3424 "name": "A String", # The alias name.
3425 },
3426 "revisionId": "A String", # A revision ID.
3427 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3428 "uid": "A String", # A server-assigned, globally unique identifier.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3429 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
3430 # winged-cargo-31) and a repo name within that project.
3431 "projectId": "A String", # The ID of the project.
3432 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
3433 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3434 },
3435 },
3436 "labels": { # Labels with user defined metadata.
3437 "a_key": "A String",
3438 },
3439 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
3440 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
3441 "kind": "A String", # The alias kind.
3442 "name": "A String", # The alias name.
3443 },
3444 "revisionId": "A String", # A revision (commit) ID.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3445 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3446 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
3447 # "project/subproject" is a valid project name. The "repo name" is
3448 # the hostURI/project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3449 },
3450 },
3451 "storageSource": { # StorageSource describes the location of the source in an archive file in # If provided, get the source from this location in in Google Cloud
3452 # Storage.
3453 # Google Cloud Storage.
3454 "generation": "A String", # Google Cloud Storage generation for the object.
3455 "object": "A String", # Google Cloud Storage object containing source.
3456 "bucket": "A String", # Google Cloud Storage bucket containing source (see [Bucket Name
3457 # Requirements]
3458 # (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
3459 },
3460 },
3461 "buildOptions": { # Special options applied to this build. This is a catch-all field where
3462 # build providers can enter any desired additional details.
3463 "a_key": "A String",
3464 },
3465 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
3466 # user's e-mail address at the time the build was initiated; this address may
3467 # not represent the same end-user for all time.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3468 "projectId": "A String", # ID of the project.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3469 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
3470 "createTime": "A String", # Time at which the build was created.
3471 "builtArtifacts": [ # Output of the build.
3472 { # Artifact describes a build product.
3473 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
3474 # container.
3475 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
3476 # like gcr.io/projectID/imagename@sha256:123456
3477 "name": "A String", # Name of the artifact. This may be the path to a binary or jar file, or in
3478 # the case of a container build, the name used to push the container image to
3479 # Google Container Registry, as presented to `docker push`.
3480 #
3481 # This field is deprecated in favor of the plural `names` field; it continues
3482 # to exist here to allow existing BuildProvenance serialized to json in
3483 # google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to
3484 # deserialize back into proto.
3485 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
3486 # the case of a container build, the name used to push the container image to
3487 # Google Container Registry, as presented to `docker push`. Note that a
3488 # single Artifact ID can have multiple names, for example if two tags are
3489 # applied to one image.
3490 "A String",
3491 ],
3492 },
3493 ],
3494 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
3495 "startTime": "A String", # Time at which execution of the build was started.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3496 "logsBucket": "A String", # Google Cloud Storage bucket where logs were written.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3497 "id": "A String", # Unique identifier of the build.
3498 },
3499 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
3500 # `BuildSignature` in the corresponding Result. After verifying the
3501 # signature, `provenance_bytes` can be unmarshalled and compared to the
3502 # provenance to confirm that it is unchanged. A base64-encoded string
3503 # representation of the provenance bytes is used for the signature in order
3504 # to interoperate with openssl which expects this format for signature
3505 # verification.
3506 #
3507 # The serialized form is captured both to avoid ambiguity in how the
3508 # provenance is marshalled to json as well to prevent incompatibilities with
3509 # future changes.
3510 },
3511 "discovered": { # Provides information about the scan status of a discovered resource. # Describes the initial scan status for this resource.
3512 "analysisStatus": "A String", # The status of discovery for the resource.
3513 "operation": { # This resource represents a long-running operation that is the result of a # Output only. An operation that indicates the status of the current scan.
3514 # This field is deprecated, do not use.
3515 # network API call.
3516 "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
3517 # different programming environments, including REST APIs and RPC APIs. It is
3518 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
3519 # three pieces of data: error code, error message, and error details.
3520 #
3521 # You can find out more about this error model and how to work with it in the
3522 # [API Design Guide](https://cloud.google.com/apis/design/errors).
3523 "message": "A String", # A developer-facing error message, which should be in English. Any
3524 # user-facing error message should be localized and sent in the
3525 # google.rpc.Status.details field, or localized by the client.
3526 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
3527 "details": [ # A list of messages that carry the error details. There is a common set of
3528 # message types for APIs to use.
3529 {
3530 "a_key": "", # Properties of the object. Contains field @type with type URL.
3531 },
3532 ],
3533 },
3534 "done": True or False, # If the value is `false`, it means the operation is still in progress.
3535 # If `true`, the operation is completed, and either `error` or `response` is
3536 # available.
3537 "response": { # The normal response of the operation in case of success. If the original
3538 # method returns no data on success, such as `Delete`, the response is
3539 # `google.protobuf.Empty`. If the original method is standard
3540 # `Get`/`Create`/`Update`, the response should be the resource. For other
3541 # methods, the response should have the type `XxxResponse`, where `Xxx`
3542 # is the original method name. For example, if the original method name
3543 # is `TakeSnapshot()`, the inferred response type is
3544 # `TakeSnapshotResponse`.
3545 "a_key": "", # Properties of the object. Contains field @type with type URL.
3546 },
3547 "name": "A String", # The server-assigned name, which is only unique within the same service that
3548 # originally returns it. If you use the default HTTP mapping, the
3549 # `name` should be a resource name ending with `operations/{unique_id}`.
3550 "metadata": { # Service-specific metadata associated with the operation. It typically
3551 # contains progress information and common metadata such as create time.
3552 # Some services might not provide such metadata. Any method that returns a
3553 # long-running operation should document the metadata type, if any.
3554 "a_key": "", # Properties of the object. Contains field @type with type URL.
3555 },
3556 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3557 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
3558 "cpe": "A String", # The CPE of the resource being scanned.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3559 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
3560 # details to show to the user. The LocalizedMessage output only and
3561 # populated by the API.
3562 # different programming environments, including REST APIs and RPC APIs. It is
3563 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
3564 # three pieces of data: error code, error message, and error details.
3565 #
3566 # You can find out more about this error model and how to work with it in the
3567 # [API Design Guide](https://cloud.google.com/apis/design/errors).
3568 "message": "A String", # A developer-facing error message, which should be in English. Any
3569 # user-facing error message should be localized and sent in the
3570 # google.rpc.Status.details field, or localized by the client.
3571 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
3572 "details": [ # A list of messages that carry the error details. There is a common set of
3573 # message types for APIs to use.
3574 {
3575 "a_key": "", # Properties of the object. Contains field @type with type URL.
3576 },
3577 ],
3578 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3579 },
3580 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Describes an attestation of an artifact.
3581 # Attestation can be verified using the attached signature. If the verifier
3582 # trusts the public key of the signer, then verifying the signature is
3583 # sufficient to establish trust. In this circumstance, the
3584 # AttestationAuthority to which this Attestation is attached is primarily
3585 # useful for look-up (how to find this Attestation if you already know the
3586 # Authority and artifact to be verified) and intent (which authority was this
3587 # attestation intended to sign for).
3588 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature.
3589 # This message only supports `ATTACHED` signatures, where the payload that is
3590 # signed is included alongside the signature itself in the same file.
3591 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
3592 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
3593 # 160-bit fingerprint, expressed as a 40 character hexadecimal string. See
3594 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
3595 # Implementations may choose to acknowledge "LONG", "SHORT", or other
3596 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
3597 # In gpg, the full fingerprint can be retrieved from the `fpr` field
3598 # returned when calling --list-keys with --with-colons. For example:
3599 # ```
3600 # gpg --with-colons --with-fingerprint --force-v4-certs \
3601 # --list-keys attester@example.com
3602 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3603 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3604 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
3605 # ```
3606 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
3607 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
3608 # The verifier must ensure that the provided type is one that the verifier
3609 # supports, and that the attestation payload is a valid instantiation of that
3610 # type (for example by validating a JSON schema).
3611 "signature": "A String", # The raw content of the signature, as output by GNU Privacy Guard (GPG) or
3612 # equivalent. Since this message only supports attached signatures, the
3613 # payload that was signed must be attached. While the signature format
3614 # supported is dependent on the verification implementation, currently only
3615 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
3616 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
3617 # --output=signature.gpg payload.json` will create the signature content
3618 # expected in this field in `signature.gpg` for the `payload.json`
3619 # attestation payload.
3620 },
3621 },
3622 "noteName": "A String", # An analysis note associated with this image, in the form
3623 # "providers/{provider_id}/notes/{NOTE_ID}"
3624 # This field can be used as a filter in list requests.
3625 "deployment": { # The period during which some deployable was active in a runtime. # Describes the deployment of an artifact on a runtime.
3626 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from the
3627 # deployable field with the same name.
3628 "A String",
3629 ],
3630 "userEmail": "A String", # Identity of the user that triggered this deployment.
3631 "address": "A String", # Address of the runtime element hosting this deployment.
3632 "platform": "A String", # Platform hosting this deployment.
3633 "deployTime": "A String", # Beginning of the lifetime of this deployment.
3634 "undeployTime": "A String", # End of the lifetime of this deployment.
3635 "config": "A String", # Configuration used to create this deployment.
3636 },
3637 "remediation": "A String", # A description of actions that can be taken to remedy the `Note`
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3638 "resourceUrl": "A String", # The unique URL of the image or the container for which the `Occurrence`
3639 # applies. For example, https://gcr.io/project/image@sha256:foo This field
3640 # can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3641 "createTime": "A String", # Output only. The time this `Occurrence` was created.
3642 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the # Describes how this resource derives from the basis
3643 # in the associated note.
3644 # DockerImage relationship. This image would be produced from a Dockerfile
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3645 # with FROM &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3646 "distance": 42, # Output only. The number of layers by which this image differs from the
3647 # associated image basis.
3648 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
3649 # occurrence.
3650 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
3651 # "distance" and is ordered with [distance] being the layer immediately
3652 # following the base image and [1] being the final layer.
3653 { # Layer holds metadata specific to a layer of a Docker image.
3654 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
3655 "directive": "A String", # The recovered Dockerfile directive used to construct this layer.
3656 },
3657 ],
3658 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # The fingerprint of the derived image.
3659 "v1Name": "A String", # The layer-id of the final layer in the Docker image's v1
3660 # representation.
3661 # This field can be used as a filter in list requests.
3662 "v2Blob": [ # The ordered list of v2 blobs that represent a given image.
3663 "A String",
3664 ],
3665 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
3666 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
3667 # Only the name of the final blob is kept.
3668 # This field can be used as a filter in list requests.
3669 },
3670 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3671 }</pre>
3672</div>
3673
3674<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3675 <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3676 <pre>Sets the access control policy on the specified `Note` or `Occurrence`.
3677Requires `containeranalysis.notes.setIamPolicy` or
3678`containeranalysis.occurrences.setIamPolicy` permission if the resource is
3679a `Note` or an `Occurrence`, respectively.
3680Attempting to call this method without these permissions will result in a `
3681`PERMISSION_DENIED` error.
3682Attempting to call this method on a non-existent resource will result in a
3683`NOT_FOUND` error if the user has `containeranalysis.notes.list` permission
3684on a `Note` or `containeranalysis.occurrences.list` on an `Occurrence`, or
3685a `PERMISSION_DENIED` error otherwise. The resource takes the following
3686formats: `projects/{projectid}/occurrences/{occurrenceid}` for occurrences
3687and projects/{projectid}/notes/{noteid} for notes
3688
3689Args:
3690 resource: string, REQUIRED: The resource for which the policy is being specified.
3691See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3692 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3693 The object takes the form of:
3694
3695{ # Request message for `SetIamPolicy` method.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3696 "policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3697 # the policy is limited to a few 10s of KB. An empty policy is a
3698 # valid policy but certain Cloud Platform services (such as Projects)
3699 # might reject them.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3700 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3701 #
3702 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3703 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
3704 # `members` to a single `role`. Members can be user accounts, service accounts,
3705 # Google groups, and domains (such as G Suite). A `role` is a named list of
3706 # permissions; each `role` can be an IAM predefined role or a user-created
3707 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3708 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3709 # Optionally, a `binding` can specify a `condition`, which is a logical
3710 # expression that allows access to a resource only if the expression evaluates
3711 # to `true`. A condition can add constraints based on attributes of the
3712 # request, the resource, or both.
3713 #
3714 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3715 #
3716 # {
3717 # "bindings": [
3718 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3719 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3720 # "members": [
3721 # "user:mike@example.com",
3722 # "group:admins@example.com",
3723 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3724 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3725 # ]
3726 # },
3727 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3728 # "role": "roles/resourcemanager.organizationViewer",
3729 # "members": ["user:eve@example.com"],
3730 # "condition": {
3731 # "title": "expirable access",
3732 # "description": "Does not grant access after Sep 2020",
3733 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
3734 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3735 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3736 # ],
3737 # "etag": "BwWWja0YfJA=",
3738 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3739 # }
3740 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3741 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3742 #
3743 # bindings:
3744 # - members:
3745 # - user:mike@example.com
3746 # - group:admins@example.com
3747 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3748 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
3749 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3750 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3751 # - user:eve@example.com
3752 # role: roles/resourcemanager.organizationViewer
3753 # condition:
3754 # title: expirable access
3755 # description: Does not grant access after Sep 2020
3756 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
3757 # - etag: BwWWja0YfJA=
3758 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3759 #
3760 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3761 # [IAM documentation](https://cloud.google.com/iam/docs/).
3762 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
3763 # `condition` that determines how and when the `bindings` are applied. Each
3764 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3765 { # Associates `members` with a `role`.
3766 "role": "A String", # Role that is assigned to `members`.
3767 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
3768 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
3769 # `members` can have the following values:
3770 #
3771 # * `allUsers`: A special identifier that represents anyone who is
3772 # on the internet; with or without a Google account.
3773 #
3774 # * `allAuthenticatedUsers`: A special identifier that represents anyone
3775 # who is authenticated with a Google account or a service account.
3776 #
3777 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3778 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3779 #
3780 #
3781 # * `serviceAccount:{emailid}`: An email address that represents a service
3782 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
3783 #
3784 # * `group:{emailid}`: An email address that represents a Google group.
3785 # For example, `admins@example.com`.
3786 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3787 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
3788 # identifier) representing a user that has been recently deleted. For
3789 # example, `alice@example.com?uid=123456789012345678901`. If the user is
3790 # recovered, this value reverts to `user:{emailid}` and the recovered user
3791 # retains the role in the binding.
3792 #
3793 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
3794 # unique identifier) representing a service account that has been recently
3795 # deleted. For example,
3796 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
3797 # If the service account is undeleted, this value reverts to
3798 # `serviceAccount:{emailid}` and the undeleted service account retains the
3799 # role in the binding.
3800 #
3801 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
3802 # identifier) representing a Google group that has been recently
3803 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
3804 # the group is recovered, this value reverts to `group:{emailid}` and the
3805 # recovered group retains the role in the binding.
3806 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3807 #
3808 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
3809 # users of that domain. For example, `google.com` or `example.com`.
3810 #
3811 "A String",
3812 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3813 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3814 # NOTE: An unsatisfied condition will not allow user access via current
3815 # binding. Different bindings, including their conditions, are examined
3816 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3817 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
3818 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3819 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3820 # Example (Comparison):
3821 #
3822 # title: "Summary size limit"
3823 # description: "Determines if a summary is less than 100 chars"
3824 # expression: "document.summary.size() &lt; 100"
3825 #
3826 # Example (Equality):
3827 #
3828 # title: "Requestor is owner"
3829 # description: "Determines if requestor is the document owner"
3830 # expression: "document.owner == request.auth.claims.email"
3831 #
3832 # Example (Logic):
3833 #
3834 # title: "Public documents"
3835 # description: "Determine whether the document should be publicly visible"
3836 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
3837 #
3838 # Example (Data Manipulation):
3839 #
3840 # title: "Notification string"
3841 # description: "Create a notification string with a timestamp."
3842 # expression: "'New message received at ' + string(document.create_time)"
3843 #
3844 # The exact variables and functions that may be referenced within an expression
3845 # are determined by the service that evaluates it. See the service
3846 # documentation for additional information.
3847 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3848 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3849 "expression": "A String", # Textual representation of an expression in Common Expression Language
3850 # syntax.
3851 "location": "A String", # Optional. String indicating the location of the expression for error
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3852 # reporting, e.g. a file name and a position in the file.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3853 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3854 # its purpose. This can be used e.g. in UIs which allow to enter the
3855 # expression.
3856 },
3857 },
3858 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3859 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
3860 # prevent simultaneous updates of a policy from overwriting each other.
3861 # It is strongly suggested that systems make use of the `etag` in the
3862 # read-modify-write cycle to perform policy updates in order to avoid race
3863 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
3864 # systems are expected to put that etag in the request to `setIamPolicy` to
3865 # ensure that their change will be applied to the same version of the policy.
3866 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3867 # **Important:** If you use IAM Conditions, you must include the `etag` field
3868 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
3869 # you to overwrite a version `3` policy with a version `1` policy, and all of
3870 # the conditions in the version `3` policy are lost.
3871 "version": 42, # Specifies the format of the policy.
3872 #
3873 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
3874 # are rejected.
3875 #
3876 # Any operation that affects conditional role bindings must specify version
3877 # `3`. This requirement applies to the following operations:
3878 #
3879 # * Getting a policy that includes a conditional role binding
3880 # * Adding a conditional role binding to a policy
3881 # * Changing a conditional role binding in a policy
3882 # * Removing any role binding, with or without a condition, from a policy
3883 # that includes conditions
3884 #
3885 # **Important:** If you use IAM Conditions, you must include the `etag` field
3886 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
3887 # you to overwrite a version `3` policy with a version `1` policy, and all of
3888 # the conditions in the version `3` policy are lost.
3889 #
3890 # If a policy does not include any conditions, operations on that policy may
3891 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3892 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3893 }
3894
3895 x__xgafv: string, V1 error format.
3896 Allowed values
3897 1 - v1 error format
3898 2 - v2 error format
3899
3900Returns:
3901 An object of the form:
3902
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3903 { # An Identity and Access Management (IAM) policy, which specifies access
3904 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3905 #
3906 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3907 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
3908 # `members` to a single `role`. Members can be user accounts, service accounts,
3909 # Google groups, and domains (such as G Suite). A `role` is a named list of
3910 # permissions; each `role` can be an IAM predefined role or a user-created
3911 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3912 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3913 # Optionally, a `binding` can specify a `condition`, which is a logical
3914 # expression that allows access to a resource only if the expression evaluates
3915 # to `true`. A condition can add constraints based on attributes of the
3916 # request, the resource, or both.
3917 #
3918 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3919 #
3920 # {
3921 # "bindings": [
3922 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3923 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3924 # "members": [
3925 # "user:mike@example.com",
3926 # "group:admins@example.com",
3927 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3928 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3929 # ]
3930 # },
3931 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3932 # "role": "roles/resourcemanager.organizationViewer",
3933 # "members": ["user:eve@example.com"],
3934 # "condition": {
3935 # "title": "expirable access",
3936 # "description": "Does not grant access after Sep 2020",
3937 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
3938 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3939 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3940 # ],
3941 # "etag": "BwWWja0YfJA=",
3942 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3943 # }
3944 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3945 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3946 #
3947 # bindings:
3948 # - members:
3949 # - user:mike@example.com
3950 # - group:admins@example.com
3951 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3952 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
3953 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3954 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3955 # - user:eve@example.com
3956 # role: roles/resourcemanager.organizationViewer
3957 # condition:
3958 # title: expirable access
3959 # description: Does not grant access after Sep 2020
3960 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
3961 # - etag: BwWWja0YfJA=
3962 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3963 #
3964 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3965 # [IAM documentation](https://cloud.google.com/iam/docs/).
3966 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
3967 # `condition` that determines how and when the `bindings` are applied. Each
3968 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3969 { # Associates `members` with a `role`.
3970 "role": "A String", # Role that is assigned to `members`.
3971 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
3972 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
3973 # `members` can have the following values:
3974 #
3975 # * `allUsers`: A special identifier that represents anyone who is
3976 # on the internet; with or without a Google account.
3977 #
3978 # * `allAuthenticatedUsers`: A special identifier that represents anyone
3979 # who is authenticated with a Google account or a service account.
3980 #
3981 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3982 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3983 #
3984 #
3985 # * `serviceAccount:{emailid}`: An email address that represents a service
3986 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
3987 #
3988 # * `group:{emailid}`: An email address that represents a Google group.
3989 # For example, `admins@example.com`.
3990 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3991 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
3992 # identifier) representing a user that has been recently deleted. For
3993 # example, `alice@example.com?uid=123456789012345678901`. If the user is
3994 # recovered, this value reverts to `user:{emailid}` and the recovered user
3995 # retains the role in the binding.
3996 #
3997 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
3998 # unique identifier) representing a service account that has been recently
3999 # deleted. For example,
4000 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
4001 # If the service account is undeleted, this value reverts to
4002 # `serviceAccount:{emailid}` and the undeleted service account retains the
4003 # role in the binding.
4004 #
4005 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
4006 # identifier) representing a Google group that has been recently
4007 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
4008 # the group is recovered, this value reverts to `group:{emailid}` and the
4009 # recovered group retains the role in the binding.
4010 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4011 #
4012 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
4013 # users of that domain. For example, `google.com` or `example.com`.
4014 #
4015 "A String",
4016 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4017 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4018 # NOTE: An unsatisfied condition will not allow user access via current
4019 # binding. Different bindings, including their conditions, are examined
4020 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4021 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
4022 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4023 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4024 # Example (Comparison):
4025 #
4026 # title: "Summary size limit"
4027 # description: "Determines if a summary is less than 100 chars"
4028 # expression: "document.summary.size() &lt; 100"
4029 #
4030 # Example (Equality):
4031 #
4032 # title: "Requestor is owner"
4033 # description: "Determines if requestor is the document owner"
4034 # expression: "document.owner == request.auth.claims.email"
4035 #
4036 # Example (Logic):
4037 #
4038 # title: "Public documents"
4039 # description: "Determine whether the document should be publicly visible"
4040 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
4041 #
4042 # Example (Data Manipulation):
4043 #
4044 # title: "Notification string"
4045 # description: "Create a notification string with a timestamp."
4046 # expression: "'New message received at ' + string(document.create_time)"
4047 #
4048 # The exact variables and functions that may be referenced within an expression
4049 # are determined by the service that evaluates it. See the service
4050 # documentation for additional information.
4051 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4052 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4053 "expression": "A String", # Textual representation of an expression in Common Expression Language
4054 # syntax.
4055 "location": "A String", # Optional. String indicating the location of the expression for error
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4056 # reporting, e.g. a file name and a position in the file.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4057 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4058 # its purpose. This can be used e.g. in UIs which allow to enter the
4059 # expression.
4060 },
4061 },
4062 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4063 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
4064 # prevent simultaneous updates of a policy from overwriting each other.
4065 # It is strongly suggested that systems make use of the `etag` in the
4066 # read-modify-write cycle to perform policy updates in order to avoid race
4067 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
4068 # systems are expected to put that etag in the request to `setIamPolicy` to
4069 # ensure that their change will be applied to the same version of the policy.
4070 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4071 # **Important:** If you use IAM Conditions, you must include the `etag` field
4072 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
4073 # you to overwrite a version `3` policy with a version `1` policy, and all of
4074 # the conditions in the version `3` policy are lost.
4075 "version": 42, # Specifies the format of the policy.
4076 #
4077 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
4078 # are rejected.
4079 #
4080 # Any operation that affects conditional role bindings must specify version
4081 # `3`. This requirement applies to the following operations:
4082 #
4083 # * Getting a policy that includes a conditional role binding
4084 # * Adding a conditional role binding to a policy
4085 # * Changing a conditional role binding in a policy
4086 # * Removing any role binding, with or without a condition, from a policy
4087 # that includes conditions
4088 #
4089 # **Important:** If you use IAM Conditions, you must include the `etag` field
4090 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
4091 # you to overwrite a version `3` policy with a version `1` policy, and all of
4092 # the conditions in the version `3` policy are lost.
4093 #
4094 # If a policy does not include any conditions, operations on that policy may
4095 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4096 }</pre>
4097</div>
4098
4099<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4100 <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4101 <pre>Returns the permissions that a caller has on the specified note or
4102occurrence resource. Requires list permission on the project (for example,
4103"storage.objects.list" on the containing bucket for testing permission of
4104an object). Attempting to call this method on a non-existent resource will
4105result in a `NOT_FOUND` error if the user has list permission on the
4106project, or a `PERMISSION_DENIED` error otherwise. The resource takes the
4107following formats: `projects/{PROJECT_ID}/occurrences/{OCCURRENCE_ID}` for
4108`Occurrences` and `projects/{PROJECT_ID}/notes/{NOTE_ID}` for `Notes`
4109
4110Args:
4111 resource: string, REQUIRED: The resource for which the policy detail is being requested.
4112See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4113 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4114 The object takes the form of:
4115
4116{ # Request message for `TestIamPermissions` method.
4117 "permissions": [ # The set of permissions to check for the `resource`. Permissions with
4118 # wildcards (such as '*' or 'storage.*') are not allowed. For more
4119 # information see
4120 # [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
4121 "A String",
4122 ],
4123 }
4124
4125 x__xgafv: string, V1 error format.
4126 Allowed values
4127 1 - v1 error format
4128 2 - v2 error format
4129
4130Returns:
4131 An object of the form:
4132
4133 { # Response message for `TestIamPermissions` method.
4134 "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is
4135 # allowed.
4136 "A String",
4137 ],
4138 }</pre>
4139</div>
4140
4141</body></html>