Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / google-api-python-client / dd49464a6262c0d1f71efcf11f131e2f591fe5f6 / . / docs / dyn / containeranalysis_v1beta1.projects.occurrences.html
blob: 8d4ff5958a82351a24c8c286ae7d34e610c79221 [file] [log] [blame]
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
75<h1><a href="containeranalysis_v1beta1.html">Container Analysis API</a> . <a href="containeranalysis_v1beta1.projects.html">projects</a> . <a href="containeranalysis_v1beta1.projects.occurrences.html">occurrences</a></h1>
76<h2>Instance Methods</h2>
77<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]78 <code><a href="#batchCreate">batchCreate(parent, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]79<p class="firstline">Creates new occurrences in batch.</p>
80<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]81 <code><a href="#create">create(parent, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]82<p class="firstline">Creates a new occurrence.</p>
83<p class="toc_element">
84 <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
85<p class="firstline">Deletes the specified occurrence. For example, use this method to delete an</p>
86<p class="toc_element">
87 <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
88<p class="firstline">Gets the specified occurrence.</p>
89<p class="toc_element">
90 <code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
91<p class="firstline">Gets the access control policy for a note or an occurrence resource.</p>
92<p class="toc_element">
93 <code><a href="#getNotes">getNotes(name, x__xgafv=None)</a></code></p>
94<p class="firstline">Gets the note attached to the specified occurrence. Consumer projects can</p>
95<p class="toc_element">
96 <code><a href="#getVulnerabilitySummary">getVulnerabilitySummary(parent, x__xgafv=None, filter=None)</a></code></p>
97<p class="firstline">Gets a summary of the number and severity of occurrences.</p>
98<p class="toc_element">
99 <code><a href="#list">list(parent, pageSize=None, pageToken=None, x__xgafv=None, filter=None)</a></code></p>
100<p class="firstline">Lists occurrences for the specified project.</p>
101<p class="toc_element">
102 <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
103<p class="firstline">Retrieves the next page of results.</p>
104<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]105 <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]106<p class="firstline">Updates the specified occurrence.</p>
107<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]108 <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]109<p class="firstline">Sets the access control policy on the specified note or occurrence.</p>
110<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]111 <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]112<p class="firstline">Returns the permissions that a caller has on the specified note or</p>
113<h3>Method Details</h3>
114<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]115 <code class="details" id="batchCreate">batchCreate(parent, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]116 <pre>Creates new occurrences in batch.
117
118Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]119 parent: string, Required. The name of the project in the form of `projects/[PROJECT_ID]`, under which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]120the occurrences are to be created. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]121 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]122 The object takes the form of:
123
124{ # Request to create occurrences in batch.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]125 "occurrences": [ # Required. The occurrences to create. Max allowed length is 1000.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]126 { # An instance of an analysis type that has been found on a resource.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]127 "updateTime": "A String", # Output only. The time this occurrence was last updated.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]128 "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
129 "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
130 #
131 # The hash of the resource content. For example, the Docker digest.
132 "type": "A String", # Required. The type of hash that was performed.
133 "value": "A String", # Required. The hash value.
134 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]135 "name": "A String", # Deprecated, do not use. Use uri instead.
136 #
137 # The name of the resource. For example, the name of a Docker image -
138 # "Debian".
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]139 "uri": "A String", # Required. The unique URI of the resource. For example,
140 # `https://gcr.io/project/image@sha256:foo` for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]141 },
142 "name": "A String", # Output only. The name of the occurrence in the form of
143 # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
144 "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
145 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
146 # scale of 0-10 where 0 indicates low severity and 10 indicates high
147 # severity.
148 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
149 "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
150 # packages etc)
151 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
152 # available, and note provider assigned severity when distro has not yet
153 # assigned a severity for this vulnerability.
154 "relatedUrls": [ # Output only. URLs related to this vulnerability.
155 { # Metadata for any related URL information.
156 "url": "A String", # Specific URL associated with the resource.
157 "label": "A String", # Label to describe usage of the URL.
158 },
159 ],
160 "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
161 # within the associated resource.
162 { # This message wraps a location affected by a vulnerability and its
163 # associated fix (if one is available).
164 "severityName": "A String", # Deprecated, use Details.effective_severity instead
165 # The severity (e.g., distro assigned severity) for this vulnerability.
166 "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
167 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
168 # format. Examples include distro or storage location for vulnerable jar.
169 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
170 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
171 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
172 # versions.
173 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
174 # name.
175 "revision": "A String", # The iteration of the package build from the above version.
176 },
177 "package": "A String", # Required. The package being described.
178 },
179 "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
180 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
181 # format. Examples include distro or storage location for vulnerable jar.
182 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
183 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
184 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
185 # versions.
186 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
187 # name.
188 "revision": "A String", # The iteration of the package build from the above version.
189 },
190 "package": "A String", # Required. The package being described.
191 },
192 },
193 ],
194 "longDescription": "A String", # Output only. A detailed description of this vulnerability.
195 "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
196 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]197 "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
198 # specified. This field can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]199 "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
200 "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
201 "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
202 # Deprecated, do not use.
203 "analysisStatus": "A String", # The status of discovery for the resource.
204 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
205 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
206 # details to show to the user. The LocalizedMessage is output only and
207 # populated by the API.
208 # different programming environments, including REST APIs and RPC APIs. It is
209 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
210 # three pieces of data: error code, error message, and error details.
211 #
212 # You can find out more about this error model and how to work with it in the
213 # [API Design Guide](https://cloud.google.com/apis/design/errors).
214 "message": "A String", # A developer-facing error message, which should be in English. Any
215 # user-facing error message should be localized and sent in the
216 # google.rpc.Status.details field, or localized by the client.
217 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
218 "details": [ # A list of messages that carry the error details. There is a common set of
219 # message types for APIs to use.
220 {
221 "a_key": "", # Properties of the object. Contains field @type with type URL.
222 },
223 ],
224 },
225 },
226 },
227 "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
228 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
229 # attestation can be verified using the attached signature. If the verifier
230 # trusts the public key of the signer, then verifying the signature is
231 # sufficient to establish trust. In this circumstance, the authority to which
232 # this attestation is attached is primarily useful for look-up (how to find
233 # this attestation if you already know the authority and artifact to be
234 # verified) and intent (which authority was this attestation intended to sign
235 # for).
236 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
237 # supports `ATTACHED` signatures, where the payload that is signed is included
238 # alongside the signature itself in the same file.
239 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
240 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
241 # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
242 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
243 # Implementations may choose to acknowledge "LONG", "SHORT", or other
244 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
245 # In gpg, the full fingerprint can be retrieved from the `fpr` field
246 # returned when calling --list-keys with --with-colons. For example:
247 # ```
248 # gpg --with-colons --with-fingerprint --force-v4-certs \
249 # --list-keys attester@example.com
250 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]251 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]252 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
253 # ```
254 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
255 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
256 # The verifier must ensure that the provided type is one that the verifier
257 # supports, and that the attestation payload is a valid instantiation of that
258 # type (for example by validating a JSON schema).
259 "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
260 # (GPG) or equivalent. Since this message only supports attached signatures,
261 # the payload that was signed must be attached. While the signature format
262 # supported is dependent on the verification implementation, currently only
263 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
264 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
265 # --output=signature.gpg payload.json` will create the signature content
266 # expected in this field in `signature.gpg` for the `payload.json`
267 # attestation payload.
268 },
269 "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
270 # This attestation must define the `serialized_payload` that the `signatures`
271 # verify and any metadata necessary to interpret that plaintext. The
272 # signatures should always be over the `serialized_payload` bytestring.
273 "signatures": [ # One or more signatures over `serialized_payload`. Verifier implementations
274 # should consider this attestation message verified if at least one
275 # `signature` verifies `serialized_payload`. See `Signature` in common.proto
276 # for more details on signature structure and verification.
277 { # Verifiers (e.g. Kritis implementations) MUST verify signatures
278 # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
279 # Typically this means that the verifier has been configured with a map from
280 # `public_key_id` to public key material (and any required parameters, e.g.
281 # signing algorithm).
282 #
283 # In particular, verification implementations MUST NOT treat the signature
284 # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
285 # DOES NOT validate or authenticate a public key; it only provides a mechanism
286 # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
287 # a trusted channel. Verification implementations MUST reject signatures in any
288 # of the following circumstances:
289 # * The `public_key_id` is not recognized by the verifier.
290 # * The public key that `public_key_id` refers to does not verify the
291 # signature with respect to the payload.
292 #
293 # The `signature` contents SHOULD NOT be "attached" (where the payload is
294 # included with the serialized `signature` bytes). Verifiers MUST ignore any
295 # "attached" payload and only verify signatures with respect to explicitly
296 # provided payload (e.g. a `payload` field on the proto message that holds
297 # this Signature, or the canonical serialization of the proto message that
298 # holds this signature).
299 "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
300 # * The `public_key_id` is required.
301 # * The `public_key_id` MUST be an RFC3986 conformant URI.
302 # * When possible, the `public_key_id` SHOULD be an immutable reference,
303 # such as a cryptographic digest.
304 #
305 # Examples of valid `public_key_id`s:
306 #
307 # OpenPGP V4 public key fingerprint:
308 # * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
309 # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
310 # details on this scheme.
311 #
312 # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
313 # serialization):
314 # * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
315 # * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
316 "signature": "A String", # The content of the signature, an opaque bytestring.
317 # The payload that this signature verifies MUST be unambiguously provided
318 # with the Signature during verification. A wrapper message might provide
319 # the payload explicitly. Alternatively, a message might have a canonical
320 # serialization that can always be unambiguously computed to derive the
321 # payload.
322 },
323 ],
324 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
325 # The verifier must ensure that the provided type is one that the verifier
326 # supports, and that the attestation payload is a valid instantiation of that
327 # type (for example by validating a JSON schema).
328 "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
329 # The encoding and semantic meaning of this payload must match what is set in
330 # `content_type`.
331 },
332 },
333 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]334 "intoto": { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
335 # signatures and the in-toto link itself. This is used for occurrences of a
336 # Grafeas in-toto note.
337 "signatures": [
338 { # A signature object consists of the KeyID used and the signature itself.
339 "keyid": "A String",
340 "sig": "A String",
341 },
342 ],
343 "signed": { # This corresponds to an in-toto link.
344 "environment": { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
345 # environment. It is suggested for this field to contain information that
346 # details environment variables, filesystem information, and the present
347 # working directory. The recommended structure of this field is:
348 # "environment": {
349 # "custom_values": {
350 # "variables": "&lt;ENV&gt;",
351 # "filesystem": "&lt;FS&gt;",
352 # "workdir": "&lt;CWD&gt;",
353 # "&lt;ANY OTHER RELEVANT FIELDS&gt;": "..."
354 # }
355 # }
356 # fields are "variables", "filesystem", and "workdir".
357 "customValues": {
358 "a_key": "A String",
359 },
360 },
361 "command": [ # This field contains the full command executed for the step. This can also
362 # be empty if links are generated for operations that aren't directly mapped
363 # to a specific command. Each term in the command is an independent string
364 # in the list. An example of a command in the in-toto metadata field is:
365 # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
366 "A String",
367 ],
368 "materials": [ # Materials are the supply chain artifacts that go into the step and are used
369 # for the operation performed. The key of the map is the path of the artifact
370 # and the structure contains the recorded hash information. An example is:
371 # "materials": [
372 # {
373 # "resource_uri": "foo/bar",
374 # "hashes": {
375 # "sha256": "ebebf...",
376 # &lt;OTHER HASH ALGORITHMS&gt;: &lt;HASH VALUE&gt;
377 # }
378 # }
379 # ]
380 {
381 "resourceUri": "A String",
382 "hashes": { # Defines a hash object for use in Materials and Products.
383 "sha256": "A String",
384 },
385 },
386 ],
387 "products": [ # Products are the supply chain artifacts generated as a result of the step.
388 # The structure is identical to that of materials.
389 {
390 "resourceUri": "A String",
391 "hashes": { # Defines a hash object for use in Materials and Products.
392 "sha256": "A String",
393 },
394 },
395 ],
396 "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
397 # are not the actual result of the step.
398 # fields are "stderr", "stdout", and "return-value".
399 "customValues": {
400 "a_key": "A String",
401 },
402 },
403 },
404 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]405 "build": { # Details of a build occurrence. # Describes a verifiable build.
406 "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
407 # details about the build from source to completion.
408 "commands": [ # Commands requested by the build.
409 { # Command describes a step performed as part of the build pipeline.
410 "waitFor": [ # The ID(s) of the command(s) that this command depends on.
411 "A String",
412 ],
413 "name": "A String", # Required. Name of the command, as presented on the command line, or if the
414 # command is packaged as a Docker container, as presented to `docker pull`.
415 "args": [ # Command-line arguments used when executing this command.
416 "A String",
417 ],
418 "env": [ # Environment variables set before running this command.
419 "A String",
420 ],
421 "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
422 # this command as a dependency.
423 "dir": "A String", # Working directory (relative to project source root) used when running this
424 # command.
425 },
426 ],
427 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
428 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
429 # source integrity was maintained in the build.
430 #
431 # The keys to this map are file paths used as build source and the values
432 # contain the hash values for those files.
433 #
434 # If the build source came in a single package such as a gzipped tarfile
435 # (.tar.gz), the FileHash will be for the single path to that file.
436 "a_key": { # Container message for hashes of byte content of files, used in source
437 # messages to verify integrity of source input to the build.
438 "fileHash": [ # Required. Collection of file hashes.
439 { # Container message for hash values.
440 "type": "A String", # Required. The type of hash that was performed.
441 "value": "A String", # Required. The hash value.
442 },
443 ],
444 },
445 },
446 "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
447 # location.
448 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
449 # these locations, in the case where the source repository had multiple
450 # remotes or submodules. This list will not include the context specified in
451 # the context field.
452 { # A SourceContext is a reference to a tree of files. A SourceContext together
453 # with a path point to a unique revision of a single file or directory.
454 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
455 # repository (e.g., GitHub).
456 "url": "A String", # Git repository URL.
457 "revisionId": "A String", # Git commit hash.
458 },
459 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
460 # Source Repo.
461 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
462 "kind": "A String", # The alias kind.
463 "name": "A String", # The alias name.
464 },
465 "revisionId": "A String", # A revision ID.
466 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
467 "uid": "A String", # A server-assigned, globally unique identifier.
468 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
469 # winged-cargo-31) and a repo name within that project.
470 "projectId": "A String", # The ID of the project.
471 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
472 },
473 },
474 },
475 "labels": { # Labels with user defined metadata.
476 "a_key": "A String",
477 },
478 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
479 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
480 "kind": "A String", # The alias kind.
481 "name": "A String", # The alias name.
482 },
483 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]484 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
485 # "project/subproject" is a valid project name. The "repo name" is the
486 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]487 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]488 },
489 },
490 ],
491 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
492 # with a path point to a unique revision of a single file or directory.
493 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
494 # repository (e.g., GitHub).
495 "url": "A String", # Git repository URL.
496 "revisionId": "A String", # Git commit hash.
497 },
498 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
499 # Source Repo.
500 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
501 "kind": "A String", # The alias kind.
502 "name": "A String", # The alias name.
503 },
504 "revisionId": "A String", # A revision ID.
505 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
506 "uid": "A String", # A server-assigned, globally unique identifier.
507 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
508 # winged-cargo-31) and a repo name within that project.
509 "projectId": "A String", # The ID of the project.
510 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
511 },
512 },
513 },
514 "labels": { # Labels with user defined metadata.
515 "a_key": "A String",
516 },
517 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
518 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
519 "kind": "A String", # The alias kind.
520 "name": "A String", # The alias name.
521 },
522 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]523 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
524 # "project/subproject" is a valid project name. The "repo name" is the
525 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]526 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]527 },
528 },
529 },
530 "buildOptions": { # Special options applied to this build. This is a catch-all field where
531 # build providers can enter any desired additional details.
532 "a_key": "A String",
533 },
534 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
535 # user's e-mail address at the time the build was initiated; this address may
536 # not represent the same end-user for all time.
537 "projectId": "A String", # ID of the project.
538 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
539 "createTime": "A String", # Time at which the build was created.
540 "builtArtifacts": [ # Output of the build.
541 { # Artifact describes a build product.
542 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
543 # container.
544 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
545 # like `gcr.io/projectID/imagename@sha256:123456`.
546 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
547 # the case of a container build, the name used to push the container image to
548 # Google Container Registry, as presented to `docker push`. Note that a
549 # single Artifact ID can have multiple names, for example if two tags are
550 # applied to one image.
551 "A String",
552 ],
553 },
554 ],
555 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
556 "startTime": "A String", # Time at which execution of the build was started.
557 "endTime": "A String", # Time at which execution of the build was finished.
558 "id": "A String", # Required. Unique identifier of the build.
559 "logsUri": "A String", # URI where any logs for this provenance were written.
560 },
561 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
562 # build signature in the corresponding build note. After verifying the
563 # signature, `provenance_bytes` can be unmarshalled and compared to the
564 # provenance to confirm that it is unchanged. A base64-encoded string
565 # representation of the provenance bytes is used for the signature in order
566 # to interoperate with openssl which expects this format for signature
567 # verification.
568 #
569 # The serialized form is captured both to avoid ambiguity in how the
570 # provenance is marshalled to json as well to prevent incompatibilities with
571 # future changes.
572 },
573 "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
574 "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
575 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
576 # the deployable field with the same name.
577 "A String",
578 ],
579 "userEmail": "A String", # Identity of the user that triggered this deployment.
580 "address": "A String", # Address of the runtime element hosting this deployment.
581 "platform": "A String", # Platform hosting this deployment.
582 "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
583 "undeployTime": "A String", # End of the lifetime of this deployment.
584 "config": "A String", # Configuration used to create this deployment.
585 },
586 },
587 "remediation": "A String", # A description of actions that can be taken to remedy the note.
588 "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
589 "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
590 # system.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]591 "name": "A String", # Output only. The name of the installed package.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]592 "location": [ # Required. All of the places within the filesystem versions of this package
593 # have been found.
594 { # An occurrence of a particular package installation found within a system's
595 # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
596 "path": "A String", # The path from which we gathered that this package/version is installed.
597 "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
598 # denoting the package manager version distributing a package.
599 "version": { # Version contains structured information about the version of a package. # The version installed at this location.
600 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
601 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
602 # versions.
603 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
604 # name.
605 "revision": "A String", # The iteration of the package build from the above version.
606 },
607 },
608 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]609 },
610 },
611 "createTime": "A String", # Output only. The time this occurrence was created.
612 "derivedImage": { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
613 # note.
614 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
615 # relationship. This image would be produced from a Dockerfile with FROM
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]616 # &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]617 "distance": 42, # Output only. The number of layers by which this image differs from the
618 # associated image basis.
619 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
620 # occurrence.
621 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
622 # "distance" and is ordered with [distance] being the layer immediately
623 # following the base image and [1] being the final layer.
624 { # Layer holds metadata specific to a layer of a Docker image.
625 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
626 "directive": "A String", # Required. The recovered Dockerfile directive used to construct this layer.
627 },
628 ],
629 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
630 "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
631 # representation.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]632 "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
633 "A String",
634 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]635 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
636 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
637 # Only the name of the final blob is kept.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]638 },
639 },
640 },
641 "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
642 # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
643 # used as a filter in list requests.
644 },
645 ],
646 }
647
648 x__xgafv: string, V1 error format.
649 Allowed values
650 1 - v1 error format
651 2 - v2 error format
652
653Returns:
654 An object of the form:
655
656 { # Response for creating occurrences in batch.
657 "occurrences": [ # The occurrences that were created.
658 { # An instance of an analysis type that has been found on a resource.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]659 "updateTime": "A String", # Output only. The time this occurrence was last updated.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]660 "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
661 "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
662 #
663 # The hash of the resource content. For example, the Docker digest.
664 "type": "A String", # Required. The type of hash that was performed.
665 "value": "A String", # Required. The hash value.
666 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]667 "name": "A String", # Deprecated, do not use. Use uri instead.
668 #
669 # The name of the resource. For example, the name of a Docker image -
670 # "Debian".
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]671 "uri": "A String", # Required. The unique URI of the resource. For example,
672 # `https://gcr.io/project/image@sha256:foo` for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]673 },
674 "name": "A String", # Output only. The name of the occurrence in the form of
675 # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
676 "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
677 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
678 # scale of 0-10 where 0 indicates low severity and 10 indicates high
679 # severity.
680 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
681 "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
682 # packages etc)
683 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
684 # available, and note provider assigned severity when distro has not yet
685 # assigned a severity for this vulnerability.
686 "relatedUrls": [ # Output only. URLs related to this vulnerability.
687 { # Metadata for any related URL information.
688 "url": "A String", # Specific URL associated with the resource.
689 "label": "A String", # Label to describe usage of the URL.
690 },
691 ],
692 "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
693 # within the associated resource.
694 { # This message wraps a location affected by a vulnerability and its
695 # associated fix (if one is available).
696 "severityName": "A String", # Deprecated, use Details.effective_severity instead
697 # The severity (e.g., distro assigned severity) for this vulnerability.
698 "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
699 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
700 # format. Examples include distro or storage location for vulnerable jar.
701 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
702 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
703 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
704 # versions.
705 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
706 # name.
707 "revision": "A String", # The iteration of the package build from the above version.
708 },
709 "package": "A String", # Required. The package being described.
710 },
711 "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
712 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
713 # format. Examples include distro or storage location for vulnerable jar.
714 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
715 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
716 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
717 # versions.
718 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
719 # name.
720 "revision": "A String", # The iteration of the package build from the above version.
721 },
722 "package": "A String", # Required. The package being described.
723 },
724 },
725 ],
726 "longDescription": "A String", # Output only. A detailed description of this vulnerability.
727 "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
728 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]729 "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
730 # specified. This field can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]731 "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
732 "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
733 "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
734 # Deprecated, do not use.
735 "analysisStatus": "A String", # The status of discovery for the resource.
736 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
737 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
738 # details to show to the user. The LocalizedMessage is output only and
739 # populated by the API.
740 # different programming environments, including REST APIs and RPC APIs. It is
741 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
742 # three pieces of data: error code, error message, and error details.
743 #
744 # You can find out more about this error model and how to work with it in the
745 # [API Design Guide](https://cloud.google.com/apis/design/errors).
746 "message": "A String", # A developer-facing error message, which should be in English. Any
747 # user-facing error message should be localized and sent in the
748 # google.rpc.Status.details field, or localized by the client.
749 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
750 "details": [ # A list of messages that carry the error details. There is a common set of
751 # message types for APIs to use.
752 {
753 "a_key": "", # Properties of the object. Contains field @type with type URL.
754 },
755 ],
756 },
757 },
758 },
759 "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
760 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
761 # attestation can be verified using the attached signature. If the verifier
762 # trusts the public key of the signer, then verifying the signature is
763 # sufficient to establish trust. In this circumstance, the authority to which
764 # this attestation is attached is primarily useful for look-up (how to find
765 # this attestation if you already know the authority and artifact to be
766 # verified) and intent (which authority was this attestation intended to sign
767 # for).
768 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
769 # supports `ATTACHED` signatures, where the payload that is signed is included
770 # alongside the signature itself in the same file.
771 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
772 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
773 # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
774 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
775 # Implementations may choose to acknowledge "LONG", "SHORT", or other
776 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
777 # In gpg, the full fingerprint can be retrieved from the `fpr` field
778 # returned when calling --list-keys with --with-colons. For example:
779 # ```
780 # gpg --with-colons --with-fingerprint --force-v4-certs \
781 # --list-keys attester@example.com
782 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]783 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]784 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
785 # ```
786 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
787 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
788 # The verifier must ensure that the provided type is one that the verifier
789 # supports, and that the attestation payload is a valid instantiation of that
790 # type (for example by validating a JSON schema).
791 "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
792 # (GPG) or equivalent. Since this message only supports attached signatures,
793 # the payload that was signed must be attached. While the signature format
794 # supported is dependent on the verification implementation, currently only
795 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
796 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
797 # --output=signature.gpg payload.json` will create the signature content
798 # expected in this field in `signature.gpg` for the `payload.json`
799 # attestation payload.
800 },
801 "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
802 # This attestation must define the `serialized_payload` that the `signatures`
803 # verify and any metadata necessary to interpret that plaintext. The
804 # signatures should always be over the `serialized_payload` bytestring.
805 "signatures": [ # One or more signatures over `serialized_payload`. Verifier implementations
806 # should consider this attestation message verified if at least one
807 # `signature` verifies `serialized_payload`. See `Signature` in common.proto
808 # for more details on signature structure and verification.
809 { # Verifiers (e.g. Kritis implementations) MUST verify signatures
810 # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
811 # Typically this means that the verifier has been configured with a map from
812 # `public_key_id` to public key material (and any required parameters, e.g.
813 # signing algorithm).
814 #
815 # In particular, verification implementations MUST NOT treat the signature
816 # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
817 # DOES NOT validate or authenticate a public key; it only provides a mechanism
818 # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
819 # a trusted channel. Verification implementations MUST reject signatures in any
820 # of the following circumstances:
821 # * The `public_key_id` is not recognized by the verifier.
822 # * The public key that `public_key_id` refers to does not verify the
823 # signature with respect to the payload.
824 #
825 # The `signature` contents SHOULD NOT be "attached" (where the payload is
826 # included with the serialized `signature` bytes). Verifiers MUST ignore any
827 # "attached" payload and only verify signatures with respect to explicitly
828 # provided payload (e.g. a `payload` field on the proto message that holds
829 # this Signature, or the canonical serialization of the proto message that
830 # holds this signature).
831 "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
832 # * The `public_key_id` is required.
833 # * The `public_key_id` MUST be an RFC3986 conformant URI.
834 # * When possible, the `public_key_id` SHOULD be an immutable reference,
835 # such as a cryptographic digest.
836 #
837 # Examples of valid `public_key_id`s:
838 #
839 # OpenPGP V4 public key fingerprint:
840 # * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
841 # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
842 # details on this scheme.
843 #
844 # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
845 # serialization):
846 # * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
847 # * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
848 "signature": "A String", # The content of the signature, an opaque bytestring.
849 # The payload that this signature verifies MUST be unambiguously provided
850 # with the Signature during verification. A wrapper message might provide
851 # the payload explicitly. Alternatively, a message might have a canonical
852 # serialization that can always be unambiguously computed to derive the
853 # payload.
854 },
855 ],
856 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
857 # The verifier must ensure that the provided type is one that the verifier
858 # supports, and that the attestation payload is a valid instantiation of that
859 # type (for example by validating a JSON schema).
860 "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
861 # The encoding and semantic meaning of this payload must match what is set in
862 # `content_type`.
863 },
864 },
865 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]866 "intoto": { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
867 # signatures and the in-toto link itself. This is used for occurrences of a
868 # Grafeas in-toto note.
869 "signatures": [
870 { # A signature object consists of the KeyID used and the signature itself.
871 "keyid": "A String",
872 "sig": "A String",
873 },
874 ],
875 "signed": { # This corresponds to an in-toto link.
876 "environment": { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
877 # environment. It is suggested for this field to contain information that
878 # details environment variables, filesystem information, and the present
879 # working directory. The recommended structure of this field is:
880 # "environment": {
881 # "custom_values": {
882 # "variables": "&lt;ENV&gt;",
883 # "filesystem": "&lt;FS&gt;",
884 # "workdir": "&lt;CWD&gt;",
885 # "&lt;ANY OTHER RELEVANT FIELDS&gt;": "..."
886 # }
887 # }
888 # fields are "variables", "filesystem", and "workdir".
889 "customValues": {
890 "a_key": "A String",
891 },
892 },
893 "command": [ # This field contains the full command executed for the step. This can also
894 # be empty if links are generated for operations that aren't directly mapped
895 # to a specific command. Each term in the command is an independent string
896 # in the list. An example of a command in the in-toto metadata field is:
897 # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
898 "A String",
899 ],
900 "materials": [ # Materials are the supply chain artifacts that go into the step and are used
901 # for the operation performed. The key of the map is the path of the artifact
902 # and the structure contains the recorded hash information. An example is:
903 # "materials": [
904 # {
905 # "resource_uri": "foo/bar",
906 # "hashes": {
907 # "sha256": "ebebf...",
908 # &lt;OTHER HASH ALGORITHMS&gt;: &lt;HASH VALUE&gt;
909 # }
910 # }
911 # ]
912 {
913 "resourceUri": "A String",
914 "hashes": { # Defines a hash object for use in Materials and Products.
915 "sha256": "A String",
916 },
917 },
918 ],
919 "products": [ # Products are the supply chain artifacts generated as a result of the step.
920 # The structure is identical to that of materials.
921 {
922 "resourceUri": "A String",
923 "hashes": { # Defines a hash object for use in Materials and Products.
924 "sha256": "A String",
925 },
926 },
927 ],
928 "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
929 # are not the actual result of the step.
930 # fields are "stderr", "stdout", and "return-value".
931 "customValues": {
932 "a_key": "A String",
933 },
934 },
935 },
936 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]937 "build": { # Details of a build occurrence. # Describes a verifiable build.
938 "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
939 # details about the build from source to completion.
940 "commands": [ # Commands requested by the build.
941 { # Command describes a step performed as part of the build pipeline.
942 "waitFor": [ # The ID(s) of the command(s) that this command depends on.
943 "A String",
944 ],
945 "name": "A String", # Required. Name of the command, as presented on the command line, or if the
946 # command is packaged as a Docker container, as presented to `docker pull`.
947 "args": [ # Command-line arguments used when executing this command.
948 "A String",
949 ],
950 "env": [ # Environment variables set before running this command.
951 "A String",
952 ],
953 "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
954 # this command as a dependency.
955 "dir": "A String", # Working directory (relative to project source root) used when running this
956 # command.
957 },
958 ],
959 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
960 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
961 # source integrity was maintained in the build.
962 #
963 # The keys to this map are file paths used as build source and the values
964 # contain the hash values for those files.
965 #
966 # If the build source came in a single package such as a gzipped tarfile
967 # (.tar.gz), the FileHash will be for the single path to that file.
968 "a_key": { # Container message for hashes of byte content of files, used in source
969 # messages to verify integrity of source input to the build.
970 "fileHash": [ # Required. Collection of file hashes.
971 { # Container message for hash values.
972 "type": "A String", # Required. The type of hash that was performed.
973 "value": "A String", # Required. The hash value.
974 },
975 ],
976 },
977 },
978 "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
979 # location.
980 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
981 # these locations, in the case where the source repository had multiple
982 # remotes or submodules. This list will not include the context specified in
983 # the context field.
984 { # A SourceContext is a reference to a tree of files. A SourceContext together
985 # with a path point to a unique revision of a single file or directory.
986 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
987 # repository (e.g., GitHub).
988 "url": "A String", # Git repository URL.
989 "revisionId": "A String", # Git commit hash.
990 },
991 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
992 # Source Repo.
993 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
994 "kind": "A String", # The alias kind.
995 "name": "A String", # The alias name.
996 },
997 "revisionId": "A String", # A revision ID.
998 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
999 "uid": "A String", # A server-assigned, globally unique identifier.
1000 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
1001 # winged-cargo-31) and a repo name within that project.
1002 "projectId": "A String", # The ID of the project.
1003 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
1004 },
1005 },
1006 },
1007 "labels": { # Labels with user defined metadata.
1008 "a_key": "A String",
1009 },
1010 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
1011 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
1012 "kind": "A String", # The alias kind.
1013 "name": "A String", # The alias name.
1014 },
1015 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1016 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
1017 # "project/subproject" is a valid project name. The "repo name" is the
1018 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1019 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1020 },
1021 },
1022 ],
1023 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
1024 # with a path point to a unique revision of a single file or directory.
1025 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
1026 # repository (e.g., GitHub).
1027 "url": "A String", # Git repository URL.
1028 "revisionId": "A String", # Git commit hash.
1029 },
1030 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
1031 # Source Repo.
1032 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
1033 "kind": "A String", # The alias kind.
1034 "name": "A String", # The alias name.
1035 },
1036 "revisionId": "A String", # A revision ID.
1037 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
1038 "uid": "A String", # A server-assigned, globally unique identifier.
1039 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
1040 # winged-cargo-31) and a repo name within that project.
1041 "projectId": "A String", # The ID of the project.
1042 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
1043 },
1044 },
1045 },
1046 "labels": { # Labels with user defined metadata.
1047 "a_key": "A String",
1048 },
1049 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
1050 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
1051 "kind": "A String", # The alias kind.
1052 "name": "A String", # The alias name.
1053 },
1054 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1055 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
1056 # "project/subproject" is a valid project name. The "repo name" is the
1057 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1058 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1059 },
1060 },
1061 },
1062 "buildOptions": { # Special options applied to this build. This is a catch-all field where
1063 # build providers can enter any desired additional details.
1064 "a_key": "A String",
1065 },
1066 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
1067 # user's e-mail address at the time the build was initiated; this address may
1068 # not represent the same end-user for all time.
1069 "projectId": "A String", # ID of the project.
1070 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
1071 "createTime": "A String", # Time at which the build was created.
1072 "builtArtifacts": [ # Output of the build.
1073 { # Artifact describes a build product.
1074 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
1075 # container.
1076 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
1077 # like `gcr.io/projectID/imagename@sha256:123456`.
1078 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
1079 # the case of a container build, the name used to push the container image to
1080 # Google Container Registry, as presented to `docker push`. Note that a
1081 # single Artifact ID can have multiple names, for example if two tags are
1082 # applied to one image.
1083 "A String",
1084 ],
1085 },
1086 ],
1087 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
1088 "startTime": "A String", # Time at which execution of the build was started.
1089 "endTime": "A String", # Time at which execution of the build was finished.
1090 "id": "A String", # Required. Unique identifier of the build.
1091 "logsUri": "A String", # URI where any logs for this provenance were written.
1092 },
1093 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
1094 # build signature in the corresponding build note. After verifying the
1095 # signature, `provenance_bytes` can be unmarshalled and compared to the
1096 # provenance to confirm that it is unchanged. A base64-encoded string
1097 # representation of the provenance bytes is used for the signature in order
1098 # to interoperate with openssl which expects this format for signature
1099 # verification.
1100 #
1101 # The serialized form is captured both to avoid ambiguity in how the
1102 # provenance is marshalled to json as well to prevent incompatibilities with
1103 # future changes.
1104 },
1105 "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
1106 "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
1107 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
1108 # the deployable field with the same name.
1109 "A String",
1110 ],
1111 "userEmail": "A String", # Identity of the user that triggered this deployment.
1112 "address": "A String", # Address of the runtime element hosting this deployment.
1113 "platform": "A String", # Platform hosting this deployment.
1114 "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
1115 "undeployTime": "A String", # End of the lifetime of this deployment.
1116 "config": "A String", # Configuration used to create this deployment.
1117 },
1118 },
1119 "remediation": "A String", # A description of actions that can be taken to remedy the note.
1120 "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
1121 "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
1122 # system.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1123 "name": "A String", # Output only. The name of the installed package.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1124 "location": [ # Required. All of the places within the filesystem versions of this package
1125 # have been found.
1126 { # An occurrence of a particular package installation found within a system's
1127 # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
1128 "path": "A String", # The path from which we gathered that this package/version is installed.
1129 "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
1130 # denoting the package manager version distributing a package.
1131 "version": { # Version contains structured information about the version of a package. # The version installed at this location.
1132 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1133 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
1134 # versions.
1135 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
1136 # name.
1137 "revision": "A String", # The iteration of the package build from the above version.
1138 },
1139 },
1140 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1141 },
1142 },
1143 "createTime": "A String", # Output only. The time this occurrence was created.
1144 "derivedImage": { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
1145 # note.
1146 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
1147 # relationship. This image would be produced from a Dockerfile with FROM
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1148 # &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1149 "distance": 42, # Output only. The number of layers by which this image differs from the
1150 # associated image basis.
1151 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
1152 # occurrence.
1153 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
1154 # "distance" and is ordered with [distance] being the layer immediately
1155 # following the base image and [1] being the final layer.
1156 { # Layer holds metadata specific to a layer of a Docker image.
1157 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
1158 "directive": "A String", # Required. The recovered Dockerfile directive used to construct this layer.
1159 },
1160 ],
1161 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
1162 "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
1163 # representation.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1164 "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
1165 "A String",
1166 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1167 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
1168 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
1169 # Only the name of the final blob is kept.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1170 },
1171 },
1172 },
1173 "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
1174 # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
1175 # used as a filter in list requests.
1176 },
1177 ],
1178 }</pre>
1179</div>
1180
1181<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1182 <code class="details" id="create">create(parent, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1183 <pre>Creates a new occurrence.
1184
1185Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1186 parent: string, Required. The name of the project in the form of `projects/[PROJECT_ID]`, under which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1187the occurrence is to be created. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1188 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1189 The object takes the form of:
1190
1191{ # An instance of an analysis type that has been found on a resource.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1192 "updateTime": "A String", # Output only. The time this occurrence was last updated.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1193 "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
1194 "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
1195 #
1196 # The hash of the resource content. For example, the Docker digest.
1197 "type": "A String", # Required. The type of hash that was performed.
1198 "value": "A String", # Required. The hash value.
1199 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1200 "name": "A String", # Deprecated, do not use. Use uri instead.
1201 #
1202 # The name of the resource. For example, the name of a Docker image -
1203 # "Debian".
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1204 "uri": "A String", # Required. The unique URI of the resource. For example,
1205 # `https://gcr.io/project/image@sha256:foo` for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1206 },
1207 "name": "A String", # Output only. The name of the occurrence in the form of
1208 # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
1209 "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
1210 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
1211 # scale of 0-10 where 0 indicates low severity and 10 indicates high
1212 # severity.
1213 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
1214 "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
1215 # packages etc)
1216 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
1217 # available, and note provider assigned severity when distro has not yet
1218 # assigned a severity for this vulnerability.
1219 "relatedUrls": [ # Output only. URLs related to this vulnerability.
1220 { # Metadata for any related URL information.
1221 "url": "A String", # Specific URL associated with the resource.
1222 "label": "A String", # Label to describe usage of the URL.
1223 },
1224 ],
1225 "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
1226 # within the associated resource.
1227 { # This message wraps a location affected by a vulnerability and its
1228 # associated fix (if one is available).
1229 "severityName": "A String", # Deprecated, use Details.effective_severity instead
1230 # The severity (e.g., distro assigned severity) for this vulnerability.
1231 "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
1232 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
1233 # format. Examples include distro or storage location for vulnerable jar.
1234 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
1235 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1236 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
1237 # versions.
1238 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
1239 # name.
1240 "revision": "A String", # The iteration of the package build from the above version.
1241 },
1242 "package": "A String", # Required. The package being described.
1243 },
1244 "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
1245 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
1246 # format. Examples include distro or storage location for vulnerable jar.
1247 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
1248 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1249 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
1250 # versions.
1251 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
1252 # name.
1253 "revision": "A String", # The iteration of the package build from the above version.
1254 },
1255 "package": "A String", # Required. The package being described.
1256 },
1257 },
1258 ],
1259 "longDescription": "A String", # Output only. A detailed description of this vulnerability.
1260 "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
1261 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1262 "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
1263 # specified. This field can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1264 "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
1265 "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
1266 "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
1267 # Deprecated, do not use.
1268 "analysisStatus": "A String", # The status of discovery for the resource.
1269 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
1270 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
1271 # details to show to the user. The LocalizedMessage is output only and
1272 # populated by the API.
1273 # different programming environments, including REST APIs and RPC APIs. It is
1274 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
1275 # three pieces of data: error code, error message, and error details.
1276 #
1277 # You can find out more about this error model and how to work with it in the
1278 # [API Design Guide](https://cloud.google.com/apis/design/errors).
1279 "message": "A String", # A developer-facing error message, which should be in English. Any
1280 # user-facing error message should be localized and sent in the
1281 # google.rpc.Status.details field, or localized by the client.
1282 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
1283 "details": [ # A list of messages that carry the error details. There is a common set of
1284 # message types for APIs to use.
1285 {
1286 "a_key": "", # Properties of the object. Contains field @type with type URL.
1287 },
1288 ],
1289 },
1290 },
1291 },
1292 "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
1293 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
1294 # attestation can be verified using the attached signature. If the verifier
1295 # trusts the public key of the signer, then verifying the signature is
1296 # sufficient to establish trust. In this circumstance, the authority to which
1297 # this attestation is attached is primarily useful for look-up (how to find
1298 # this attestation if you already know the authority and artifact to be
1299 # verified) and intent (which authority was this attestation intended to sign
1300 # for).
1301 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
1302 # supports `ATTACHED` signatures, where the payload that is signed is included
1303 # alongside the signature itself in the same file.
1304 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
1305 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
1306 # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
1307 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
1308 # Implementations may choose to acknowledge "LONG", "SHORT", or other
1309 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
1310 # In gpg, the full fingerprint can be retrieved from the `fpr` field
1311 # returned when calling --list-keys with --with-colons. For example:
1312 # ```
1313 # gpg --with-colons --with-fingerprint --force-v4-certs \
1314 # --list-keys attester@example.com
1315 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1316 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1317 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
1318 # ```
1319 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
1320 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
1321 # The verifier must ensure that the provided type is one that the verifier
1322 # supports, and that the attestation payload is a valid instantiation of that
1323 # type (for example by validating a JSON schema).
1324 "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
1325 # (GPG) or equivalent. Since this message only supports attached signatures,
1326 # the payload that was signed must be attached. While the signature format
1327 # supported is dependent on the verification implementation, currently only
1328 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
1329 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
1330 # --output=signature.gpg payload.json` will create the signature content
1331 # expected in this field in `signature.gpg` for the `payload.json`
1332 # attestation payload.
1333 },
1334 "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
1335 # This attestation must define the `serialized_payload` that the `signatures`
1336 # verify and any metadata necessary to interpret that plaintext. The
1337 # signatures should always be over the `serialized_payload` bytestring.
1338 "signatures": [ # One or more signatures over `serialized_payload`. Verifier implementations
1339 # should consider this attestation message verified if at least one
1340 # `signature` verifies `serialized_payload`. See `Signature` in common.proto
1341 # for more details on signature structure and verification.
1342 { # Verifiers (e.g. Kritis implementations) MUST verify signatures
1343 # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
1344 # Typically this means that the verifier has been configured with a map from
1345 # `public_key_id` to public key material (and any required parameters, e.g.
1346 # signing algorithm).
1347 #
1348 # In particular, verification implementations MUST NOT treat the signature
1349 # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
1350 # DOES NOT validate or authenticate a public key; it only provides a mechanism
1351 # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
1352 # a trusted channel. Verification implementations MUST reject signatures in any
1353 # of the following circumstances:
1354 # * The `public_key_id` is not recognized by the verifier.
1355 # * The public key that `public_key_id` refers to does not verify the
1356 # signature with respect to the payload.
1357 #
1358 # The `signature` contents SHOULD NOT be "attached" (where the payload is
1359 # included with the serialized `signature` bytes). Verifiers MUST ignore any
1360 # "attached" payload and only verify signatures with respect to explicitly
1361 # provided payload (e.g. a `payload` field on the proto message that holds
1362 # this Signature, or the canonical serialization of the proto message that
1363 # holds this signature).
1364 "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
1365 # * The `public_key_id` is required.
1366 # * The `public_key_id` MUST be an RFC3986 conformant URI.
1367 # * When possible, the `public_key_id` SHOULD be an immutable reference,
1368 # such as a cryptographic digest.
1369 #
1370 # Examples of valid `public_key_id`s:
1371 #
1372 # OpenPGP V4 public key fingerprint:
1373 # * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
1374 # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
1375 # details on this scheme.
1376 #
1377 # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
1378 # serialization):
1379 # * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
1380 # * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
1381 "signature": "A String", # The content of the signature, an opaque bytestring.
1382 # The payload that this signature verifies MUST be unambiguously provided
1383 # with the Signature during verification. A wrapper message might provide
1384 # the payload explicitly. Alternatively, a message might have a canonical
1385 # serialization that can always be unambiguously computed to derive the
1386 # payload.
1387 },
1388 ],
1389 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
1390 # The verifier must ensure that the provided type is one that the verifier
1391 # supports, and that the attestation payload is a valid instantiation of that
1392 # type (for example by validating a JSON schema).
1393 "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
1394 # The encoding and semantic meaning of this payload must match what is set in
1395 # `content_type`.
1396 },
1397 },
1398 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1399 "intoto": { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
1400 # signatures and the in-toto link itself. This is used for occurrences of a
1401 # Grafeas in-toto note.
1402 "signatures": [
1403 { # A signature object consists of the KeyID used and the signature itself.
1404 "keyid": "A String",
1405 "sig": "A String",
1406 },
1407 ],
1408 "signed": { # This corresponds to an in-toto link.
1409 "environment": { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
1410 # environment. It is suggested for this field to contain information that
1411 # details environment variables, filesystem information, and the present
1412 # working directory. The recommended structure of this field is:
1413 # "environment": {
1414 # "custom_values": {
1415 # "variables": "&lt;ENV&gt;",
1416 # "filesystem": "&lt;FS&gt;",
1417 # "workdir": "&lt;CWD&gt;",
1418 # "&lt;ANY OTHER RELEVANT FIELDS&gt;": "..."
1419 # }
1420 # }
1421 # fields are "variables", "filesystem", and "workdir".
1422 "customValues": {
1423 "a_key": "A String",
1424 },
1425 },
1426 "command": [ # This field contains the full command executed for the step. This can also
1427 # be empty if links are generated for operations that aren't directly mapped
1428 # to a specific command. Each term in the command is an independent string
1429 # in the list. An example of a command in the in-toto metadata field is:
1430 # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
1431 "A String",
1432 ],
1433 "materials": [ # Materials are the supply chain artifacts that go into the step and are used
1434 # for the operation performed. The key of the map is the path of the artifact
1435 # and the structure contains the recorded hash information. An example is:
1436 # "materials": [
1437 # {
1438 # "resource_uri": "foo/bar",
1439 # "hashes": {
1440 # "sha256": "ebebf...",
1441 # &lt;OTHER HASH ALGORITHMS&gt;: &lt;HASH VALUE&gt;
1442 # }
1443 # }
1444 # ]
1445 {
1446 "resourceUri": "A String",
1447 "hashes": { # Defines a hash object for use in Materials and Products.
1448 "sha256": "A String",
1449 },
1450 },
1451 ],
1452 "products": [ # Products are the supply chain artifacts generated as a result of the step.
1453 # The structure is identical to that of materials.
1454 {
1455 "resourceUri": "A String",
1456 "hashes": { # Defines a hash object for use in Materials and Products.
1457 "sha256": "A String",
1458 },
1459 },
1460 ],
1461 "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
1462 # are not the actual result of the step.
1463 # fields are "stderr", "stdout", and "return-value".
1464 "customValues": {
1465 "a_key": "A String",
1466 },
1467 },
1468 },
1469 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1470 "build": { # Details of a build occurrence. # Describes a verifiable build.
1471 "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
1472 # details about the build from source to completion.
1473 "commands": [ # Commands requested by the build.
1474 { # Command describes a step performed as part of the build pipeline.
1475 "waitFor": [ # The ID(s) of the command(s) that this command depends on.
1476 "A String",
1477 ],
1478 "name": "A String", # Required. Name of the command, as presented on the command line, or if the
1479 # command is packaged as a Docker container, as presented to `docker pull`.
1480 "args": [ # Command-line arguments used when executing this command.
1481 "A String",
1482 ],
1483 "env": [ # Environment variables set before running this command.
1484 "A String",
1485 ],
1486 "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
1487 # this command as a dependency.
1488 "dir": "A String", # Working directory (relative to project source root) used when running this
1489 # command.
1490 },
1491 ],
1492 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
1493 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
1494 # source integrity was maintained in the build.
1495 #
1496 # The keys to this map are file paths used as build source and the values
1497 # contain the hash values for those files.
1498 #
1499 # If the build source came in a single package such as a gzipped tarfile
1500 # (.tar.gz), the FileHash will be for the single path to that file.
1501 "a_key": { # Container message for hashes of byte content of files, used in source
1502 # messages to verify integrity of source input to the build.
1503 "fileHash": [ # Required. Collection of file hashes.
1504 { # Container message for hash values.
1505 "type": "A String", # Required. The type of hash that was performed.
1506 "value": "A String", # Required. The hash value.
1507 },
1508 ],
1509 },
1510 },
1511 "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
1512 # location.
1513 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
1514 # these locations, in the case where the source repository had multiple
1515 # remotes or submodules. This list will not include the context specified in
1516 # the context field.
1517 { # A SourceContext is a reference to a tree of files. A SourceContext together
1518 # with a path point to a unique revision of a single file or directory.
1519 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
1520 # repository (e.g., GitHub).
1521 "url": "A String", # Git repository URL.
1522 "revisionId": "A String", # Git commit hash.
1523 },
1524 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
1525 # Source Repo.
1526 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
1527 "kind": "A String", # The alias kind.
1528 "name": "A String", # The alias name.
1529 },
1530 "revisionId": "A String", # A revision ID.
1531 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
1532 "uid": "A String", # A server-assigned, globally unique identifier.
1533 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
1534 # winged-cargo-31) and a repo name within that project.
1535 "projectId": "A String", # The ID of the project.
1536 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
1537 },
1538 },
1539 },
1540 "labels": { # Labels with user defined metadata.
1541 "a_key": "A String",
1542 },
1543 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
1544 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
1545 "kind": "A String", # The alias kind.
1546 "name": "A String", # The alias name.
1547 },
1548 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1549 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
1550 # "project/subproject" is a valid project name. The "repo name" is the
1551 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1552 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1553 },
1554 },
1555 ],
1556 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
1557 # with a path point to a unique revision of a single file or directory.
1558 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
1559 # repository (e.g., GitHub).
1560 "url": "A String", # Git repository URL.
1561 "revisionId": "A String", # Git commit hash.
1562 },
1563 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
1564 # Source Repo.
1565 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
1566 "kind": "A String", # The alias kind.
1567 "name": "A String", # The alias name.
1568 },
1569 "revisionId": "A String", # A revision ID.
1570 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
1571 "uid": "A String", # A server-assigned, globally unique identifier.
1572 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
1573 # winged-cargo-31) and a repo name within that project.
1574 "projectId": "A String", # The ID of the project.
1575 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
1576 },
1577 },
1578 },
1579 "labels": { # Labels with user defined metadata.
1580 "a_key": "A String",
1581 },
1582 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
1583 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
1584 "kind": "A String", # The alias kind.
1585 "name": "A String", # The alias name.
1586 },
1587 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1588 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
1589 # "project/subproject" is a valid project name. The "repo name" is the
1590 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1591 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1592 },
1593 },
1594 },
1595 "buildOptions": { # Special options applied to this build. This is a catch-all field where
1596 # build providers can enter any desired additional details.
1597 "a_key": "A String",
1598 },
1599 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
1600 # user's e-mail address at the time the build was initiated; this address may
1601 # not represent the same end-user for all time.
1602 "projectId": "A String", # ID of the project.
1603 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
1604 "createTime": "A String", # Time at which the build was created.
1605 "builtArtifacts": [ # Output of the build.
1606 { # Artifact describes a build product.
1607 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
1608 # container.
1609 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
1610 # like `gcr.io/projectID/imagename@sha256:123456`.
1611 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
1612 # the case of a container build, the name used to push the container image to
1613 # Google Container Registry, as presented to `docker push`. Note that a
1614 # single Artifact ID can have multiple names, for example if two tags are
1615 # applied to one image.
1616 "A String",
1617 ],
1618 },
1619 ],
1620 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
1621 "startTime": "A String", # Time at which execution of the build was started.
1622 "endTime": "A String", # Time at which execution of the build was finished.
1623 "id": "A String", # Required. Unique identifier of the build.
1624 "logsUri": "A String", # URI where any logs for this provenance were written.
1625 },
1626 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
1627 # build signature in the corresponding build note. After verifying the
1628 # signature, `provenance_bytes` can be unmarshalled and compared to the
1629 # provenance to confirm that it is unchanged. A base64-encoded string
1630 # representation of the provenance bytes is used for the signature in order
1631 # to interoperate with openssl which expects this format for signature
1632 # verification.
1633 #
1634 # The serialized form is captured both to avoid ambiguity in how the
1635 # provenance is marshalled to json as well to prevent incompatibilities with
1636 # future changes.
1637 },
1638 "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
1639 "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
1640 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
1641 # the deployable field with the same name.
1642 "A String",
1643 ],
1644 "userEmail": "A String", # Identity of the user that triggered this deployment.
1645 "address": "A String", # Address of the runtime element hosting this deployment.
1646 "platform": "A String", # Platform hosting this deployment.
1647 "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
1648 "undeployTime": "A String", # End of the lifetime of this deployment.
1649 "config": "A String", # Configuration used to create this deployment.
1650 },
1651 },
1652 "remediation": "A String", # A description of actions that can be taken to remedy the note.
1653 "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
1654 "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
1655 # system.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1656 "name": "A String", # Output only. The name of the installed package.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1657 "location": [ # Required. All of the places within the filesystem versions of this package
1658 # have been found.
1659 { # An occurrence of a particular package installation found within a system's
1660 # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
1661 "path": "A String", # The path from which we gathered that this package/version is installed.
1662 "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
1663 # denoting the package manager version distributing a package.
1664 "version": { # Version contains structured information about the version of a package. # The version installed at this location.
1665 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1666 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
1667 # versions.
1668 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
1669 # name.
1670 "revision": "A String", # The iteration of the package build from the above version.
1671 },
1672 },
1673 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1674 },
1675 },
1676 "createTime": "A String", # Output only. The time this occurrence was created.
1677 "derivedImage": { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
1678 # note.
1679 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
1680 # relationship. This image would be produced from a Dockerfile with FROM
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1681 # &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1682 "distance": 42, # Output only. The number of layers by which this image differs from the
1683 # associated image basis.
1684 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
1685 # occurrence.
1686 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
1687 # "distance" and is ordered with [distance] being the layer immediately
1688 # following the base image and [1] being the final layer.
1689 { # Layer holds metadata specific to a layer of a Docker image.
1690 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
1691 "directive": "A String", # Required. The recovered Dockerfile directive used to construct this layer.
1692 },
1693 ],
1694 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
1695 "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
1696 # representation.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1697 "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
1698 "A String",
1699 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1700 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
1701 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
1702 # Only the name of the final blob is kept.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1703 },
1704 },
1705 },
1706 "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
1707 # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
1708 # used as a filter in list requests.
1709}
1710
1711 x__xgafv: string, V1 error format.
1712 Allowed values
1713 1 - v1 error format
1714 2 - v2 error format
1715
1716Returns:
1717 An object of the form:
1718
1719 { # An instance of an analysis type that has been found on a resource.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1720 "updateTime": "A String", # Output only. The time this occurrence was last updated.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1721 "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
1722 "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
1723 #
1724 # The hash of the resource content. For example, the Docker digest.
1725 "type": "A String", # Required. The type of hash that was performed.
1726 "value": "A String", # Required. The hash value.
1727 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1728 "name": "A String", # Deprecated, do not use. Use uri instead.
1729 #
1730 # The name of the resource. For example, the name of a Docker image -
1731 # "Debian".
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1732 "uri": "A String", # Required. The unique URI of the resource. For example,
1733 # `https://gcr.io/project/image@sha256:foo` for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1734 },
1735 "name": "A String", # Output only. The name of the occurrence in the form of
1736 # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
1737 "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
1738 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
1739 # scale of 0-10 where 0 indicates low severity and 10 indicates high
1740 # severity.
1741 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
1742 "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
1743 # packages etc)
1744 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
1745 # available, and note provider assigned severity when distro has not yet
1746 # assigned a severity for this vulnerability.
1747 "relatedUrls": [ # Output only. URLs related to this vulnerability.
1748 { # Metadata for any related URL information.
1749 "url": "A String", # Specific URL associated with the resource.
1750 "label": "A String", # Label to describe usage of the URL.
1751 },
1752 ],
1753 "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
1754 # within the associated resource.
1755 { # This message wraps a location affected by a vulnerability and its
1756 # associated fix (if one is available).
1757 "severityName": "A String", # Deprecated, use Details.effective_severity instead
1758 # The severity (e.g., distro assigned severity) for this vulnerability.
1759 "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
1760 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
1761 # format. Examples include distro or storage location for vulnerable jar.
1762 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
1763 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1764 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
1765 # versions.
1766 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
1767 # name.
1768 "revision": "A String", # The iteration of the package build from the above version.
1769 },
1770 "package": "A String", # Required. The package being described.
1771 },
1772 "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
1773 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
1774 # format. Examples include distro or storage location for vulnerable jar.
1775 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
1776 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
1777 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
1778 # versions.
1779 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
1780 # name.
1781 "revision": "A String", # The iteration of the package build from the above version.
1782 },
1783 "package": "A String", # Required. The package being described.
1784 },
1785 },
1786 ],
1787 "longDescription": "A String", # Output only. A detailed description of this vulnerability.
1788 "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
1789 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1790 "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
1791 # specified. This field can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1792 "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
1793 "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
1794 "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
1795 # Deprecated, do not use.
1796 "analysisStatus": "A String", # The status of discovery for the resource.
1797 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
1798 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
1799 # details to show to the user. The LocalizedMessage is output only and
1800 # populated by the API.
1801 # different programming environments, including REST APIs and RPC APIs. It is
1802 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
1803 # three pieces of data: error code, error message, and error details.
1804 #
1805 # You can find out more about this error model and how to work with it in the
1806 # [API Design Guide](https://cloud.google.com/apis/design/errors).
1807 "message": "A String", # A developer-facing error message, which should be in English. Any
1808 # user-facing error message should be localized and sent in the
1809 # google.rpc.Status.details field, or localized by the client.
1810 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
1811 "details": [ # A list of messages that carry the error details. There is a common set of
1812 # message types for APIs to use.
1813 {
1814 "a_key": "", # Properties of the object. Contains field @type with type URL.
1815 },
1816 ],
1817 },
1818 },
1819 },
1820 "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
1821 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
1822 # attestation can be verified using the attached signature. If the verifier
1823 # trusts the public key of the signer, then verifying the signature is
1824 # sufficient to establish trust. In this circumstance, the authority to which
1825 # this attestation is attached is primarily useful for look-up (how to find
1826 # this attestation if you already know the authority and artifact to be
1827 # verified) and intent (which authority was this attestation intended to sign
1828 # for).
1829 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
1830 # supports `ATTACHED` signatures, where the payload that is signed is included
1831 # alongside the signature itself in the same file.
1832 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
1833 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
1834 # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
1835 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
1836 # Implementations may choose to acknowledge "LONG", "SHORT", or other
1837 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
1838 # In gpg, the full fingerprint can be retrieved from the `fpr` field
1839 # returned when calling --list-keys with --with-colons. For example:
1840 # ```
1841 # gpg --with-colons --with-fingerprint --force-v4-certs \
1842 # --list-keys attester@example.com
1843 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1844 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1845 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
1846 # ```
1847 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
1848 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
1849 # The verifier must ensure that the provided type is one that the verifier
1850 # supports, and that the attestation payload is a valid instantiation of that
1851 # type (for example by validating a JSON schema).
1852 "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
1853 # (GPG) or equivalent. Since this message only supports attached signatures,
1854 # the payload that was signed must be attached. While the signature format
1855 # supported is dependent on the verification implementation, currently only
1856 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
1857 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
1858 # --output=signature.gpg payload.json` will create the signature content
1859 # expected in this field in `signature.gpg` for the `payload.json`
1860 # attestation payload.
1861 },
1862 "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
1863 # This attestation must define the `serialized_payload` that the `signatures`
1864 # verify and any metadata necessary to interpret that plaintext. The
1865 # signatures should always be over the `serialized_payload` bytestring.
1866 "signatures": [ # One or more signatures over `serialized_payload`. Verifier implementations
1867 # should consider this attestation message verified if at least one
1868 # `signature` verifies `serialized_payload`. See `Signature` in common.proto
1869 # for more details on signature structure and verification.
1870 { # Verifiers (e.g. Kritis implementations) MUST verify signatures
1871 # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
1872 # Typically this means that the verifier has been configured with a map from
1873 # `public_key_id` to public key material (and any required parameters, e.g.
1874 # signing algorithm).
1875 #
1876 # In particular, verification implementations MUST NOT treat the signature
1877 # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
1878 # DOES NOT validate or authenticate a public key; it only provides a mechanism
1879 # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
1880 # a trusted channel. Verification implementations MUST reject signatures in any
1881 # of the following circumstances:
1882 # * The `public_key_id` is not recognized by the verifier.
1883 # * The public key that `public_key_id` refers to does not verify the
1884 # signature with respect to the payload.
1885 #
1886 # The `signature` contents SHOULD NOT be "attached" (where the payload is
1887 # included with the serialized `signature` bytes). Verifiers MUST ignore any
1888 # "attached" payload and only verify signatures with respect to explicitly
1889 # provided payload (e.g. a `payload` field on the proto message that holds
1890 # this Signature, or the canonical serialization of the proto message that
1891 # holds this signature).
1892 "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
1893 # * The `public_key_id` is required.
1894 # * The `public_key_id` MUST be an RFC3986 conformant URI.
1895 # * When possible, the `public_key_id` SHOULD be an immutable reference,
1896 # such as a cryptographic digest.
1897 #
1898 # Examples of valid `public_key_id`s:
1899 #
1900 # OpenPGP V4 public key fingerprint:
1901 # * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
1902 # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
1903 # details on this scheme.
1904 #
1905 # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
1906 # serialization):
1907 # * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
1908 # * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
1909 "signature": "A String", # The content of the signature, an opaque bytestring.
1910 # The payload that this signature verifies MUST be unambiguously provided
1911 # with the Signature during verification. A wrapper message might provide
1912 # the payload explicitly. Alternatively, a message might have a canonical
1913 # serialization that can always be unambiguously computed to derive the
1914 # payload.
1915 },
1916 ],
1917 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
1918 # The verifier must ensure that the provided type is one that the verifier
1919 # supports, and that the attestation payload is a valid instantiation of that
1920 # type (for example by validating a JSON schema).
1921 "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
1922 # The encoding and semantic meaning of this payload must match what is set in
1923 # `content_type`.
1924 },
1925 },
1926 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1927 "intoto": { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
1928 # signatures and the in-toto link itself. This is used for occurrences of a
1929 # Grafeas in-toto note.
1930 "signatures": [
1931 { # A signature object consists of the KeyID used and the signature itself.
1932 "keyid": "A String",
1933 "sig": "A String",
1934 },
1935 ],
1936 "signed": { # This corresponds to an in-toto link.
1937 "environment": { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
1938 # environment. It is suggested for this field to contain information that
1939 # details environment variables, filesystem information, and the present
1940 # working directory. The recommended structure of this field is:
1941 # "environment": {
1942 # "custom_values": {
1943 # "variables": "&lt;ENV&gt;",
1944 # "filesystem": "&lt;FS&gt;",
1945 # "workdir": "&lt;CWD&gt;",
1946 # "&lt;ANY OTHER RELEVANT FIELDS&gt;": "..."
1947 # }
1948 # }
1949 # fields are "variables", "filesystem", and "workdir".
1950 "customValues": {
1951 "a_key": "A String",
1952 },
1953 },
1954 "command": [ # This field contains the full command executed for the step. This can also
1955 # be empty if links are generated for operations that aren't directly mapped
1956 # to a specific command. Each term in the command is an independent string
1957 # in the list. An example of a command in the in-toto metadata field is:
1958 # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
1959 "A String",
1960 ],
1961 "materials": [ # Materials are the supply chain artifacts that go into the step and are used
1962 # for the operation performed. The key of the map is the path of the artifact
1963 # and the structure contains the recorded hash information. An example is:
1964 # "materials": [
1965 # {
1966 # "resource_uri": "foo/bar",
1967 # "hashes": {
1968 # "sha256": "ebebf...",
1969 # &lt;OTHER HASH ALGORITHMS&gt;: &lt;HASH VALUE&gt;
1970 # }
1971 # }
1972 # ]
1973 {
1974 "resourceUri": "A String",
1975 "hashes": { # Defines a hash object for use in Materials and Products.
1976 "sha256": "A String",
1977 },
1978 },
1979 ],
1980 "products": [ # Products are the supply chain artifacts generated as a result of the step.
1981 # The structure is identical to that of materials.
1982 {
1983 "resourceUri": "A String",
1984 "hashes": { # Defines a hash object for use in Materials and Products.
1985 "sha256": "A String",
1986 },
1987 },
1988 ],
1989 "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
1990 # are not the actual result of the step.
1991 # fields are "stderr", "stdout", and "return-value".
1992 "customValues": {
1993 "a_key": "A String",
1994 },
1995 },
1996 },
1997 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1998 "build": { # Details of a build occurrence. # Describes a verifiable build.
1999 "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
2000 # details about the build from source to completion.
2001 "commands": [ # Commands requested by the build.
2002 { # Command describes a step performed as part of the build pipeline.
2003 "waitFor": [ # The ID(s) of the command(s) that this command depends on.
2004 "A String",
2005 ],
2006 "name": "A String", # Required. Name of the command, as presented on the command line, or if the
2007 # command is packaged as a Docker container, as presented to `docker pull`.
2008 "args": [ # Command-line arguments used when executing this command.
2009 "A String",
2010 ],
2011 "env": [ # Environment variables set before running this command.
2012 "A String",
2013 ],
2014 "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
2015 # this command as a dependency.
2016 "dir": "A String", # Working directory (relative to project source root) used when running this
2017 # command.
2018 },
2019 ],
2020 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
2021 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
2022 # source integrity was maintained in the build.
2023 #
2024 # The keys to this map are file paths used as build source and the values
2025 # contain the hash values for those files.
2026 #
2027 # If the build source came in a single package such as a gzipped tarfile
2028 # (.tar.gz), the FileHash will be for the single path to that file.
2029 "a_key": { # Container message for hashes of byte content of files, used in source
2030 # messages to verify integrity of source input to the build.
2031 "fileHash": [ # Required. Collection of file hashes.
2032 { # Container message for hash values.
2033 "type": "A String", # Required. The type of hash that was performed.
2034 "value": "A String", # Required. The hash value.
2035 },
2036 ],
2037 },
2038 },
2039 "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
2040 # location.
2041 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
2042 # these locations, in the case where the source repository had multiple
2043 # remotes or submodules. This list will not include the context specified in
2044 # the context field.
2045 { # A SourceContext is a reference to a tree of files. A SourceContext together
2046 # with a path point to a unique revision of a single file or directory.
2047 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
2048 # repository (e.g., GitHub).
2049 "url": "A String", # Git repository URL.
2050 "revisionId": "A String", # Git commit hash.
2051 },
2052 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
2053 # Source Repo.
2054 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2055 "kind": "A String", # The alias kind.
2056 "name": "A String", # The alias name.
2057 },
2058 "revisionId": "A String", # A revision ID.
2059 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
2060 "uid": "A String", # A server-assigned, globally unique identifier.
2061 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
2062 # winged-cargo-31) and a repo name within that project.
2063 "projectId": "A String", # The ID of the project.
2064 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
2065 },
2066 },
2067 },
2068 "labels": { # Labels with user defined metadata.
2069 "a_key": "A String",
2070 },
2071 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
2072 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2073 "kind": "A String", # The alias kind.
2074 "name": "A String", # The alias name.
2075 },
2076 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2077 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
2078 # "project/subproject" is a valid project name. The "repo name" is the
2079 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2080 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2081 },
2082 },
2083 ],
2084 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
2085 # with a path point to a unique revision of a single file or directory.
2086 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
2087 # repository (e.g., GitHub).
2088 "url": "A String", # Git repository URL.
2089 "revisionId": "A String", # Git commit hash.
2090 },
2091 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
2092 # Source Repo.
2093 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2094 "kind": "A String", # The alias kind.
2095 "name": "A String", # The alias name.
2096 },
2097 "revisionId": "A String", # A revision ID.
2098 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
2099 "uid": "A String", # A server-assigned, globally unique identifier.
2100 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
2101 # winged-cargo-31) and a repo name within that project.
2102 "projectId": "A String", # The ID of the project.
2103 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
2104 },
2105 },
2106 },
2107 "labels": { # Labels with user defined metadata.
2108 "a_key": "A String",
2109 },
2110 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
2111 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2112 "kind": "A String", # The alias kind.
2113 "name": "A String", # The alias name.
2114 },
2115 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2116 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
2117 # "project/subproject" is a valid project name. The "repo name" is the
2118 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2119 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2120 },
2121 },
2122 },
2123 "buildOptions": { # Special options applied to this build. This is a catch-all field where
2124 # build providers can enter any desired additional details.
2125 "a_key": "A String",
2126 },
2127 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
2128 # user's e-mail address at the time the build was initiated; this address may
2129 # not represent the same end-user for all time.
2130 "projectId": "A String", # ID of the project.
2131 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
2132 "createTime": "A String", # Time at which the build was created.
2133 "builtArtifacts": [ # Output of the build.
2134 { # Artifact describes a build product.
2135 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
2136 # container.
2137 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
2138 # like `gcr.io/projectID/imagename@sha256:123456`.
2139 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
2140 # the case of a container build, the name used to push the container image to
2141 # Google Container Registry, as presented to `docker push`. Note that a
2142 # single Artifact ID can have multiple names, for example if two tags are
2143 # applied to one image.
2144 "A String",
2145 ],
2146 },
2147 ],
2148 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
2149 "startTime": "A String", # Time at which execution of the build was started.
2150 "endTime": "A String", # Time at which execution of the build was finished.
2151 "id": "A String", # Required. Unique identifier of the build.
2152 "logsUri": "A String", # URI where any logs for this provenance were written.
2153 },
2154 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
2155 # build signature in the corresponding build note. After verifying the
2156 # signature, `provenance_bytes` can be unmarshalled and compared to the
2157 # provenance to confirm that it is unchanged. A base64-encoded string
2158 # representation of the provenance bytes is used for the signature in order
2159 # to interoperate with openssl which expects this format for signature
2160 # verification.
2161 #
2162 # The serialized form is captured both to avoid ambiguity in how the
2163 # provenance is marshalled to json as well to prevent incompatibilities with
2164 # future changes.
2165 },
2166 "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
2167 "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
2168 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
2169 # the deployable field with the same name.
2170 "A String",
2171 ],
2172 "userEmail": "A String", # Identity of the user that triggered this deployment.
2173 "address": "A String", # Address of the runtime element hosting this deployment.
2174 "platform": "A String", # Platform hosting this deployment.
2175 "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
2176 "undeployTime": "A String", # End of the lifetime of this deployment.
2177 "config": "A String", # Configuration used to create this deployment.
2178 },
2179 },
2180 "remediation": "A String", # A description of actions that can be taken to remedy the note.
2181 "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
2182 "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
2183 # system.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2184 "name": "A String", # Output only. The name of the installed package.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2185 "location": [ # Required. All of the places within the filesystem versions of this package
2186 # have been found.
2187 { # An occurrence of a particular package installation found within a system's
2188 # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
2189 "path": "A String", # The path from which we gathered that this package/version is installed.
2190 "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
2191 # denoting the package manager version distributing a package.
2192 "version": { # Version contains structured information about the version of a package. # The version installed at this location.
2193 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2194 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
2195 # versions.
2196 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
2197 # name.
2198 "revision": "A String", # The iteration of the package build from the above version.
2199 },
2200 },
2201 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2202 },
2203 },
2204 "createTime": "A String", # Output only. The time this occurrence was created.
2205 "derivedImage": { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
2206 # note.
2207 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
2208 # relationship. This image would be produced from a Dockerfile with FROM
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2209 # &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2210 "distance": 42, # Output only. The number of layers by which this image differs from the
2211 # associated image basis.
2212 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
2213 # occurrence.
2214 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
2215 # "distance" and is ordered with [distance] being the layer immediately
2216 # following the base image and [1] being the final layer.
2217 { # Layer holds metadata specific to a layer of a Docker image.
2218 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
2219 "directive": "A String", # Required. The recovered Dockerfile directive used to construct this layer.
2220 },
2221 ],
2222 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
2223 "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
2224 # representation.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2225 "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
2226 "A String",
2227 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2228 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
2229 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
2230 # Only the name of the final blob is kept.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2231 },
2232 },
2233 },
2234 "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
2235 # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
2236 # used as a filter in list requests.
2237 }</pre>
2238</div>
2239
2240<div class="method">
2241 <code class="details" id="delete">delete(name, x__xgafv=None)</code>
2242 <pre>Deletes the specified occurrence. For example, use this method to delete an
2243occurrence when the occurrence is no longer applicable for the given
2244resource.
2245
2246Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2247 name: string, Required. The name of the occurrence in the form of
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2248`projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`. (required)
2249 x__xgafv: string, V1 error format.
2250 Allowed values
2251 1 - v1 error format
2252 2 - v2 error format
2253
2254Returns:
2255 An object of the form:
2256
2257 { # A generic empty message that you can re-use to avoid defining duplicated
2258 # empty messages in your APIs. A typical example is to use it as the request
2259 # or the response type of an API method. For instance:
2260 #
2261 # service Foo {
2262 # rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
2263 # }
2264 #
2265 # The JSON representation for `Empty` is empty JSON object `{}`.
2266 }</pre>
2267</div>
2268
2269<div class="method">
2270 <code class="details" id="get">get(name, x__xgafv=None)</code>
2271 <pre>Gets the specified occurrence.
2272
2273Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2274 name: string, Required. The name of the occurrence in the form of
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2275`projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`. (required)
2276 x__xgafv: string, V1 error format.
2277 Allowed values
2278 1 - v1 error format
2279 2 - v2 error format
2280
2281Returns:
2282 An object of the form:
2283
2284 { # An instance of an analysis type that has been found on a resource.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2285 "updateTime": "A String", # Output only. The time this occurrence was last updated.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2286 "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
2287 "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
2288 #
2289 # The hash of the resource content. For example, the Docker digest.
2290 "type": "A String", # Required. The type of hash that was performed.
2291 "value": "A String", # Required. The hash value.
2292 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2293 "name": "A String", # Deprecated, do not use. Use uri instead.
2294 #
2295 # The name of the resource. For example, the name of a Docker image -
2296 # "Debian".
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2297 "uri": "A String", # Required. The unique URI of the resource. For example,
2298 # `https://gcr.io/project/image@sha256:foo` for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2299 },
2300 "name": "A String", # Output only. The name of the occurrence in the form of
2301 # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
2302 "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
2303 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
2304 # scale of 0-10 where 0 indicates low severity and 10 indicates high
2305 # severity.
2306 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
2307 "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
2308 # packages etc)
2309 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
2310 # available, and note provider assigned severity when distro has not yet
2311 # assigned a severity for this vulnerability.
2312 "relatedUrls": [ # Output only. URLs related to this vulnerability.
2313 { # Metadata for any related URL information.
2314 "url": "A String", # Specific URL associated with the resource.
2315 "label": "A String", # Label to describe usage of the URL.
2316 },
2317 ],
2318 "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
2319 # within the associated resource.
2320 { # This message wraps a location affected by a vulnerability and its
2321 # associated fix (if one is available).
2322 "severityName": "A String", # Deprecated, use Details.effective_severity instead
2323 # The severity (e.g., distro assigned severity) for this vulnerability.
2324 "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
2325 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
2326 # format. Examples include distro or storage location for vulnerable jar.
2327 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
2328 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2329 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
2330 # versions.
2331 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
2332 # name.
2333 "revision": "A String", # The iteration of the package build from the above version.
2334 },
2335 "package": "A String", # Required. The package being described.
2336 },
2337 "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
2338 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
2339 # format. Examples include distro or storage location for vulnerable jar.
2340 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
2341 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2342 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
2343 # versions.
2344 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
2345 # name.
2346 "revision": "A String", # The iteration of the package build from the above version.
2347 },
2348 "package": "A String", # Required. The package being described.
2349 },
2350 },
2351 ],
2352 "longDescription": "A String", # Output only. A detailed description of this vulnerability.
2353 "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
2354 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2355 "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
2356 # specified. This field can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2357 "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
2358 "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
2359 "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
2360 # Deprecated, do not use.
2361 "analysisStatus": "A String", # The status of discovery for the resource.
2362 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
2363 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
2364 # details to show to the user. The LocalizedMessage is output only and
2365 # populated by the API.
2366 # different programming environments, including REST APIs and RPC APIs. It is
2367 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
2368 # three pieces of data: error code, error message, and error details.
2369 #
2370 # You can find out more about this error model and how to work with it in the
2371 # [API Design Guide](https://cloud.google.com/apis/design/errors).
2372 "message": "A String", # A developer-facing error message, which should be in English. Any
2373 # user-facing error message should be localized and sent in the
2374 # google.rpc.Status.details field, or localized by the client.
2375 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
2376 "details": [ # A list of messages that carry the error details. There is a common set of
2377 # message types for APIs to use.
2378 {
2379 "a_key": "", # Properties of the object. Contains field @type with type URL.
2380 },
2381 ],
2382 },
2383 },
2384 },
2385 "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
2386 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
2387 # attestation can be verified using the attached signature. If the verifier
2388 # trusts the public key of the signer, then verifying the signature is
2389 # sufficient to establish trust. In this circumstance, the authority to which
2390 # this attestation is attached is primarily useful for look-up (how to find
2391 # this attestation if you already know the authority and artifact to be
2392 # verified) and intent (which authority was this attestation intended to sign
2393 # for).
2394 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
2395 # supports `ATTACHED` signatures, where the payload that is signed is included
2396 # alongside the signature itself in the same file.
2397 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
2398 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
2399 # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
2400 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
2401 # Implementations may choose to acknowledge "LONG", "SHORT", or other
2402 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
2403 # In gpg, the full fingerprint can be retrieved from the `fpr` field
2404 # returned when calling --list-keys with --with-colons. For example:
2405 # ```
2406 # gpg --with-colons --with-fingerprint --force-v4-certs \
2407 # --list-keys attester@example.com
2408 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2409 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2410 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
2411 # ```
2412 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
2413 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
2414 # The verifier must ensure that the provided type is one that the verifier
2415 # supports, and that the attestation payload is a valid instantiation of that
2416 # type (for example by validating a JSON schema).
2417 "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
2418 # (GPG) or equivalent. Since this message only supports attached signatures,
2419 # the payload that was signed must be attached. While the signature format
2420 # supported is dependent on the verification implementation, currently only
2421 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
2422 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
2423 # --output=signature.gpg payload.json` will create the signature content
2424 # expected in this field in `signature.gpg` for the `payload.json`
2425 # attestation payload.
2426 },
2427 "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
2428 # This attestation must define the `serialized_payload` that the `signatures`
2429 # verify and any metadata necessary to interpret that plaintext. The
2430 # signatures should always be over the `serialized_payload` bytestring.
2431 "signatures": [ # One or more signatures over `serialized_payload`. Verifier implementations
2432 # should consider this attestation message verified if at least one
2433 # `signature` verifies `serialized_payload`. See `Signature` in common.proto
2434 # for more details on signature structure and verification.
2435 { # Verifiers (e.g. Kritis implementations) MUST verify signatures
2436 # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
2437 # Typically this means that the verifier has been configured with a map from
2438 # `public_key_id` to public key material (and any required parameters, e.g.
2439 # signing algorithm).
2440 #
2441 # In particular, verification implementations MUST NOT treat the signature
2442 # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
2443 # DOES NOT validate or authenticate a public key; it only provides a mechanism
2444 # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
2445 # a trusted channel. Verification implementations MUST reject signatures in any
2446 # of the following circumstances:
2447 # * The `public_key_id` is not recognized by the verifier.
2448 # * The public key that `public_key_id` refers to does not verify the
2449 # signature with respect to the payload.
2450 #
2451 # The `signature` contents SHOULD NOT be "attached" (where the payload is
2452 # included with the serialized `signature` bytes). Verifiers MUST ignore any
2453 # "attached" payload and only verify signatures with respect to explicitly
2454 # provided payload (e.g. a `payload` field on the proto message that holds
2455 # this Signature, or the canonical serialization of the proto message that
2456 # holds this signature).
2457 "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
2458 # * The `public_key_id` is required.
2459 # * The `public_key_id` MUST be an RFC3986 conformant URI.
2460 # * When possible, the `public_key_id` SHOULD be an immutable reference,
2461 # such as a cryptographic digest.
2462 #
2463 # Examples of valid `public_key_id`s:
2464 #
2465 # OpenPGP V4 public key fingerprint:
2466 # * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
2467 # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
2468 # details on this scheme.
2469 #
2470 # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
2471 # serialization):
2472 # * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
2473 # * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
2474 "signature": "A String", # The content of the signature, an opaque bytestring.
2475 # The payload that this signature verifies MUST be unambiguously provided
2476 # with the Signature during verification. A wrapper message might provide
2477 # the payload explicitly. Alternatively, a message might have a canonical
2478 # serialization that can always be unambiguously computed to derive the
2479 # payload.
2480 },
2481 ],
2482 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
2483 # The verifier must ensure that the provided type is one that the verifier
2484 # supports, and that the attestation payload is a valid instantiation of that
2485 # type (for example by validating a JSON schema).
2486 "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
2487 # The encoding and semantic meaning of this payload must match what is set in
2488 # `content_type`.
2489 },
2490 },
2491 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2492 "intoto": { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
2493 # signatures and the in-toto link itself. This is used for occurrences of a
2494 # Grafeas in-toto note.
2495 "signatures": [
2496 { # A signature object consists of the KeyID used and the signature itself.
2497 "keyid": "A String",
2498 "sig": "A String",
2499 },
2500 ],
2501 "signed": { # This corresponds to an in-toto link.
2502 "environment": { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
2503 # environment. It is suggested for this field to contain information that
2504 # details environment variables, filesystem information, and the present
2505 # working directory. The recommended structure of this field is:
2506 # "environment": {
2507 # "custom_values": {
2508 # "variables": "&lt;ENV&gt;",
2509 # "filesystem": "&lt;FS&gt;",
2510 # "workdir": "&lt;CWD&gt;",
2511 # "&lt;ANY OTHER RELEVANT FIELDS&gt;": "..."
2512 # }
2513 # }
2514 # fields are "variables", "filesystem", and "workdir".
2515 "customValues": {
2516 "a_key": "A String",
2517 },
2518 },
2519 "command": [ # This field contains the full command executed for the step. This can also
2520 # be empty if links are generated for operations that aren't directly mapped
2521 # to a specific command. Each term in the command is an independent string
2522 # in the list. An example of a command in the in-toto metadata field is:
2523 # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
2524 "A String",
2525 ],
2526 "materials": [ # Materials are the supply chain artifacts that go into the step and are used
2527 # for the operation performed. The key of the map is the path of the artifact
2528 # and the structure contains the recorded hash information. An example is:
2529 # "materials": [
2530 # {
2531 # "resource_uri": "foo/bar",
2532 # "hashes": {
2533 # "sha256": "ebebf...",
2534 # &lt;OTHER HASH ALGORITHMS&gt;: &lt;HASH VALUE&gt;
2535 # }
2536 # }
2537 # ]
2538 {
2539 "resourceUri": "A String",
2540 "hashes": { # Defines a hash object for use in Materials and Products.
2541 "sha256": "A String",
2542 },
2543 },
2544 ],
2545 "products": [ # Products are the supply chain artifacts generated as a result of the step.
2546 # The structure is identical to that of materials.
2547 {
2548 "resourceUri": "A String",
2549 "hashes": { # Defines a hash object for use in Materials and Products.
2550 "sha256": "A String",
2551 },
2552 },
2553 ],
2554 "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
2555 # are not the actual result of the step.
2556 # fields are "stderr", "stdout", and "return-value".
2557 "customValues": {
2558 "a_key": "A String",
2559 },
2560 },
2561 },
2562 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2563 "build": { # Details of a build occurrence. # Describes a verifiable build.
2564 "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
2565 # details about the build from source to completion.
2566 "commands": [ # Commands requested by the build.
2567 { # Command describes a step performed as part of the build pipeline.
2568 "waitFor": [ # The ID(s) of the command(s) that this command depends on.
2569 "A String",
2570 ],
2571 "name": "A String", # Required. Name of the command, as presented on the command line, or if the
2572 # command is packaged as a Docker container, as presented to `docker pull`.
2573 "args": [ # Command-line arguments used when executing this command.
2574 "A String",
2575 ],
2576 "env": [ # Environment variables set before running this command.
2577 "A String",
2578 ],
2579 "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
2580 # this command as a dependency.
2581 "dir": "A String", # Working directory (relative to project source root) used when running this
2582 # command.
2583 },
2584 ],
2585 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
2586 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
2587 # source integrity was maintained in the build.
2588 #
2589 # The keys to this map are file paths used as build source and the values
2590 # contain the hash values for those files.
2591 #
2592 # If the build source came in a single package such as a gzipped tarfile
2593 # (.tar.gz), the FileHash will be for the single path to that file.
2594 "a_key": { # Container message for hashes of byte content of files, used in source
2595 # messages to verify integrity of source input to the build.
2596 "fileHash": [ # Required. Collection of file hashes.
2597 { # Container message for hash values.
2598 "type": "A String", # Required. The type of hash that was performed.
2599 "value": "A String", # Required. The hash value.
2600 },
2601 ],
2602 },
2603 },
2604 "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
2605 # location.
2606 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
2607 # these locations, in the case where the source repository had multiple
2608 # remotes or submodules. This list will not include the context specified in
2609 # the context field.
2610 { # A SourceContext is a reference to a tree of files. A SourceContext together
2611 # with a path point to a unique revision of a single file or directory.
2612 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
2613 # repository (e.g., GitHub).
2614 "url": "A String", # Git repository URL.
2615 "revisionId": "A String", # Git commit hash.
2616 },
2617 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
2618 # Source Repo.
2619 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2620 "kind": "A String", # The alias kind.
2621 "name": "A String", # The alias name.
2622 },
2623 "revisionId": "A String", # A revision ID.
2624 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
2625 "uid": "A String", # A server-assigned, globally unique identifier.
2626 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
2627 # winged-cargo-31) and a repo name within that project.
2628 "projectId": "A String", # The ID of the project.
2629 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
2630 },
2631 },
2632 },
2633 "labels": { # Labels with user defined metadata.
2634 "a_key": "A String",
2635 },
2636 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
2637 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2638 "kind": "A String", # The alias kind.
2639 "name": "A String", # The alias name.
2640 },
2641 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2642 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
2643 # "project/subproject" is a valid project name. The "repo name" is the
2644 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2645 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2646 },
2647 },
2648 ],
2649 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
2650 # with a path point to a unique revision of a single file or directory.
2651 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
2652 # repository (e.g., GitHub).
2653 "url": "A String", # Git repository URL.
2654 "revisionId": "A String", # Git commit hash.
2655 },
2656 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
2657 # Source Repo.
2658 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2659 "kind": "A String", # The alias kind.
2660 "name": "A String", # The alias name.
2661 },
2662 "revisionId": "A String", # A revision ID.
2663 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
2664 "uid": "A String", # A server-assigned, globally unique identifier.
2665 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
2666 # winged-cargo-31) and a repo name within that project.
2667 "projectId": "A String", # The ID of the project.
2668 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
2669 },
2670 },
2671 },
2672 "labels": { # Labels with user defined metadata.
2673 "a_key": "A String",
2674 },
2675 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
2676 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
2677 "kind": "A String", # The alias kind.
2678 "name": "A String", # The alias name.
2679 },
2680 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2681 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
2682 # "project/subproject" is a valid project name. The "repo name" is the
2683 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2684 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2685 },
2686 },
2687 },
2688 "buildOptions": { # Special options applied to this build. This is a catch-all field where
2689 # build providers can enter any desired additional details.
2690 "a_key": "A String",
2691 },
2692 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
2693 # user's e-mail address at the time the build was initiated; this address may
2694 # not represent the same end-user for all time.
2695 "projectId": "A String", # ID of the project.
2696 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
2697 "createTime": "A String", # Time at which the build was created.
2698 "builtArtifacts": [ # Output of the build.
2699 { # Artifact describes a build product.
2700 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
2701 # container.
2702 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
2703 # like `gcr.io/projectID/imagename@sha256:123456`.
2704 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
2705 # the case of a container build, the name used to push the container image to
2706 # Google Container Registry, as presented to `docker push`. Note that a
2707 # single Artifact ID can have multiple names, for example if two tags are
2708 # applied to one image.
2709 "A String",
2710 ],
2711 },
2712 ],
2713 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
2714 "startTime": "A String", # Time at which execution of the build was started.
2715 "endTime": "A String", # Time at which execution of the build was finished.
2716 "id": "A String", # Required. Unique identifier of the build.
2717 "logsUri": "A String", # URI where any logs for this provenance were written.
2718 },
2719 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
2720 # build signature in the corresponding build note. After verifying the
2721 # signature, `provenance_bytes` can be unmarshalled and compared to the
2722 # provenance to confirm that it is unchanged. A base64-encoded string
2723 # representation of the provenance bytes is used for the signature in order
2724 # to interoperate with openssl which expects this format for signature
2725 # verification.
2726 #
2727 # The serialized form is captured both to avoid ambiguity in how the
2728 # provenance is marshalled to json as well to prevent incompatibilities with
2729 # future changes.
2730 },
2731 "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
2732 "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
2733 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
2734 # the deployable field with the same name.
2735 "A String",
2736 ],
2737 "userEmail": "A String", # Identity of the user that triggered this deployment.
2738 "address": "A String", # Address of the runtime element hosting this deployment.
2739 "platform": "A String", # Platform hosting this deployment.
2740 "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
2741 "undeployTime": "A String", # End of the lifetime of this deployment.
2742 "config": "A String", # Configuration used to create this deployment.
2743 },
2744 },
2745 "remediation": "A String", # A description of actions that can be taken to remedy the note.
2746 "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
2747 "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
2748 # system.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2749 "name": "A String", # Output only. The name of the installed package.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2750 "location": [ # Required. All of the places within the filesystem versions of this package
2751 # have been found.
2752 { # An occurrence of a particular package installation found within a system's
2753 # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
2754 "path": "A String", # The path from which we gathered that this package/version is installed.
2755 "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
2756 # denoting the package manager version distributing a package.
2757 "version": { # Version contains structured information about the version of a package. # The version installed at this location.
2758 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
2759 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
2760 # versions.
2761 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
2762 # name.
2763 "revision": "A String", # The iteration of the package build from the above version.
2764 },
2765 },
2766 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2767 },
2768 },
2769 "createTime": "A String", # Output only. The time this occurrence was created.
2770 "derivedImage": { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
2771 # note.
2772 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
2773 # relationship. This image would be produced from a Dockerfile with FROM
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2774 # &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2775 "distance": 42, # Output only. The number of layers by which this image differs from the
2776 # associated image basis.
2777 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
2778 # occurrence.
2779 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
2780 # "distance" and is ordered with [distance] being the layer immediately
2781 # following the base image and [1] being the final layer.
2782 { # Layer holds metadata specific to a layer of a Docker image.
2783 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
2784 "directive": "A String", # Required. The recovered Dockerfile directive used to construct this layer.
2785 },
2786 ],
2787 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
2788 "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
2789 # representation.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2790 "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
2791 "A String",
2792 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2793 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
2794 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
2795 # Only the name of the final blob is kept.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2796 },
2797 },
2798 },
2799 "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
2800 # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
2801 # used as a filter in list requests.
2802 }</pre>
2803</div>
2804
2805<div class="method">
2806 <code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>
2807 <pre>Gets the access control policy for a note or an occurrence resource.
2808Requires `containeranalysis.notes.setIamPolicy` or
2809`containeranalysis.occurrences.setIamPolicy` permission if the resource is
2810a note or occurrence, respectively.
2811
2812The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
2813notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
2814occurrences.
2815
2816Args:
2817 resource: string, REQUIRED: The resource for which the policy is being requested.
2818See the operation documentation for the appropriate value for this field. (required)
2819 body: object, The request body.
2820 The object takes the form of:
2821
2822{ # Request message for `GetIamPolicy` method.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2823 "options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to
2824 # `GetIamPolicy`.
2825 "requestedPolicyVersion": 42, # Optional. The policy format version to be returned.
2826 #
2827 # Valid values are 0, 1, and 3. Requests specifying an invalid value will be
2828 # rejected.
2829 #
2830 # Requests for policies with any conditional bindings must specify version 3.
2831 # Policies without any conditional bindings may specify any valid value or
2832 # leave the field unset.
2833 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2834 }
2835
2836 x__xgafv: string, V1 error format.
2837 Allowed values
2838 1 - v1 error format
2839 2 - v2 error format
2840
2841Returns:
2842 An object of the form:
2843
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2844 { # An Identity and Access Management (IAM) policy, which specifies access
2845 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2846 #
2847 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2848 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
2849 # `members` to a single `role`. Members can be user accounts, service accounts,
2850 # Google groups, and domains (such as G Suite). A `role` is a named list of
2851 # permissions; each `role` can be an IAM predefined role or a user-created
2852 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2853 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2854 # Optionally, a `binding` can specify a `condition`, which is a logical
2855 # expression that allows access to a resource only if the expression evaluates
2856 # to `true`. A condition can add constraints based on attributes of the
2857 # request, the resource, or both.
2858 #
2859 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2860 #
2861 # {
2862 # "bindings": [
2863 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2864 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2865 # "members": [
2866 # "user:mike@example.com",
2867 # "group:admins@example.com",
2868 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2869 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2870 # ]
2871 # },
2872 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2873 # "role": "roles/resourcemanager.organizationViewer",
2874 # "members": ["user:eve@example.com"],
2875 # "condition": {
2876 # "title": "expirable access",
2877 # "description": "Does not grant access after Sep 2020",
2878 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
2879 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2880 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2881 # ],
2882 # "etag": "BwWWja0YfJA=",
2883 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2884 # }
2885 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2886 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2887 #
2888 # bindings:
2889 # - members:
2890 # - user:mike@example.com
2891 # - group:admins@example.com
2892 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2893 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
2894 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2895 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2896 # - user:eve@example.com
2897 # role: roles/resourcemanager.organizationViewer
2898 # condition:
2899 # title: expirable access
2900 # description: Does not grant access after Sep 2020
2901 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
2902 # - etag: BwWWja0YfJA=
2903 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2904 #
2905 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2906 # [IAM documentation](https://cloud.google.com/iam/docs/).
2907 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
2908 # `condition` that determines how and when the `bindings` are applied. Each
2909 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2910 { # Associates `members` with a `role`.
2911 "role": "A String", # Role that is assigned to `members`.
2912 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2913 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
2914 # NOTE: An unsatisfied condition will not allow user access via current
2915 # binding. Different bindings, including their conditions, are examined
2916 # independently.
2917 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
2918 # are documented at https://github.com/google/cel-spec.
2919 #
2920 # Example (Comparison):
2921 #
2922 # title: "Summary size limit"
2923 # description: "Determines if a summary is less than 100 chars"
2924 # expression: "document.summary.size() &lt; 100"
2925 #
2926 # Example (Equality):
2927 #
2928 # title: "Requestor is owner"
2929 # description: "Determines if requestor is the document owner"
2930 # expression: "document.owner == request.auth.claims.email"
2931 #
2932 # Example (Logic):
2933 #
2934 # title: "Public documents"
2935 # description: "Determine whether the document should be publicly visible"
2936 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
2937 #
2938 # Example (Data Manipulation):
2939 #
2940 # title: "Notification string"
2941 # description: "Create a notification string with a timestamp."
2942 # expression: "'New message received at ' + string(document.create_time)"
2943 #
2944 # The exact variables and functions that may be referenced within an expression
2945 # are determined by the service that evaluates it. See the service
2946 # documentation for additional information.
2947 "description": "A String", # Optional. Description of the expression. This is a longer text which
2948 # describes the expression, e.g. when hovered over it in a UI.
2949 "expression": "A String", # Textual representation of an expression in Common Expression Language
2950 # syntax.
2951 "location": "A String", # Optional. String indicating the location of the expression for error
2952 # reporting, e.g. a file name and a position in the file.
2953 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
2954 # its purpose. This can be used e.g. in UIs which allow to enter the
2955 # expression.
2956 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2957 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
2958 # `members` can have the following values:
2959 #
2960 # * `allUsers`: A special identifier that represents anyone who is
2961 # on the internet; with or without a Google account.
2962 #
2963 # * `allAuthenticatedUsers`: A special identifier that represents anyone
2964 # who is authenticated with a Google account or a service account.
2965 #
2966 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2967 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2968 #
2969 #
2970 # * `serviceAccount:{emailid}`: An email address that represents a service
2971 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
2972 #
2973 # * `group:{emailid}`: An email address that represents a Google group.
2974 # For example, `admins@example.com`.
2975 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]2976 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
2977 # identifier) representing a user that has been recently deleted. For
2978 # example, `alice@example.com?uid=123456789012345678901`. If the user is
2979 # recovered, this value reverts to `user:{emailid}` and the recovered user
2980 # retains the role in the binding.
2981 #
2982 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
2983 # unique identifier) representing a service account that has been recently
2984 # deleted. For example,
2985 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
2986 # If the service account is undeleted, this value reverts to
2987 # `serviceAccount:{emailid}` and the undeleted service account retains the
2988 # role in the binding.
2989 #
2990 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
2991 # identifier) representing a Google group that has been recently
2992 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
2993 # the group is recovered, this value reverts to `group:{emailid}` and the
2994 # recovered group retains the role in the binding.
2995 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2996 #
2997 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
2998 # users of that domain. For example, `google.com` or `example.com`.
2999 #
3000 "A String",
3001 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3002 },
3003 ],
3004 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
3005 # prevent simultaneous updates of a policy from overwriting each other.
3006 # It is strongly suggested that systems make use of the `etag` in the
3007 # read-modify-write cycle to perform policy updates in order to avoid race
3008 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
3009 # systems are expected to put that etag in the request to `setIamPolicy` to
3010 # ensure that their change will be applied to the same version of the policy.
3011 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3012 # **Important:** If you use IAM Conditions, you must include the `etag` field
3013 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
3014 # you to overwrite a version `3` policy with a version `1` policy, and all of
3015 # the conditions in the version `3` policy are lost.
3016 "version": 42, # Specifies the format of the policy.
3017 #
3018 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
3019 # are rejected.
3020 #
3021 # Any operation that affects conditional role bindings must specify version
3022 # `3`. This requirement applies to the following operations:
3023 #
3024 # * Getting a policy that includes a conditional role binding
3025 # * Adding a conditional role binding to a policy
3026 # * Changing a conditional role binding in a policy
3027 # * Removing any role binding, with or without a condition, from a policy
3028 # that includes conditions
3029 #
3030 # **Important:** If you use IAM Conditions, you must include the `etag` field
3031 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
3032 # you to overwrite a version `3` policy with a version `1` policy, and all of
3033 # the conditions in the version `3` policy are lost.
3034 #
3035 # If a policy does not include any conditions, operations on that policy may
3036 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3037 }</pre>
3038</div>
3039
3040<div class="method">
3041 <code class="details" id="getNotes">getNotes(name, x__xgafv=None)</code>
3042 <pre>Gets the note attached to the specified occurrence. Consumer projects can
3043use this method to get a note that belongs to a provider project.
3044
3045Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3046 name: string, Required. The name of the occurrence in the form of
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3047`projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`. (required)
3048 x__xgafv: string, V1 error format.
3049 Allowed values
3050 1 - v1 error format
3051 2 - v2 error format
3052
3053Returns:
3054 An object of the form:
3055
3056 { # A type of analysis that can be done for a resource.
3057 "updateTime": "A String", # Output only. The time this note was last updated. This field can be used as
3058 # a filter in list requests.
3059 "relatedNoteNames": [ # Other notes related to this note.
3060 "A String",
3061 ],
3062 "name": "A String", # Output only. The name of the note in the form of
3063 # `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
3064 "package": { # This represents a particular package that is distributed over various # A note describing a package hosted by various package managers.
3065 # channels. E.g., glibc (aka libc6) is distributed by many, at various
3066 # versions.
3067 "distribution": [ # The various channels by which a package is distributed.
3068 { # This represents a particular channel of distribution for a given package.
3069 # E.g., Debian's jessie-backports dpkg mirror.
3070 "cpeUri": "A String", # Required. The cpe_uri in [CPE format](https://cpe.mitre.org/specification/)
3071 # denoting the package manager version distributing a package.
3072 "maintainer": "A String", # A freeform string denoting the maintainer of this package.
3073 "description": "A String", # The distribution channel-specific description of this package.
3074 "url": "A String", # The distribution channel-specific homepage for this package.
3075 "architecture": "A String", # The CPU architecture for which packages in this distribution channel were
3076 # built.
3077 "latestVersion": { # Version contains structured information about the version of a package. # The latest available version of this package in this distribution channel.
3078 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3079 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
3080 # versions.
3081 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
3082 # name.
3083 "revision": "A String", # The iteration of the package build from the above version.
3084 },
3085 },
3086 ],
3087 "name": "A String", # Required. Immutable. The name of the package.
3088 },
3089 "vulnerability": { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
3090 "windowsDetails": [ # Windows details get their own format because the information format and
3091 # model don't match a normal detail. Specifically Windows updates are done as
3092 # patches, thus Windows vulnerabilities really are a missing package, rather
3093 # than a package being at an incorrect version.
3094 {
3095 "cpeUri": "A String", # Required. The CPE URI in
3096 # [cpe format](https://cpe.mitre.org/specification/) in which the
3097 # vulnerability manifests. Examples include distro or storage location for
3098 # vulnerable jar.
3099 "fixingKbs": [ # Required. The names of the KBs which have hotfixes to mitigate this
3100 # vulnerability. Note that there may be multiple hotfixes (and thus
3101 # multiple KBs) that mitigate a given vulnerability. Currently any listed
3102 # kb's presence is considered a fix.
3103 {
3104 "url": "A String", # A link to the KB in the Windows update catalog -
3105 # https://www.catalog.update.microsoft.com/
3106 "name": "A String", # The KB name (generally of the form KB[0-9]+ i.e. KB123456).
3107 },
3108 ],
3109 "name": "A String", # Required. The name of the vulnerability.
3110 "description": "A String", # The description of the vulnerability.
3111 },
3112 ],
3113 "cvssV3": { # Common Vulnerability Scoring System version 3. # The full description of the CVSSv3.
3114 # For details, see https://www.first.org/cvss/specification-document
3115 "attackComplexity": "A String",
3116 "attackVector": "A String", # Base Metrics
3117 # Represents the intrinsic characteristics of a vulnerability that are
3118 # constant over time and across user environments.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3119 "privilegesRequired": "A String",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3120 "userInteraction": "A String",
3121 "baseScore": 3.14, # The base score is a function of the base metric scores.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3122 "availabilityImpact": "A String",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3123 "impactScore": 3.14,
3124 "exploitabilityScore": 3.14,
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3125 "scope": "A String",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3126 "integrityImpact": "A String",
3127 "confidentialityImpact": "A String",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3128 },
3129 "cvssScore": 3.14, # The CVSS score for this vulnerability.
3130 "severity": "A String", # Note provider assigned impact of the vulnerability.
3131 "details": [ # All information about the package to specifically identify this
3132 # vulnerability. One entry per (version range and cpe_uri) the package
3133 # vulnerability has manifested in.
3134 { # Identifies all appearances of this vulnerability in the package for a
3135 # specific distro/location. For example: glibc in
3136 # cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2
3137 "severityName": "A String", # The severity (eg: distro assigned severity) for this vulnerability.
3138 "cpeUri": "A String", # Required. The CPE URI in
3139 # [cpe format](https://cpe.mitre.org/specification/) in which the
3140 # vulnerability manifests. Examples include distro or storage location for
3141 # vulnerable jar.
3142 "description": "A String", # A vendor-specific description of this note.
3143 "minAffectedVersion": { # Version contains structured information about the version of a package. # The min version of the package in which the vulnerability exists.
3144 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3145 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
3146 # versions.
3147 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
3148 # name.
3149 "revision": "A String", # The iteration of the package build from the above version.
3150 },
3151 "package": "A String", # Required. The name of the package where the vulnerability was found.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3152 "isObsolete": True or False, # Whether this detail is obsolete. Occurrences are expected not to point to
3153 # obsolete details.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3154 "packageType": "A String", # The type of package; whether native or non native(ruby gems, node.js
3155 # packages etc).
3156 "sourceUpdateTime": "A String", # The time this information was last changed at the source. This is an
3157 # upstream timestamp from the underlying information source - e.g. Ubuntu
3158 # security tracker.
3159 "maxAffectedVersion": { # Version contains structured information about the version of a package. # The max version of the package in which the vulnerability exists.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3160 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3161 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
3162 # versions.
3163 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
3164 # name.
3165 "revision": "A String", # The iteration of the package build from the above version.
3166 },
3167 "fixedLocation": { # The location of the vulnerability. # The fix for this specific package version.
3168 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
3169 # format. Examples include distro or storage location for vulnerable jar.
3170 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
3171 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3172 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
3173 # versions.
3174 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
3175 # name.
3176 "revision": "A String", # The iteration of the package build from the above version.
3177 },
3178 "package": "A String", # Required. The package being described.
3179 },
3180 },
3181 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3182 "sourceUpdateTime": "A String", # The time this information was last changed at the source. This is an
3183 # upstream timestamp from the underlying information source - e.g. Ubuntu
3184 # security tracker.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3185 },
3186 "kind": "A String", # Output only. The type of analysis. This field can be used as a filter in
3187 # list requests.
3188 "relatedUrl": [ # URLs associated with this note.
3189 { # Metadata for any related URL information.
3190 "url": "A String", # Specific URL associated with the resource.
3191 "label": "A String", # Label to describe usage of the URL.
3192 },
3193 ],
3194 "longDescription": "A String", # A detailed description of this note.
3195 "attestationAuthority": { # Note kind that represents a logical attestation "role" or "authority". For # A note describing an attestation role.
3196 # example, an organization might have one `Authority` for "QA" and one for
3197 # "build". This note is intended to act strictly as a grouping mechanism for
3198 # the attached occurrences (Attestations). This grouping mechanism also
3199 # provides a security boundary, since IAM ACLs gate the ability for a principle
3200 # to attach an occurrence to a given note. It also provides a single point of
3201 # lookup to find all attached attestation occurrences, even if they don't all
3202 # live in the same project.
3203 "hint": { # This submessage provides human-readable hints about the purpose of the # Hint hints at the purpose of the attestation authority.
3204 # authority. Because the name of a note acts as its resource reference, it is
3205 # important to disambiguate the canonical name of the Note (which might be a
3206 # UUID for security purposes) from "readable" names more suitable for debug
3207 # output. Note that these hints should not be used to look up authorities in
3208 # security sensitive contexts, such as when looking up attestations to
3209 # verify.
3210 "humanReadableName": "A String", # Required. The human readable name of this attestation authority, for
3211 # example "qa".
3212 },
3213 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3214 "intoto": { # This contains the fields corresponding to the definition of a software supply # A note describing an in-toto link.
3215 # chain step in an in-toto layout. This information goes into a Grafeas note.
3216 "stepName": "A String", # This field identifies the name of the step in the supply chain.
3217 "expectedCommand": [ # This field contains the expected command used to perform the step.
3218 "A String",
3219 ],
3220 "threshold": "A String", # This field contains a value that indicates the minimum number of keys that
3221 # need to be used to sign the step's in-toto link.
3222 "expectedMaterials": [ # The following fields contain in-toto artifact rules identifying the
3223 # artifacts that enter this supply chain step, and exit the supply chain
3224 # step, i.e. materials and products of the step.
3225 { # Defines an object to declare an in-toto artifact rule
3226 "artifactRule": [
3227 "A String",
3228 ],
3229 },
3230 ],
3231 "expectedProducts": [
3232 { # Defines an object to declare an in-toto artifact rule
3233 "artifactRule": [
3234 "A String",
3235 ],
3236 },
3237 ],
3238 "signingKeys": [ # This field contains the public keys that can be used to verify the
3239 # signatures on the step metadata.
3240 { # This defines the format used to record keys used in the software supply
3241 # chain. An in-toto link is attested using one or more keys defined in the
3242 # in-toto layout. An example of this is:
3243 # {
3244 # "key_id": "776a00e29f3559e0141b3b096f696abc6cfb0c657ab40f441132b345b0...",
3245 # "key_type": "rsa",
3246 # "public_key_value": "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0B...",
3247 # "key_scheme": "rsassa-pss-sha256"
3248 # }
3249 # The format for in-toto's key definition can be found in section 4.2 of the
3250 # in-toto specification.
3251 "keyType": "A String", # This field identifies the specific signing method. Eg: "rsa", "ed25519",
3252 # and "ecdsa".
3253 "keyId": "A String", # key_id is an identifier for the signing key.
3254 "publicKeyValue": "A String", # This field contains the actual public key.
3255 "keyScheme": "A String", # This field contains the corresponding signature scheme.
3256 # Eg: "rsassa-pss-sha256".
3257 },
3258 ],
3259 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3260 "build": { # Note holding the version of the provider's builder and the signature of the # A note describing build provenance for a verifiable build.
3261 # provenance message in the build details occurrence.
3262 "builderVersion": "A String", # Required. Immutable. Version of the builder which produced this build.
3263 "signature": { # Message encapsulating the signature of the verified build. # Signature of the build in occurrences pointing to this build note
3264 # containing build details.
3265 "publicKey": "A String", # Public key of the builder which can be used to verify that the related
3266 # findings are valid and unchanged. If `key_type` is empty, this defaults
3267 # to PEM encoded public keys.
3268 #
3269 # This field may be empty if `key_id` references an external key.
3270 #
3271 # For Cloud Build based signatures, this is a PEM encoded public
3272 # key. To verify the Cloud Build signature, place the contents of
3273 # this field into a file (public.pem). The signature field is base64-decoded
3274 # into its binary representation in signature.bin, and the provenance bytes
3275 # from `BuildDetails` are base64-decoded into a binary representation in
3276 # signed.bin. OpenSSL can then verify the signature:
3277 # `openssl sha256 -verify public.pem -signature signature.bin signed.bin`
3278 "keyType": "A String", # The type of the key, either stored in `public_key` or referenced in
3279 # `key_id`.
3280 "keyId": "A String", # An ID for the key used to sign. This could be either an ID for the key
3281 # stored in `public_key` (such as the ID or fingerprint for a PGP key, or the
3282 # CN for a cert), or a reference to an external key (such as a reference to a
3283 # key in Cloud Key Management Service).
3284 "signature": "A String", # Required. Signature of the related `BuildProvenance`. In JSON, this is
3285 # base-64 encoded.
3286 },
3287 },
3288 "baseImage": { # Basis describes the base image portion (Note) of the DockerImage # A note describing a base image.
3289 # relationship. Linked occurrences are derived from this or an
3290 # equivalent image via:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3291 # FROM &lt;Basis.resource_url&gt;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3292 # Or an equivalent reference, e.g. a tag of the resource_url.
3293 "resourceUrl": "A String", # Required. Immutable. The resource_url for the resource representing the
3294 # basis of associated occurrence images.
3295 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. Immutable. The fingerprint of the base image.
3296 "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
3297 # representation.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3298 "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
3299 "A String",
3300 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3301 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
3302 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
3303 # Only the name of the final blob is kept.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3304 },
3305 },
3306 "expirationTime": "A String", # Time of expiration for this note. Empty if note does not expire.
3307 "deployable": { # An artifact that can be deployed in some runtime. # A note describing something that can be deployed.
3308 "resourceUri": [ # Required. Resource URI for the artifact being deployed.
3309 "A String",
3310 ],
3311 },
3312 "shortDescription": "A String", # A one sentence description of this note.
3313 "createTime": "A String", # Output only. The time this note was created. This field can be used as a
3314 # filter in list requests.
3315 "discovery": { # A note that indicates a type of analysis a provider would perform. This note # A note describing the initial analysis of a resource.
3316 # exists in a provider's project. A `Discovery` occurrence is created in a
3317 # consumer's project at the start of analysis.
3318 "analysisKind": "A String", # Required. Immutable. The kind of analysis that is handled by this
3319 # discovery.
3320 },
3321 }</pre>
3322</div>
3323
3324<div class="method">
3325 <code class="details" id="getVulnerabilitySummary">getVulnerabilitySummary(parent, x__xgafv=None, filter=None)</code>
3326 <pre>Gets a summary of the number and severity of occurrences.
3327
3328Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3329 parent: string, Required. The name of the project to get a vulnerability summary for in the form of
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3330`projects/[PROJECT_ID]`. (required)
3331 x__xgafv: string, V1 error format.
3332 Allowed values
3333 1 - v1 error format
3334 2 - v2 error format
3335 filter: string, The filter expression.
3336
3337Returns:
3338 An object of the form:
3339
3340 { # A summary of how many vulnerability occurrences there are per resource and
3341 # severity type.
3342 "counts": [ # A listing by resource of the number of fixable and total vulnerabilities.
3343 { # Per resource and severity counts of fixable and total vulnerabilities.
3344 "totalCount": "A String", # The total number of vulnerabilities associated with this resource.
3345 "resource": { # An entity that can have metadata. For example, a Docker image. # The affected resource.
3346 "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
3347 #
3348 # The hash of the resource content. For example, the Docker digest.
3349 "type": "A String", # Required. The type of hash that was performed.
3350 "value": "A String", # Required. The hash value.
3351 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3352 "name": "A String", # Deprecated, do not use. Use uri instead.
3353 #
3354 # The name of the resource. For example, the name of a Docker image -
3355 # "Debian".
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3356 "uri": "A String", # Required. The unique URI of the resource. For example,
3357 # `https://gcr.io/project/image@sha256:foo` for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3358 },
3359 "severity": "A String", # The severity for this count. SEVERITY_UNSPECIFIED indicates total across
3360 # all severities.
3361 "fixableCount": "A String", # The number of fixable vulnerabilities associated with this resource.
3362 },
3363 ],
3364 }</pre>
3365</div>
3366
3367<div class="method">
3368 <code class="details" id="list">list(parent, pageSize=None, pageToken=None, x__xgafv=None, filter=None)</code>
3369 <pre>Lists occurrences for the specified project.
3370
3371Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3372 parent: string, Required. The name of the project to list occurrences for in the form of
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3373`projects/[PROJECT_ID]`. (required)
3374 pageSize: integer, Number of occurrences to return in the list. Must be positive. Max allowed
3375page size is 1000. If not specified, page size defaults to 20.
3376 pageToken: string, Token to provide to skip to a particular spot in the list.
3377 x__xgafv: string, V1 error format.
3378 Allowed values
3379 1 - v1 error format
3380 2 - v2 error format
3381 filter: string, The filter expression.
3382
3383Returns:
3384 An object of the form:
3385
3386 { # Response for listing occurrences.
3387 "nextPageToken": "A String", # The next pagination token in the list response. It should be used as
3388 # `page_token` for the following request. An empty value means no more
3389 # results.
3390 "occurrences": [ # The occurrences requested.
3391 { # An instance of an analysis type that has been found on a resource.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3392 "updateTime": "A String", # Output only. The time this occurrence was last updated.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3393 "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
3394 "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
3395 #
3396 # The hash of the resource content. For example, the Docker digest.
3397 "type": "A String", # Required. The type of hash that was performed.
3398 "value": "A String", # Required. The hash value.
3399 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3400 "name": "A String", # Deprecated, do not use. Use uri instead.
3401 #
3402 # The name of the resource. For example, the name of a Docker image -
3403 # "Debian".
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3404 "uri": "A String", # Required. The unique URI of the resource. For example,
3405 # `https://gcr.io/project/image@sha256:foo` for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3406 },
3407 "name": "A String", # Output only. The name of the occurrence in the form of
3408 # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
3409 "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
3410 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
3411 # scale of 0-10 where 0 indicates low severity and 10 indicates high
3412 # severity.
3413 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
3414 "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
3415 # packages etc)
3416 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
3417 # available, and note provider assigned severity when distro has not yet
3418 # assigned a severity for this vulnerability.
3419 "relatedUrls": [ # Output only. URLs related to this vulnerability.
3420 { # Metadata for any related URL information.
3421 "url": "A String", # Specific URL associated with the resource.
3422 "label": "A String", # Label to describe usage of the URL.
3423 },
3424 ],
3425 "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
3426 # within the associated resource.
3427 { # This message wraps a location affected by a vulnerability and its
3428 # associated fix (if one is available).
3429 "severityName": "A String", # Deprecated, use Details.effective_severity instead
3430 # The severity (e.g., distro assigned severity) for this vulnerability.
3431 "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
3432 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
3433 # format. Examples include distro or storage location for vulnerable jar.
3434 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
3435 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3436 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
3437 # versions.
3438 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
3439 # name.
3440 "revision": "A String", # The iteration of the package build from the above version.
3441 },
3442 "package": "A String", # Required. The package being described.
3443 },
3444 "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
3445 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
3446 # format. Examples include distro or storage location for vulnerable jar.
3447 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
3448 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3449 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
3450 # versions.
3451 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
3452 # name.
3453 "revision": "A String", # The iteration of the package build from the above version.
3454 },
3455 "package": "A String", # Required. The package being described.
3456 },
3457 },
3458 ],
3459 "longDescription": "A String", # Output only. A detailed description of this vulnerability.
3460 "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
3461 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3462 "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
3463 # specified. This field can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3464 "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
3465 "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
3466 "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
3467 # Deprecated, do not use.
3468 "analysisStatus": "A String", # The status of discovery for the resource.
3469 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
3470 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
3471 # details to show to the user. The LocalizedMessage is output only and
3472 # populated by the API.
3473 # different programming environments, including REST APIs and RPC APIs. It is
3474 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
3475 # three pieces of data: error code, error message, and error details.
3476 #
3477 # You can find out more about this error model and how to work with it in the
3478 # [API Design Guide](https://cloud.google.com/apis/design/errors).
3479 "message": "A String", # A developer-facing error message, which should be in English. Any
3480 # user-facing error message should be localized and sent in the
3481 # google.rpc.Status.details field, or localized by the client.
3482 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
3483 "details": [ # A list of messages that carry the error details. There is a common set of
3484 # message types for APIs to use.
3485 {
3486 "a_key": "", # Properties of the object. Contains field @type with type URL.
3487 },
3488 ],
3489 },
3490 },
3491 },
3492 "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
3493 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
3494 # attestation can be verified using the attached signature. If the verifier
3495 # trusts the public key of the signer, then verifying the signature is
3496 # sufficient to establish trust. In this circumstance, the authority to which
3497 # this attestation is attached is primarily useful for look-up (how to find
3498 # this attestation if you already know the authority and artifact to be
3499 # verified) and intent (which authority was this attestation intended to sign
3500 # for).
3501 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
3502 # supports `ATTACHED` signatures, where the payload that is signed is included
3503 # alongside the signature itself in the same file.
3504 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
3505 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
3506 # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
3507 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
3508 # Implementations may choose to acknowledge "LONG", "SHORT", or other
3509 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
3510 # In gpg, the full fingerprint can be retrieved from the `fpr` field
3511 # returned when calling --list-keys with --with-colons. For example:
3512 # ```
3513 # gpg --with-colons --with-fingerprint --force-v4-certs \
3514 # --list-keys attester@example.com
3515 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3516 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3517 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
3518 # ```
3519 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
3520 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
3521 # The verifier must ensure that the provided type is one that the verifier
3522 # supports, and that the attestation payload is a valid instantiation of that
3523 # type (for example by validating a JSON schema).
3524 "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
3525 # (GPG) or equivalent. Since this message only supports attached signatures,
3526 # the payload that was signed must be attached. While the signature format
3527 # supported is dependent on the verification implementation, currently only
3528 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
3529 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
3530 # --output=signature.gpg payload.json` will create the signature content
3531 # expected in this field in `signature.gpg` for the `payload.json`
3532 # attestation payload.
3533 },
3534 "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
3535 # This attestation must define the `serialized_payload` that the `signatures`
3536 # verify and any metadata necessary to interpret that plaintext. The
3537 # signatures should always be over the `serialized_payload` bytestring.
3538 "signatures": [ # One or more signatures over `serialized_payload`. Verifier implementations
3539 # should consider this attestation message verified if at least one
3540 # `signature` verifies `serialized_payload`. See `Signature` in common.proto
3541 # for more details on signature structure and verification.
3542 { # Verifiers (e.g. Kritis implementations) MUST verify signatures
3543 # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
3544 # Typically this means that the verifier has been configured with a map from
3545 # `public_key_id` to public key material (and any required parameters, e.g.
3546 # signing algorithm).
3547 #
3548 # In particular, verification implementations MUST NOT treat the signature
3549 # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
3550 # DOES NOT validate or authenticate a public key; it only provides a mechanism
3551 # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
3552 # a trusted channel. Verification implementations MUST reject signatures in any
3553 # of the following circumstances:
3554 # * The `public_key_id` is not recognized by the verifier.
3555 # * The public key that `public_key_id` refers to does not verify the
3556 # signature with respect to the payload.
3557 #
3558 # The `signature` contents SHOULD NOT be "attached" (where the payload is
3559 # included with the serialized `signature` bytes). Verifiers MUST ignore any
3560 # "attached" payload and only verify signatures with respect to explicitly
3561 # provided payload (e.g. a `payload` field on the proto message that holds
3562 # this Signature, or the canonical serialization of the proto message that
3563 # holds this signature).
3564 "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
3565 # * The `public_key_id` is required.
3566 # * The `public_key_id` MUST be an RFC3986 conformant URI.
3567 # * When possible, the `public_key_id` SHOULD be an immutable reference,
3568 # such as a cryptographic digest.
3569 #
3570 # Examples of valid `public_key_id`s:
3571 #
3572 # OpenPGP V4 public key fingerprint:
3573 # * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
3574 # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
3575 # details on this scheme.
3576 #
3577 # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
3578 # serialization):
3579 # * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
3580 # * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
3581 "signature": "A String", # The content of the signature, an opaque bytestring.
3582 # The payload that this signature verifies MUST be unambiguously provided
3583 # with the Signature during verification. A wrapper message might provide
3584 # the payload explicitly. Alternatively, a message might have a canonical
3585 # serialization that can always be unambiguously computed to derive the
3586 # payload.
3587 },
3588 ],
3589 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
3590 # The verifier must ensure that the provided type is one that the verifier
3591 # supports, and that the attestation payload is a valid instantiation of that
3592 # type (for example by validating a JSON schema).
3593 "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
3594 # The encoding and semantic meaning of this payload must match what is set in
3595 # `content_type`.
3596 },
3597 },
3598 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3599 "intoto": { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
3600 # signatures and the in-toto link itself. This is used for occurrences of a
3601 # Grafeas in-toto note.
3602 "signatures": [
3603 { # A signature object consists of the KeyID used and the signature itself.
3604 "keyid": "A String",
3605 "sig": "A String",
3606 },
3607 ],
3608 "signed": { # This corresponds to an in-toto link.
3609 "environment": { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
3610 # environment. It is suggested for this field to contain information that
3611 # details environment variables, filesystem information, and the present
3612 # working directory. The recommended structure of this field is:
3613 # "environment": {
3614 # "custom_values": {
3615 # "variables": "&lt;ENV&gt;",
3616 # "filesystem": "&lt;FS&gt;",
3617 # "workdir": "&lt;CWD&gt;",
3618 # "&lt;ANY OTHER RELEVANT FIELDS&gt;": "..."
3619 # }
3620 # }
3621 # fields are "variables", "filesystem", and "workdir".
3622 "customValues": {
3623 "a_key": "A String",
3624 },
3625 },
3626 "command": [ # This field contains the full command executed for the step. This can also
3627 # be empty if links are generated for operations that aren't directly mapped
3628 # to a specific command. Each term in the command is an independent string
3629 # in the list. An example of a command in the in-toto metadata field is:
3630 # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
3631 "A String",
3632 ],
3633 "materials": [ # Materials are the supply chain artifacts that go into the step and are used
3634 # for the operation performed. The key of the map is the path of the artifact
3635 # and the structure contains the recorded hash information. An example is:
3636 # "materials": [
3637 # {
3638 # "resource_uri": "foo/bar",
3639 # "hashes": {
3640 # "sha256": "ebebf...",
3641 # &lt;OTHER HASH ALGORITHMS&gt;: &lt;HASH VALUE&gt;
3642 # }
3643 # }
3644 # ]
3645 {
3646 "resourceUri": "A String",
3647 "hashes": { # Defines a hash object for use in Materials and Products.
3648 "sha256": "A String",
3649 },
3650 },
3651 ],
3652 "products": [ # Products are the supply chain artifacts generated as a result of the step.
3653 # The structure is identical to that of materials.
3654 {
3655 "resourceUri": "A String",
3656 "hashes": { # Defines a hash object for use in Materials and Products.
3657 "sha256": "A String",
3658 },
3659 },
3660 ],
3661 "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
3662 # are not the actual result of the step.
3663 # fields are "stderr", "stdout", and "return-value".
3664 "customValues": {
3665 "a_key": "A String",
3666 },
3667 },
3668 },
3669 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3670 "build": { # Details of a build occurrence. # Describes a verifiable build.
3671 "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
3672 # details about the build from source to completion.
3673 "commands": [ # Commands requested by the build.
3674 { # Command describes a step performed as part of the build pipeline.
3675 "waitFor": [ # The ID(s) of the command(s) that this command depends on.
3676 "A String",
3677 ],
3678 "name": "A String", # Required. Name of the command, as presented on the command line, or if the
3679 # command is packaged as a Docker container, as presented to `docker pull`.
3680 "args": [ # Command-line arguments used when executing this command.
3681 "A String",
3682 ],
3683 "env": [ # Environment variables set before running this command.
3684 "A String",
3685 ],
3686 "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
3687 # this command as a dependency.
3688 "dir": "A String", # Working directory (relative to project source root) used when running this
3689 # command.
3690 },
3691 ],
3692 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
3693 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
3694 # source integrity was maintained in the build.
3695 #
3696 # The keys to this map are file paths used as build source and the values
3697 # contain the hash values for those files.
3698 #
3699 # If the build source came in a single package such as a gzipped tarfile
3700 # (.tar.gz), the FileHash will be for the single path to that file.
3701 "a_key": { # Container message for hashes of byte content of files, used in source
3702 # messages to verify integrity of source input to the build.
3703 "fileHash": [ # Required. Collection of file hashes.
3704 { # Container message for hash values.
3705 "type": "A String", # Required. The type of hash that was performed.
3706 "value": "A String", # Required. The hash value.
3707 },
3708 ],
3709 },
3710 },
3711 "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
3712 # location.
3713 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
3714 # these locations, in the case where the source repository had multiple
3715 # remotes or submodules. This list will not include the context specified in
3716 # the context field.
3717 { # A SourceContext is a reference to a tree of files. A SourceContext together
3718 # with a path point to a unique revision of a single file or directory.
3719 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
3720 # repository (e.g., GitHub).
3721 "url": "A String", # Git repository URL.
3722 "revisionId": "A String", # Git commit hash.
3723 },
3724 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
3725 # Source Repo.
3726 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
3727 "kind": "A String", # The alias kind.
3728 "name": "A String", # The alias name.
3729 },
3730 "revisionId": "A String", # A revision ID.
3731 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
3732 "uid": "A String", # A server-assigned, globally unique identifier.
3733 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
3734 # winged-cargo-31) and a repo name within that project.
3735 "projectId": "A String", # The ID of the project.
3736 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
3737 },
3738 },
3739 },
3740 "labels": { # Labels with user defined metadata.
3741 "a_key": "A String",
3742 },
3743 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
3744 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
3745 "kind": "A String", # The alias kind.
3746 "name": "A String", # The alias name.
3747 },
3748 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3749 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
3750 # "project/subproject" is a valid project name. The "repo name" is the
3751 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3752 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3753 },
3754 },
3755 ],
3756 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
3757 # with a path point to a unique revision of a single file or directory.
3758 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
3759 # repository (e.g., GitHub).
3760 "url": "A String", # Git repository URL.
3761 "revisionId": "A String", # Git commit hash.
3762 },
3763 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
3764 # Source Repo.
3765 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
3766 "kind": "A String", # The alias kind.
3767 "name": "A String", # The alias name.
3768 },
3769 "revisionId": "A String", # A revision ID.
3770 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
3771 "uid": "A String", # A server-assigned, globally unique identifier.
3772 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
3773 # winged-cargo-31) and a repo name within that project.
3774 "projectId": "A String", # The ID of the project.
3775 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
3776 },
3777 },
3778 },
3779 "labels": { # Labels with user defined metadata.
3780 "a_key": "A String",
3781 },
3782 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
3783 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
3784 "kind": "A String", # The alias kind.
3785 "name": "A String", # The alias name.
3786 },
3787 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3788 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
3789 # "project/subproject" is a valid project name. The "repo name" is the
3790 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3791 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3792 },
3793 },
3794 },
3795 "buildOptions": { # Special options applied to this build. This is a catch-all field where
3796 # build providers can enter any desired additional details.
3797 "a_key": "A String",
3798 },
3799 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
3800 # user's e-mail address at the time the build was initiated; this address may
3801 # not represent the same end-user for all time.
3802 "projectId": "A String", # ID of the project.
3803 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
3804 "createTime": "A String", # Time at which the build was created.
3805 "builtArtifacts": [ # Output of the build.
3806 { # Artifact describes a build product.
3807 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
3808 # container.
3809 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
3810 # like `gcr.io/projectID/imagename@sha256:123456`.
3811 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
3812 # the case of a container build, the name used to push the container image to
3813 # Google Container Registry, as presented to `docker push`. Note that a
3814 # single Artifact ID can have multiple names, for example if two tags are
3815 # applied to one image.
3816 "A String",
3817 ],
3818 },
3819 ],
3820 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
3821 "startTime": "A String", # Time at which execution of the build was started.
3822 "endTime": "A String", # Time at which execution of the build was finished.
3823 "id": "A String", # Required. Unique identifier of the build.
3824 "logsUri": "A String", # URI where any logs for this provenance were written.
3825 },
3826 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
3827 # build signature in the corresponding build note. After verifying the
3828 # signature, `provenance_bytes` can be unmarshalled and compared to the
3829 # provenance to confirm that it is unchanged. A base64-encoded string
3830 # representation of the provenance bytes is used for the signature in order
3831 # to interoperate with openssl which expects this format for signature
3832 # verification.
3833 #
3834 # The serialized form is captured both to avoid ambiguity in how the
3835 # provenance is marshalled to json as well to prevent incompatibilities with
3836 # future changes.
3837 },
3838 "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
3839 "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
3840 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
3841 # the deployable field with the same name.
3842 "A String",
3843 ],
3844 "userEmail": "A String", # Identity of the user that triggered this deployment.
3845 "address": "A String", # Address of the runtime element hosting this deployment.
3846 "platform": "A String", # Platform hosting this deployment.
3847 "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
3848 "undeployTime": "A String", # End of the lifetime of this deployment.
3849 "config": "A String", # Configuration used to create this deployment.
3850 },
3851 },
3852 "remediation": "A String", # A description of actions that can be taken to remedy the note.
3853 "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
3854 "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
3855 # system.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3856 "name": "A String", # Output only. The name of the installed package.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3857 "location": [ # Required. All of the places within the filesystem versions of this package
3858 # have been found.
3859 { # An occurrence of a particular package installation found within a system's
3860 # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
3861 "path": "A String", # The path from which we gathered that this package/version is installed.
3862 "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
3863 # denoting the package manager version distributing a package.
3864 "version": { # Version contains structured information about the version of a package. # The version installed at this location.
3865 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3866 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
3867 # versions.
3868 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
3869 # name.
3870 "revision": "A String", # The iteration of the package build from the above version.
3871 },
3872 },
3873 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3874 },
3875 },
3876 "createTime": "A String", # Output only. The time this occurrence was created.
3877 "derivedImage": { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
3878 # note.
3879 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
3880 # relationship. This image would be produced from a Dockerfile with FROM
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3881 # &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3882 "distance": 42, # Output only. The number of layers by which this image differs from the
3883 # associated image basis.
3884 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
3885 # occurrence.
3886 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
3887 # "distance" and is ordered with [distance] being the layer immediately
3888 # following the base image and [1] being the final layer.
3889 { # Layer holds metadata specific to a layer of a Docker image.
3890 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
3891 "directive": "A String", # Required. The recovered Dockerfile directive used to construct this layer.
3892 },
3893 ],
3894 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
3895 "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
3896 # representation.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3897 "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
3898 "A String",
3899 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3900 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
3901 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
3902 # Only the name of the final blob is kept.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3903 },
3904 },
3905 },
3906 "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
3907 # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
3908 # used as a filter in list requests.
3909 },
3910 ],
3911 }</pre>
3912</div>
3913
3914<div class="method">
3915 <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
3916 <pre>Retrieves the next page of results.
3917
3918Args:
3919 previous_request: The request for the previous page. (required)
3920 previous_response: The response from the request for the previous page. (required)
3921
3922Returns:
3923 A request object that you can call 'execute()' on to request the next
3924 page. Returns None if there are no more items in the collection.
3925 </pre>
3926</div>
3927
3928<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3929 <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3930 <pre>Updates the specified occurrence.
3931
3932Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3933 name: string, Required. The name of the occurrence in the form of
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3934`projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3935 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3936 The object takes the form of:
3937
3938{ # An instance of an analysis type that has been found on a resource.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3939 "updateTime": "A String", # Output only. The time this occurrence was last updated.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3940 "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
3941 "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
3942 #
3943 # The hash of the resource content. For example, the Docker digest.
3944 "type": "A String", # Required. The type of hash that was performed.
3945 "value": "A String", # Required. The hash value.
3946 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3947 "name": "A String", # Deprecated, do not use. Use uri instead.
3948 #
3949 # The name of the resource. For example, the name of a Docker image -
3950 # "Debian".
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]3951 "uri": "A String", # Required. The unique URI of the resource. For example,
3952 # `https://gcr.io/project/image@sha256:foo` for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3953 },
3954 "name": "A String", # Output only. The name of the occurrence in the form of
3955 # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
3956 "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
3957 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
3958 # scale of 0-10 where 0 indicates low severity and 10 indicates high
3959 # severity.
3960 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
3961 "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
3962 # packages etc)
3963 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
3964 # available, and note provider assigned severity when distro has not yet
3965 # assigned a severity for this vulnerability.
3966 "relatedUrls": [ # Output only. URLs related to this vulnerability.
3967 { # Metadata for any related URL information.
3968 "url": "A String", # Specific URL associated with the resource.
3969 "label": "A String", # Label to describe usage of the URL.
3970 },
3971 ],
3972 "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
3973 # within the associated resource.
3974 { # This message wraps a location affected by a vulnerability and its
3975 # associated fix (if one is available).
3976 "severityName": "A String", # Deprecated, use Details.effective_severity instead
3977 # The severity (e.g., distro assigned severity) for this vulnerability.
3978 "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
3979 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
3980 # format. Examples include distro or storage location for vulnerable jar.
3981 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
3982 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3983 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
3984 # versions.
3985 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
3986 # name.
3987 "revision": "A String", # The iteration of the package build from the above version.
3988 },
3989 "package": "A String", # Required. The package being described.
3990 },
3991 "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
3992 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
3993 # format. Examples include distro or storage location for vulnerable jar.
3994 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
3995 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
3996 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
3997 # versions.
3998 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
3999 # name.
4000 "revision": "A String", # The iteration of the package build from the above version.
4001 },
4002 "package": "A String", # Required. The package being described.
4003 },
4004 },
4005 ],
4006 "longDescription": "A String", # Output only. A detailed description of this vulnerability.
4007 "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
4008 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4009 "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
4010 # specified. This field can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4011 "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
4012 "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
4013 "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
4014 # Deprecated, do not use.
4015 "analysisStatus": "A String", # The status of discovery for the resource.
4016 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
4017 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
4018 # details to show to the user. The LocalizedMessage is output only and
4019 # populated by the API.
4020 # different programming environments, including REST APIs and RPC APIs. It is
4021 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
4022 # three pieces of data: error code, error message, and error details.
4023 #
4024 # You can find out more about this error model and how to work with it in the
4025 # [API Design Guide](https://cloud.google.com/apis/design/errors).
4026 "message": "A String", # A developer-facing error message, which should be in English. Any
4027 # user-facing error message should be localized and sent in the
4028 # google.rpc.Status.details field, or localized by the client.
4029 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
4030 "details": [ # A list of messages that carry the error details. There is a common set of
4031 # message types for APIs to use.
4032 {
4033 "a_key": "", # Properties of the object. Contains field @type with type URL.
4034 },
4035 ],
4036 },
4037 },
4038 },
4039 "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
4040 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
4041 # attestation can be verified using the attached signature. If the verifier
4042 # trusts the public key of the signer, then verifying the signature is
4043 # sufficient to establish trust. In this circumstance, the authority to which
4044 # this attestation is attached is primarily useful for look-up (how to find
4045 # this attestation if you already know the authority and artifact to be
4046 # verified) and intent (which authority was this attestation intended to sign
4047 # for).
4048 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
4049 # supports `ATTACHED` signatures, where the payload that is signed is included
4050 # alongside the signature itself in the same file.
4051 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
4052 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
4053 # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
4054 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
4055 # Implementations may choose to acknowledge "LONG", "SHORT", or other
4056 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
4057 # In gpg, the full fingerprint can be retrieved from the `fpr` field
4058 # returned when calling --list-keys with --with-colons. For example:
4059 # ```
4060 # gpg --with-colons --with-fingerprint --force-v4-certs \
4061 # --list-keys attester@example.com
4062 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4063 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4064 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
4065 # ```
4066 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
4067 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
4068 # The verifier must ensure that the provided type is one that the verifier
4069 # supports, and that the attestation payload is a valid instantiation of that
4070 # type (for example by validating a JSON schema).
4071 "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
4072 # (GPG) or equivalent. Since this message only supports attached signatures,
4073 # the payload that was signed must be attached. While the signature format
4074 # supported is dependent on the verification implementation, currently only
4075 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
4076 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
4077 # --output=signature.gpg payload.json` will create the signature content
4078 # expected in this field in `signature.gpg` for the `payload.json`
4079 # attestation payload.
4080 },
4081 "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
4082 # This attestation must define the `serialized_payload` that the `signatures`
4083 # verify and any metadata necessary to interpret that plaintext. The
4084 # signatures should always be over the `serialized_payload` bytestring.
4085 "signatures": [ # One or more signatures over `serialized_payload`. Verifier implementations
4086 # should consider this attestation message verified if at least one
4087 # `signature` verifies `serialized_payload`. See `Signature` in common.proto
4088 # for more details on signature structure and verification.
4089 { # Verifiers (e.g. Kritis implementations) MUST verify signatures
4090 # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
4091 # Typically this means that the verifier has been configured with a map from
4092 # `public_key_id` to public key material (and any required parameters, e.g.
4093 # signing algorithm).
4094 #
4095 # In particular, verification implementations MUST NOT treat the signature
4096 # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
4097 # DOES NOT validate or authenticate a public key; it only provides a mechanism
4098 # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
4099 # a trusted channel. Verification implementations MUST reject signatures in any
4100 # of the following circumstances:
4101 # * The `public_key_id` is not recognized by the verifier.
4102 # * The public key that `public_key_id` refers to does not verify the
4103 # signature with respect to the payload.
4104 #
4105 # The `signature` contents SHOULD NOT be "attached" (where the payload is
4106 # included with the serialized `signature` bytes). Verifiers MUST ignore any
4107 # "attached" payload and only verify signatures with respect to explicitly
4108 # provided payload (e.g. a `payload` field on the proto message that holds
4109 # this Signature, or the canonical serialization of the proto message that
4110 # holds this signature).
4111 "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
4112 # * The `public_key_id` is required.
4113 # * The `public_key_id` MUST be an RFC3986 conformant URI.
4114 # * When possible, the `public_key_id` SHOULD be an immutable reference,
4115 # such as a cryptographic digest.
4116 #
4117 # Examples of valid `public_key_id`s:
4118 #
4119 # OpenPGP V4 public key fingerprint:
4120 # * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
4121 # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
4122 # details on this scheme.
4123 #
4124 # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
4125 # serialization):
4126 # * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
4127 # * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
4128 "signature": "A String", # The content of the signature, an opaque bytestring.
4129 # The payload that this signature verifies MUST be unambiguously provided
4130 # with the Signature during verification. A wrapper message might provide
4131 # the payload explicitly. Alternatively, a message might have a canonical
4132 # serialization that can always be unambiguously computed to derive the
4133 # payload.
4134 },
4135 ],
4136 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
4137 # The verifier must ensure that the provided type is one that the verifier
4138 # supports, and that the attestation payload is a valid instantiation of that
4139 # type (for example by validating a JSON schema).
4140 "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
4141 # The encoding and semantic meaning of this payload must match what is set in
4142 # `content_type`.
4143 },
4144 },
4145 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4146 "intoto": { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
4147 # signatures and the in-toto link itself. This is used for occurrences of a
4148 # Grafeas in-toto note.
4149 "signatures": [
4150 { # A signature object consists of the KeyID used and the signature itself.
4151 "keyid": "A String",
4152 "sig": "A String",
4153 },
4154 ],
4155 "signed": { # This corresponds to an in-toto link.
4156 "environment": { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
4157 # environment. It is suggested for this field to contain information that
4158 # details environment variables, filesystem information, and the present
4159 # working directory. The recommended structure of this field is:
4160 # "environment": {
4161 # "custom_values": {
4162 # "variables": "&lt;ENV&gt;",
4163 # "filesystem": "&lt;FS&gt;",
4164 # "workdir": "&lt;CWD&gt;",
4165 # "&lt;ANY OTHER RELEVANT FIELDS&gt;": "..."
4166 # }
4167 # }
4168 # fields are "variables", "filesystem", and "workdir".
4169 "customValues": {
4170 "a_key": "A String",
4171 },
4172 },
4173 "command": [ # This field contains the full command executed for the step. This can also
4174 # be empty if links are generated for operations that aren't directly mapped
4175 # to a specific command. Each term in the command is an independent string
4176 # in the list. An example of a command in the in-toto metadata field is:
4177 # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
4178 "A String",
4179 ],
4180 "materials": [ # Materials are the supply chain artifacts that go into the step and are used
4181 # for the operation performed. The key of the map is the path of the artifact
4182 # and the structure contains the recorded hash information. An example is:
4183 # "materials": [
4184 # {
4185 # "resource_uri": "foo/bar",
4186 # "hashes": {
4187 # "sha256": "ebebf...",
4188 # &lt;OTHER HASH ALGORITHMS&gt;: &lt;HASH VALUE&gt;
4189 # }
4190 # }
4191 # ]
4192 {
4193 "resourceUri": "A String",
4194 "hashes": { # Defines a hash object for use in Materials and Products.
4195 "sha256": "A String",
4196 },
4197 },
4198 ],
4199 "products": [ # Products are the supply chain artifacts generated as a result of the step.
4200 # The structure is identical to that of materials.
4201 {
4202 "resourceUri": "A String",
4203 "hashes": { # Defines a hash object for use in Materials and Products.
4204 "sha256": "A String",
4205 },
4206 },
4207 ],
4208 "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
4209 # are not the actual result of the step.
4210 # fields are "stderr", "stdout", and "return-value".
4211 "customValues": {
4212 "a_key": "A String",
4213 },
4214 },
4215 },
4216 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4217 "build": { # Details of a build occurrence. # Describes a verifiable build.
4218 "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
4219 # details about the build from source to completion.
4220 "commands": [ # Commands requested by the build.
4221 { # Command describes a step performed as part of the build pipeline.
4222 "waitFor": [ # The ID(s) of the command(s) that this command depends on.
4223 "A String",
4224 ],
4225 "name": "A String", # Required. Name of the command, as presented on the command line, or if the
4226 # command is packaged as a Docker container, as presented to `docker pull`.
4227 "args": [ # Command-line arguments used when executing this command.
4228 "A String",
4229 ],
4230 "env": [ # Environment variables set before running this command.
4231 "A String",
4232 ],
4233 "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
4234 # this command as a dependency.
4235 "dir": "A String", # Working directory (relative to project source root) used when running this
4236 # command.
4237 },
4238 ],
4239 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
4240 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
4241 # source integrity was maintained in the build.
4242 #
4243 # The keys to this map are file paths used as build source and the values
4244 # contain the hash values for those files.
4245 #
4246 # If the build source came in a single package such as a gzipped tarfile
4247 # (.tar.gz), the FileHash will be for the single path to that file.
4248 "a_key": { # Container message for hashes of byte content of files, used in source
4249 # messages to verify integrity of source input to the build.
4250 "fileHash": [ # Required. Collection of file hashes.
4251 { # Container message for hash values.
4252 "type": "A String", # Required. The type of hash that was performed.
4253 "value": "A String", # Required. The hash value.
4254 },
4255 ],
4256 },
4257 },
4258 "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
4259 # location.
4260 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
4261 # these locations, in the case where the source repository had multiple
4262 # remotes or submodules. This list will not include the context specified in
4263 # the context field.
4264 { # A SourceContext is a reference to a tree of files. A SourceContext together
4265 # with a path point to a unique revision of a single file or directory.
4266 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
4267 # repository (e.g., GitHub).
4268 "url": "A String", # Git repository URL.
4269 "revisionId": "A String", # Git commit hash.
4270 },
4271 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
4272 # Source Repo.
4273 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
4274 "kind": "A String", # The alias kind.
4275 "name": "A String", # The alias name.
4276 },
4277 "revisionId": "A String", # A revision ID.
4278 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
4279 "uid": "A String", # A server-assigned, globally unique identifier.
4280 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
4281 # winged-cargo-31) and a repo name within that project.
4282 "projectId": "A String", # The ID of the project.
4283 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
4284 },
4285 },
4286 },
4287 "labels": { # Labels with user defined metadata.
4288 "a_key": "A String",
4289 },
4290 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
4291 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
4292 "kind": "A String", # The alias kind.
4293 "name": "A String", # The alias name.
4294 },
4295 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4296 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
4297 # "project/subproject" is a valid project name. The "repo name" is the
4298 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4299 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4300 },
4301 },
4302 ],
4303 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
4304 # with a path point to a unique revision of a single file or directory.
4305 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
4306 # repository (e.g., GitHub).
4307 "url": "A String", # Git repository URL.
4308 "revisionId": "A String", # Git commit hash.
4309 },
4310 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
4311 # Source Repo.
4312 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
4313 "kind": "A String", # The alias kind.
4314 "name": "A String", # The alias name.
4315 },
4316 "revisionId": "A String", # A revision ID.
4317 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
4318 "uid": "A String", # A server-assigned, globally unique identifier.
4319 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
4320 # winged-cargo-31) and a repo name within that project.
4321 "projectId": "A String", # The ID of the project.
4322 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
4323 },
4324 },
4325 },
4326 "labels": { # Labels with user defined metadata.
4327 "a_key": "A String",
4328 },
4329 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
4330 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
4331 "kind": "A String", # The alias kind.
4332 "name": "A String", # The alias name.
4333 },
4334 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4335 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
4336 # "project/subproject" is a valid project name. The "repo name" is the
4337 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4338 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4339 },
4340 },
4341 },
4342 "buildOptions": { # Special options applied to this build. This is a catch-all field where
4343 # build providers can enter any desired additional details.
4344 "a_key": "A String",
4345 },
4346 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
4347 # user's e-mail address at the time the build was initiated; this address may
4348 # not represent the same end-user for all time.
4349 "projectId": "A String", # ID of the project.
4350 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
4351 "createTime": "A String", # Time at which the build was created.
4352 "builtArtifacts": [ # Output of the build.
4353 { # Artifact describes a build product.
4354 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
4355 # container.
4356 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
4357 # like `gcr.io/projectID/imagename@sha256:123456`.
4358 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
4359 # the case of a container build, the name used to push the container image to
4360 # Google Container Registry, as presented to `docker push`. Note that a
4361 # single Artifact ID can have multiple names, for example if two tags are
4362 # applied to one image.
4363 "A String",
4364 ],
4365 },
4366 ],
4367 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
4368 "startTime": "A String", # Time at which execution of the build was started.
4369 "endTime": "A String", # Time at which execution of the build was finished.
4370 "id": "A String", # Required. Unique identifier of the build.
4371 "logsUri": "A String", # URI where any logs for this provenance were written.
4372 },
4373 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
4374 # build signature in the corresponding build note. After verifying the
4375 # signature, `provenance_bytes` can be unmarshalled and compared to the
4376 # provenance to confirm that it is unchanged. A base64-encoded string
4377 # representation of the provenance bytes is used for the signature in order
4378 # to interoperate with openssl which expects this format for signature
4379 # verification.
4380 #
4381 # The serialized form is captured both to avoid ambiguity in how the
4382 # provenance is marshalled to json as well to prevent incompatibilities with
4383 # future changes.
4384 },
4385 "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
4386 "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
4387 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
4388 # the deployable field with the same name.
4389 "A String",
4390 ],
4391 "userEmail": "A String", # Identity of the user that triggered this deployment.
4392 "address": "A String", # Address of the runtime element hosting this deployment.
4393 "platform": "A String", # Platform hosting this deployment.
4394 "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
4395 "undeployTime": "A String", # End of the lifetime of this deployment.
4396 "config": "A String", # Configuration used to create this deployment.
4397 },
4398 },
4399 "remediation": "A String", # A description of actions that can be taken to remedy the note.
4400 "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
4401 "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
4402 # system.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4403 "name": "A String", # Output only. The name of the installed package.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4404 "location": [ # Required. All of the places within the filesystem versions of this package
4405 # have been found.
4406 { # An occurrence of a particular package installation found within a system's
4407 # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
4408 "path": "A String", # The path from which we gathered that this package/version is installed.
4409 "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
4410 # denoting the package manager version distributing a package.
4411 "version": { # Version contains structured information about the version of a package. # The version installed at this location.
4412 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
4413 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
4414 # versions.
4415 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
4416 # name.
4417 "revision": "A String", # The iteration of the package build from the above version.
4418 },
4419 },
4420 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4421 },
4422 },
4423 "createTime": "A String", # Output only. The time this occurrence was created.
4424 "derivedImage": { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
4425 # note.
4426 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
4427 # relationship. This image would be produced from a Dockerfile with FROM
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4428 # &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4429 "distance": 42, # Output only. The number of layers by which this image differs from the
4430 # associated image basis.
4431 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
4432 # occurrence.
4433 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
4434 # "distance" and is ordered with [distance] being the layer immediately
4435 # following the base image and [1] being the final layer.
4436 { # Layer holds metadata specific to a layer of a Docker image.
4437 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
4438 "directive": "A String", # Required. The recovered Dockerfile directive used to construct this layer.
4439 },
4440 ],
4441 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
4442 "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
4443 # representation.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4444 "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
4445 "A String",
4446 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4447 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
4448 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
4449 # Only the name of the final blob is kept.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4450 },
4451 },
4452 },
4453 "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
4454 # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
4455 # used as a filter in list requests.
4456}
4457
4458 updateMask: string, The fields to update.
4459 x__xgafv: string, V1 error format.
4460 Allowed values
4461 1 - v1 error format
4462 2 - v2 error format
4463
4464Returns:
4465 An object of the form:
4466
4467 { # An instance of an analysis type that has been found on a resource.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4468 "updateTime": "A String", # Output only. The time this occurrence was last updated.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4469 "resource": { # An entity that can have metadata. For example, a Docker image. # Required. Immutable. The resource for which the occurrence applies.
4470 "contentHash": { # Container message for hash values. # Deprecated, do not use. Use uri instead.
4471 #
4472 # The hash of the resource content. For example, the Docker digest.
4473 "type": "A String", # Required. The type of hash that was performed.
4474 "value": "A String", # Required. The hash value.
4475 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4476 "name": "A String", # Deprecated, do not use. Use uri instead.
4477 #
4478 # The name of the resource. For example, the name of a Docker image -
4479 # "Debian".
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4480 "uri": "A String", # Required. The unique URI of the resource. For example,
4481 # `https://gcr.io/project/image@sha256:foo` for a Docker image.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4482 },
4483 "name": "A String", # Output only. The name of the occurrence in the form of
4484 # `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
4485 "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
4486 "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a
4487 # scale of 0-10 where 0 indicates low severity and 10 indicates high
4488 # severity.
4489 "severity": "A String", # Output only. The note provider assigned Severity of the vulnerability.
4490 "type": "A String", # The type of package; whether native or non native(ruby gems, node.js
4491 # packages etc)
4492 "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is
4493 # available, and note provider assigned severity when distro has not yet
4494 # assigned a severity for this vulnerability.
4495 "relatedUrls": [ # Output only. URLs related to this vulnerability.
4496 { # Metadata for any related URL information.
4497 "url": "A String", # Specific URL associated with the resource.
4498 "label": "A String", # Label to describe usage of the URL.
4499 },
4500 ],
4501 "packageIssue": [ # Required. The set of affected locations and their fixes (if available)
4502 # within the associated resource.
4503 { # This message wraps a location affected by a vulnerability and its
4504 # associated fix (if one is available).
4505 "severityName": "A String", # Deprecated, use Details.effective_severity instead
4506 # The severity (e.g., distro assigned severity) for this vulnerability.
4507 "affectedLocation": { # The location of the vulnerability. # Required. The location of the vulnerability.
4508 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
4509 # format. Examples include distro or storage location for vulnerable jar.
4510 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
4511 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
4512 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
4513 # versions.
4514 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
4515 # name.
4516 "revision": "A String", # The iteration of the package build from the above version.
4517 },
4518 "package": "A String", # Required. The package being described.
4519 },
4520 "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
4521 "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/)
4522 # format. Examples include distro or storage location for vulnerable jar.
4523 "version": { # Version contains structured information about the version of a package. # Required. The version of the package being described.
4524 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
4525 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
4526 # versions.
4527 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
4528 # name.
4529 "revision": "A String", # The iteration of the package build from the above version.
4530 },
4531 "package": "A String", # Required. The package being described.
4532 },
4533 },
4534 ],
4535 "longDescription": "A String", # Output only. A detailed description of this vulnerability.
4536 "shortDescription": "A String", # Output only. A one sentence description of this vulnerability.
4537 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4538 "kind": "A String", # Output only. This explicitly denotes which of the occurrence details are
4539 # specified. This field can be used as a filter in list requests.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4540 "discovered": { # Details of a discovery occurrence. # Describes when a resource was discovered.
4541 "discovered": { # Provides information about the analysis status of a discovered resource. # Required. Analysis status for the discovered resource.
4542 "lastAnalysisTime": "A String", # The last time continuous analysis was done for this resource.
4543 # Deprecated, do not use.
4544 "analysisStatus": "A String", # The status of discovery for the resource.
4545 "continuousAnalysis": "A String", # Whether the resource is continuously analyzed.
4546 "analysisStatusError": { # The `Status` type defines a logical error model that is suitable for # When an error is encountered this will contain a LocalizedMessage under
4547 # details to show to the user. The LocalizedMessage is output only and
4548 # populated by the API.
4549 # different programming environments, including REST APIs and RPC APIs. It is
4550 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
4551 # three pieces of data: error code, error message, and error details.
4552 #
4553 # You can find out more about this error model and how to work with it in the
4554 # [API Design Guide](https://cloud.google.com/apis/design/errors).
4555 "message": "A String", # A developer-facing error message, which should be in English. Any
4556 # user-facing error message should be localized and sent in the
4557 # google.rpc.Status.details field, or localized by the client.
4558 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
4559 "details": [ # A list of messages that carry the error details. There is a common set of
4560 # message types for APIs to use.
4561 {
4562 "a_key": "", # Properties of the object. Contains field @type with type URL.
4563 },
4564 ],
4565 },
4566 },
4567 },
4568 "attestation": { # Details of an attestation occurrence. # Describes an attestation of an artifact.
4569 "attestation": { # Occurrence that represents a single "attestation". The authenticity of an # Required. Attestation for the resource.
4570 # attestation can be verified using the attached signature. If the verifier
4571 # trusts the public key of the signer, then verifying the signature is
4572 # sufficient to establish trust. In this circumstance, the authority to which
4573 # this attestation is attached is primarily useful for look-up (how to find
4574 # this attestation if you already know the authority and artifact to be
4575 # verified) and intent (which authority was this attestation intended to sign
4576 # for).
4577 "pgpSignedAttestation": { # An attestation wrapper with a PGP-compatible signature. This message only # A PGP signed attestation.
4578 # supports `ATTACHED` signatures, where the payload that is signed is included
4579 # alongside the signature itself in the same file.
4580 "pgpKeyId": "A String", # The cryptographic fingerprint of the key used to generate the signature,
4581 # as output by, e.g. `gpg --list-keys`. This should be the version 4, full
4582 # 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
4583 # https://tools.ietf.org/html/rfc4880#section-12.2 for details.
4584 # Implementations may choose to acknowledge "LONG", "SHORT", or other
4585 # abbreviated key IDs, but only the full fingerprint is guaranteed to work.
4586 # In gpg, the full fingerprint can be retrieved from the `fpr` field
4587 # returned when calling --list-keys with --with-colons. For example:
4588 # ```
4589 # gpg --with-colons --with-fingerprint --force-v4-certs \
4590 # --list-keys attester@example.com
4591 # tru::1:1513631572:0:3:1:5
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4592 # pub:...&lt;SNIP&gt;...
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4593 # fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
4594 # ```
4595 # Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
4596 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
4597 # The verifier must ensure that the provided type is one that the verifier
4598 # supports, and that the attestation payload is a valid instantiation of that
4599 # type (for example by validating a JSON schema).
4600 "signature": "A String", # Required. The raw content of the signature, as output by GNU Privacy Guard
4601 # (GPG) or equivalent. Since this message only supports attached signatures,
4602 # the payload that was signed must be attached. While the signature format
4603 # supported is dependent on the verification implementation, currently only
4604 # ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
4605 # `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
4606 # --output=signature.gpg payload.json` will create the signature content
4607 # expected in this field in `signature.gpg` for the `payload.json`
4608 # attestation payload.
4609 },
4610 "genericSignedAttestation": { # An attestation wrapper that uses the Grafeas `Signature` message.
4611 # This attestation must define the `serialized_payload` that the `signatures`
4612 # verify and any metadata necessary to interpret that plaintext. The
4613 # signatures should always be over the `serialized_payload` bytestring.
4614 "signatures": [ # One or more signatures over `serialized_payload`. Verifier implementations
4615 # should consider this attestation message verified if at least one
4616 # `signature` verifies `serialized_payload`. See `Signature` in common.proto
4617 # for more details on signature structure and verification.
4618 { # Verifiers (e.g. Kritis implementations) MUST verify signatures
4619 # with respect to the trust anchors defined in policy (e.g. a Kritis policy).
4620 # Typically this means that the verifier has been configured with a map from
4621 # `public_key_id` to public key material (and any required parameters, e.g.
4622 # signing algorithm).
4623 #
4624 # In particular, verification implementations MUST NOT treat the signature
4625 # `public_key_id` as anything more than a key lookup hint. The `public_key_id`
4626 # DOES NOT validate or authenticate a public key; it only provides a mechanism
4627 # for quickly selecting a public key ALREADY CONFIGURED on the verifier through
4628 # a trusted channel. Verification implementations MUST reject signatures in any
4629 # of the following circumstances:
4630 # * The `public_key_id` is not recognized by the verifier.
4631 # * The public key that `public_key_id` refers to does not verify the
4632 # signature with respect to the payload.
4633 #
4634 # The `signature` contents SHOULD NOT be "attached" (where the payload is
4635 # included with the serialized `signature` bytes). Verifiers MUST ignore any
4636 # "attached" payload and only verify signatures with respect to explicitly
4637 # provided payload (e.g. a `payload` field on the proto message that holds
4638 # this Signature, or the canonical serialization of the proto message that
4639 # holds this signature).
4640 "publicKeyId": "A String", # The identifier for the public key that verifies this signature.
4641 # * The `public_key_id` is required.
4642 # * The `public_key_id` MUST be an RFC3986 conformant URI.
4643 # * When possible, the `public_key_id` SHOULD be an immutable reference,
4644 # such as a cryptographic digest.
4645 #
4646 # Examples of valid `public_key_id`s:
4647 #
4648 # OpenPGP V4 public key fingerprint:
4649 # * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA"
4650 # See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more
4651 # details on this scheme.
4652 #
4653 # RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER
4654 # serialization):
4655 # * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU"
4656 # * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
4657 "signature": "A String", # The content of the signature, an opaque bytestring.
4658 # The payload that this signature verifies MUST be unambiguously provided
4659 # with the Signature during verification. A wrapper message might provide
4660 # the payload explicitly. Alternatively, a message might have a canonical
4661 # serialization that can always be unambiguously computed to derive the
4662 # payload.
4663 },
4664 ],
4665 "contentType": "A String", # Type (for example schema) of the attestation payload that was signed.
4666 # The verifier must ensure that the provided type is one that the verifier
4667 # supports, and that the attestation payload is a valid instantiation of that
4668 # type (for example by validating a JSON schema).
4669 "serializedPayload": "A String", # The serialized payload that is verified by one or more `signatures`.
4670 # The encoding and semantic meaning of this payload must match what is set in
4671 # `content_type`.
4672 },
4673 },
4674 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4675 "intoto": { # This corresponds to a signed in-toto link - it is made up of one or more # Describes a specific in-toto link.
4676 # signatures and the in-toto link itself. This is used for occurrences of a
4677 # Grafeas in-toto note.
4678 "signatures": [
4679 { # A signature object consists of the KeyID used and the signature itself.
4680 "keyid": "A String",
4681 "sig": "A String",
4682 },
4683 ],
4684 "signed": { # This corresponds to an in-toto link.
4685 "environment": { # Defines an object for the environment field in in-toto links. The suggested # This is a field that can be used to capture information about the
4686 # environment. It is suggested for this field to contain information that
4687 # details environment variables, filesystem information, and the present
4688 # working directory. The recommended structure of this field is:
4689 # "environment": {
4690 # "custom_values": {
4691 # "variables": "&lt;ENV&gt;",
4692 # "filesystem": "&lt;FS&gt;",
4693 # "workdir": "&lt;CWD&gt;",
4694 # "&lt;ANY OTHER RELEVANT FIELDS&gt;": "..."
4695 # }
4696 # }
4697 # fields are "variables", "filesystem", and "workdir".
4698 "customValues": {
4699 "a_key": "A String",
4700 },
4701 },
4702 "command": [ # This field contains the full command executed for the step. This can also
4703 # be empty if links are generated for operations that aren't directly mapped
4704 # to a specific command. Each term in the command is an independent string
4705 # in the list. An example of a command in the in-toto metadata field is:
4706 # "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
4707 "A String",
4708 ],
4709 "materials": [ # Materials are the supply chain artifacts that go into the step and are used
4710 # for the operation performed. The key of the map is the path of the artifact
4711 # and the structure contains the recorded hash information. An example is:
4712 # "materials": [
4713 # {
4714 # "resource_uri": "foo/bar",
4715 # "hashes": {
4716 # "sha256": "ebebf...",
4717 # &lt;OTHER HASH ALGORITHMS&gt;: &lt;HASH VALUE&gt;
4718 # }
4719 # }
4720 # ]
4721 {
4722 "resourceUri": "A String",
4723 "hashes": { # Defines a hash object for use in Materials and Products.
4724 "sha256": "A String",
4725 },
4726 },
4727 ],
4728 "products": [ # Products are the supply chain artifacts generated as a result of the step.
4729 # The structure is identical to that of materials.
4730 {
4731 "resourceUri": "A String",
4732 "hashes": { # Defines a hash object for use in Materials and Products.
4733 "sha256": "A String",
4734 },
4735 },
4736 ],
4737 "byproducts": { # Defines an object for the byproducts field in in-toto links. The suggested # ByProducts are data generated as part of a software supply chain step, but
4738 # are not the actual result of the step.
4739 # fields are "stderr", "stdout", and "return-value".
4740 "customValues": {
4741 "a_key": "A String",
4742 },
4743 },
4744 },
4745 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4746 "build": { # Details of a build occurrence. # Describes a verifiable build.
4747 "provenance": { # Provenance of a build. Contains all information needed to verify the full # Required. The actual provenance for the build.
4748 # details about the build from source to completion.
4749 "commands": [ # Commands requested by the build.
4750 { # Command describes a step performed as part of the build pipeline.
4751 "waitFor": [ # The ID(s) of the command(s) that this command depends on.
4752 "A String",
4753 ],
4754 "name": "A String", # Required. Name of the command, as presented on the command line, or if the
4755 # command is packaged as a Docker container, as presented to `docker pull`.
4756 "args": [ # Command-line arguments used when executing this command.
4757 "A String",
4758 ],
4759 "env": [ # Environment variables set before running this command.
4760 "A String",
4761 ],
4762 "id": "A String", # Optional unique identifier for this command, used in wait_for to reference
4763 # this command as a dependency.
4764 "dir": "A String", # Working directory (relative to project source root) used when running this
4765 # command.
4766 },
4767 ],
4768 "sourceProvenance": { # Source describes the location of the source used for the build. # Details of the Source input to the build.
4769 "fileHashes": { # Hash(es) of the build source, which can be used to verify that the original
4770 # source integrity was maintained in the build.
4771 #
4772 # The keys to this map are file paths used as build source and the values
4773 # contain the hash values for those files.
4774 #
4775 # If the build source came in a single package such as a gzipped tarfile
4776 # (.tar.gz), the FileHash will be for the single path to that file.
4777 "a_key": { # Container message for hashes of byte content of files, used in source
4778 # messages to verify integrity of source input to the build.
4779 "fileHash": [ # Required. Collection of file hashes.
4780 { # Container message for hash values.
4781 "type": "A String", # Required. The type of hash that was performed.
4782 "value": "A String", # Required. The hash value.
4783 },
4784 ],
4785 },
4786 },
4787 "artifactStorageSourceUri": "A String", # If provided, the input binary artifacts for the build came from this
4788 # location.
4789 "additionalContexts": [ # If provided, some of the source code used for the build may be found in
4790 # these locations, in the case where the source repository had multiple
4791 # remotes or submodules. This list will not include the context specified in
4792 # the context field.
4793 { # A SourceContext is a reference to a tree of files. A SourceContext together
4794 # with a path point to a unique revision of a single file or directory.
4795 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
4796 # repository (e.g., GitHub).
4797 "url": "A String", # Git repository URL.
4798 "revisionId": "A String", # Git commit hash.
4799 },
4800 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
4801 # Source Repo.
4802 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
4803 "kind": "A String", # The alias kind.
4804 "name": "A String", # The alias name.
4805 },
4806 "revisionId": "A String", # A revision ID.
4807 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
4808 "uid": "A String", # A server-assigned, globally unique identifier.
4809 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
4810 # winged-cargo-31) and a repo name within that project.
4811 "projectId": "A String", # The ID of the project.
4812 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
4813 },
4814 },
4815 },
4816 "labels": { # Labels with user defined metadata.
4817 "a_key": "A String",
4818 },
4819 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
4820 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
4821 "kind": "A String", # The alias kind.
4822 "name": "A String", # The alias name.
4823 },
4824 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4825 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
4826 # "project/subproject" is a valid project name. The "repo name" is the
4827 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4828 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4829 },
4830 },
4831 ],
4832 "context": { # A SourceContext is a reference to a tree of files. A SourceContext together # If provided, the source code used for the build came from this location.
4833 # with a path point to a unique revision of a single file or directory.
4834 "git": { # A GitSourceContext denotes a particular revision in a third party Git # A SourceContext referring to any third party Git repo (e.g., GitHub).
4835 # repository (e.g., GitHub).
4836 "url": "A String", # Git repository URL.
4837 "revisionId": "A String", # Git commit hash.
4838 },
4839 "cloudRepo": { # A CloudRepoSourceContext denotes a particular revision in a Google Cloud # A SourceContext referring to a revision in a Google Cloud Source Repo.
4840 # Source Repo.
4841 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
4842 "kind": "A String", # The alias kind.
4843 "name": "A String", # The alias name.
4844 },
4845 "revisionId": "A String", # A revision ID.
4846 "repoId": { # A unique identifier for a Cloud Repo. # The ID of the repo.
4847 "uid": "A String", # A server-assigned, globally unique identifier.
4848 "projectRepoId": { # Selects a repo using a Google Cloud Platform project ID (e.g., # A combination of a project ID and a repo name.
4849 # winged-cargo-31) and a repo name within that project.
4850 "projectId": "A String", # The ID of the project.
4851 "repoName": "A String", # The name of the repo. Leave empty for the default repo.
4852 },
4853 },
4854 },
4855 "labels": { # Labels with user defined metadata.
4856 "a_key": "A String",
4857 },
4858 "gerrit": { # A SourceContext referring to a Gerrit project. # A SourceContext referring to a Gerrit project.
4859 "aliasContext": { # An alias to a repo revision. # An alias, which may be a branch or tag.
4860 "kind": "A String", # The alias kind.
4861 "name": "A String", # The alias name.
4862 },
4863 "revisionId": "A String", # A revision (commit) ID.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4864 "gerritProject": "A String", # The full project name within the host. Projects may be nested, so
4865 # "project/subproject" is a valid project name. The "repo name" is the
4866 # hostURI/project.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4867 "hostUri": "A String", # The URI of a running Gerrit instance.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4868 },
4869 },
4870 },
4871 "buildOptions": { # Special options applied to this build. This is a catch-all field where
4872 # build providers can enter any desired additional details.
4873 "a_key": "A String",
4874 },
4875 "creator": "A String", # E-mail address of the user who initiated this build. Note that this was the
4876 # user's e-mail address at the time the build was initiated; this address may
4877 # not represent the same end-user for all time.
4878 "projectId": "A String", # ID of the project.
4879 "builderVersion": "A String", # Version string of the builder at the time this build was executed.
4880 "createTime": "A String", # Time at which the build was created.
4881 "builtArtifacts": [ # Output of the build.
4882 { # Artifact describes a build product.
4883 "checksum": "A String", # Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
4884 # container.
4885 "id": "A String", # Artifact ID, if any; for container images, this will be a URL by digest
4886 # like `gcr.io/projectID/imagename@sha256:123456`.
4887 "names": [ # Related artifact names. This may be the path to a binary or jar file, or in
4888 # the case of a container build, the name used to push the container image to
4889 # Google Container Registry, as presented to `docker push`. Note that a
4890 # single Artifact ID can have multiple names, for example if two tags are
4891 # applied to one image.
4892 "A String",
4893 ],
4894 },
4895 ],
4896 "triggerId": "A String", # Trigger identifier if the build was triggered automatically; empty if not.
4897 "startTime": "A String", # Time at which execution of the build was started.
4898 "endTime": "A String", # Time at which execution of the build was finished.
4899 "id": "A String", # Required. Unique identifier of the build.
4900 "logsUri": "A String", # URI where any logs for this provenance were written.
4901 },
4902 "provenanceBytes": "A String", # Serialized JSON representation of the provenance, used in generating the
4903 # build signature in the corresponding build note. After verifying the
4904 # signature, `provenance_bytes` can be unmarshalled and compared to the
4905 # provenance to confirm that it is unchanged. A base64-encoded string
4906 # representation of the provenance bytes is used for the signature in order
4907 # to interoperate with openssl which expects this format for signature
4908 # verification.
4909 #
4910 # The serialized form is captured both to avoid ambiguity in how the
4911 # provenance is marshalled to json as well to prevent incompatibilities with
4912 # future changes.
4913 },
4914 "deployment": { # Details of a deployment occurrence. # Describes the deployment of an artifact on a runtime.
4915 "deployment": { # The period during which some deployable was active in a runtime. # Required. Deployment history for the resource.
4916 "resourceUri": [ # Output only. Resource URI for the artifact being deployed taken from
4917 # the deployable field with the same name.
4918 "A String",
4919 ],
4920 "userEmail": "A String", # Identity of the user that triggered this deployment.
4921 "address": "A String", # Address of the runtime element hosting this deployment.
4922 "platform": "A String", # Platform hosting this deployment.
4923 "deployTime": "A String", # Required. Beginning of the lifetime of this deployment.
4924 "undeployTime": "A String", # End of the lifetime of this deployment.
4925 "config": "A String", # Configuration used to create this deployment.
4926 },
4927 },
4928 "remediation": "A String", # A description of actions that can be taken to remedy the note.
4929 "installation": { # Details of a package occurrence. # Describes the installation of a package on the linked resource.
4930 "installation": { # This represents how a particular software package may be installed on a # Required. Where the package was installed.
4931 # system.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4932 "name": "A String", # Output only. The name of the installed package.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4933 "location": [ # Required. All of the places within the filesystem versions of this package
4934 # have been found.
4935 { # An occurrence of a particular package installation found within a system's
4936 # filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
4937 "path": "A String", # The path from which we gathered that this package/version is installed.
4938 "cpeUri": "A String", # Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
4939 # denoting the package manager version distributing a package.
4940 "version": { # Version contains structured information about the version of a package. # The version installed at this location.
4941 "epoch": 42, # Used to correct mistakes in the version numbering scheme.
4942 "kind": "A String", # Required. Distinguishes between sentinel MIN/MAX versions and normal
4943 # versions.
4944 "name": "A String", # Required only when version kind is NORMAL. The main part of the version
4945 # name.
4946 "revision": "A String", # The iteration of the package build from the above version.
4947 },
4948 },
4949 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4950 },
4951 },
4952 "createTime": "A String", # Output only. The time this occurrence was created.
4953 "derivedImage": { # Details of an image occurrence. # Describes how this resource derives from the basis in the associated
4954 # note.
4955 "derivedImage": { # Derived describes the derived image portion (Occurrence) of the DockerImage # Required. Immutable. The child image derived from the base image.
4956 # relationship. This image would be produced from a Dockerfile with FROM
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4957 # &lt;DockerImage.Basis in attached Note&gt;.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4958 "distance": 42, # Output only. The number of layers by which this image differs from the
4959 # associated image basis.
4960 "baseResourceUrl": "A String", # Output only. This contains the base image URL for the derived image
4961 # occurrence.
4962 "layerInfo": [ # This contains layer-specific metadata, if populated it has length
4963 # "distance" and is ordered with [distance] being the layer immediately
4964 # following the base image and [1] being the final layer.
4965 { # Layer holds metadata specific to a layer of a Docker image.
4966 "arguments": "A String", # The recovered arguments to the Dockerfile directive.
4967 "directive": "A String", # Required. The recovered Dockerfile directive used to construct this layer.
4968 },
4969 ],
4970 "fingerprint": { # A set of properties that uniquely identify a given Docker image. # Required. The fingerprint of the derived image.
4971 "v1Name": "A String", # Required. The layer ID of the final layer in the Docker image's v1
4972 # representation.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4973 "v2Blob": [ # Required. The ordered list of v2 blobs that represent a given image.
4974 "A String",
4975 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4976 "v2Name": "A String", # Output only. The name of the image's v2 blobs computed via:
4977 # [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1])
4978 # Only the name of the final blob is kept.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4979 },
4980 },
4981 },
4982 "noteName": "A String", # Required. Immutable. The analysis note associated with this occurrence, in
4983 # the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be
4984 # used as a filter in list requests.
4985 }</pre>
4986</div>
4987
4988<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]4989 <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]4990 <pre>Sets the access control policy on the specified note or occurrence.
4991Requires `containeranalysis.notes.setIamPolicy` or
4992`containeranalysis.occurrences.setIamPolicy` permission if the resource is
4993a note or an occurrence, respectively.
4994
4995The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
4996notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
4997occurrences.
4998
4999Args:
5000 resource: string, REQUIRED: The resource for which the policy is being specified.
5001See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5002 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5003 The object takes the form of:
5004
5005{ # Request message for `SetIamPolicy` method.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5006 "policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5007 # the policy is limited to a few 10s of KB. An empty policy is a
5008 # valid policy but certain Cloud Platform services (such as Projects)
5009 # might reject them.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5010 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5011 #
5012 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5013 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
5014 # `members` to a single `role`. Members can be user accounts, service accounts,
5015 # Google groups, and domains (such as G Suite). A `role` is a named list of
5016 # permissions; each `role` can be an IAM predefined role or a user-created
5017 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5018 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5019 # Optionally, a `binding` can specify a `condition`, which is a logical
5020 # expression that allows access to a resource only if the expression evaluates
5021 # to `true`. A condition can add constraints based on attributes of the
5022 # request, the resource, or both.
5023 #
5024 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5025 #
5026 # {
5027 # "bindings": [
5028 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5029 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5030 # "members": [
5031 # "user:mike@example.com",
5032 # "group:admins@example.com",
5033 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5034 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5035 # ]
5036 # },
5037 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5038 # "role": "roles/resourcemanager.organizationViewer",
5039 # "members": ["user:eve@example.com"],
5040 # "condition": {
5041 # "title": "expirable access",
5042 # "description": "Does not grant access after Sep 2020",
5043 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
5044 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5045 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5046 # ],
5047 # "etag": "BwWWja0YfJA=",
5048 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5049 # }
5050 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5051 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5052 #
5053 # bindings:
5054 # - members:
5055 # - user:mike@example.com
5056 # - group:admins@example.com
5057 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5058 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
5059 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5060 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5061 # - user:eve@example.com
5062 # role: roles/resourcemanager.organizationViewer
5063 # condition:
5064 # title: expirable access
5065 # description: Does not grant access after Sep 2020
5066 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
5067 # - etag: BwWWja0YfJA=
5068 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5069 #
5070 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5071 # [IAM documentation](https://cloud.google.com/iam/docs/).
5072 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
5073 # `condition` that determines how and when the `bindings` are applied. Each
5074 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5075 { # Associates `members` with a `role`.
5076 "role": "A String", # Role that is assigned to `members`.
5077 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5078 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
5079 # NOTE: An unsatisfied condition will not allow user access via current
5080 # binding. Different bindings, including their conditions, are examined
5081 # independently.
5082 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
5083 # are documented at https://github.com/google/cel-spec.
5084 #
5085 # Example (Comparison):
5086 #
5087 # title: "Summary size limit"
5088 # description: "Determines if a summary is less than 100 chars"
5089 # expression: "document.summary.size() &lt; 100"
5090 #
5091 # Example (Equality):
5092 #
5093 # title: "Requestor is owner"
5094 # description: "Determines if requestor is the document owner"
5095 # expression: "document.owner == request.auth.claims.email"
5096 #
5097 # Example (Logic):
5098 #
5099 # title: "Public documents"
5100 # description: "Determine whether the document should be publicly visible"
5101 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
5102 #
5103 # Example (Data Manipulation):
5104 #
5105 # title: "Notification string"
5106 # description: "Create a notification string with a timestamp."
5107 # expression: "'New message received at ' + string(document.create_time)"
5108 #
5109 # The exact variables and functions that may be referenced within an expression
5110 # are determined by the service that evaluates it. See the service
5111 # documentation for additional information.
5112 "description": "A String", # Optional. Description of the expression. This is a longer text which
5113 # describes the expression, e.g. when hovered over it in a UI.
5114 "expression": "A String", # Textual representation of an expression in Common Expression Language
5115 # syntax.
5116 "location": "A String", # Optional. String indicating the location of the expression for error
5117 # reporting, e.g. a file name and a position in the file.
5118 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
5119 # its purpose. This can be used e.g. in UIs which allow to enter the
5120 # expression.
5121 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5122 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
5123 # `members` can have the following values:
5124 #
5125 # * `allUsers`: A special identifier that represents anyone who is
5126 # on the internet; with or without a Google account.
5127 #
5128 # * `allAuthenticatedUsers`: A special identifier that represents anyone
5129 # who is authenticated with a Google account or a service account.
5130 #
5131 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5132 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5133 #
5134 #
5135 # * `serviceAccount:{emailid}`: An email address that represents a service
5136 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
5137 #
5138 # * `group:{emailid}`: An email address that represents a Google group.
5139 # For example, `admins@example.com`.
5140 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5141 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
5142 # identifier) representing a user that has been recently deleted. For
5143 # example, `alice@example.com?uid=123456789012345678901`. If the user is
5144 # recovered, this value reverts to `user:{emailid}` and the recovered user
5145 # retains the role in the binding.
5146 #
5147 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
5148 # unique identifier) representing a service account that has been recently
5149 # deleted. For example,
5150 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
5151 # If the service account is undeleted, this value reverts to
5152 # `serviceAccount:{emailid}` and the undeleted service account retains the
5153 # role in the binding.
5154 #
5155 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
5156 # identifier) representing a Google group that has been recently
5157 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
5158 # the group is recovered, this value reverts to `group:{emailid}` and the
5159 # recovered group retains the role in the binding.
5160 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5161 #
5162 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
5163 # users of that domain. For example, `google.com` or `example.com`.
5164 #
5165 "A String",
5166 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5167 },
5168 ],
5169 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
5170 # prevent simultaneous updates of a policy from overwriting each other.
5171 # It is strongly suggested that systems make use of the `etag` in the
5172 # read-modify-write cycle to perform policy updates in order to avoid race
5173 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
5174 # systems are expected to put that etag in the request to `setIamPolicy` to
5175 # ensure that their change will be applied to the same version of the policy.
5176 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5177 # **Important:** If you use IAM Conditions, you must include the `etag` field
5178 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
5179 # you to overwrite a version `3` policy with a version `1` policy, and all of
5180 # the conditions in the version `3` policy are lost.
5181 "version": 42, # Specifies the format of the policy.
5182 #
5183 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
5184 # are rejected.
5185 #
5186 # Any operation that affects conditional role bindings must specify version
5187 # `3`. This requirement applies to the following operations:
5188 #
5189 # * Getting a policy that includes a conditional role binding
5190 # * Adding a conditional role binding to a policy
5191 # * Changing a conditional role binding in a policy
5192 # * Removing any role binding, with or without a condition, from a policy
5193 # that includes conditions
5194 #
5195 # **Important:** If you use IAM Conditions, you must include the `etag` field
5196 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
5197 # you to overwrite a version `3` policy with a version `1` policy, and all of
5198 # the conditions in the version `3` policy are lost.
5199 #
5200 # If a policy does not include any conditions, operations on that policy may
5201 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5202 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5203 }
5204
5205 x__xgafv: string, V1 error format.
5206 Allowed values
5207 1 - v1 error format
5208 2 - v2 error format
5209
5210Returns:
5211 An object of the form:
5212
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5213 { # An Identity and Access Management (IAM) policy, which specifies access
5214 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5215 #
5216 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5217 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
5218 # `members` to a single `role`. Members can be user accounts, service accounts,
5219 # Google groups, and domains (such as G Suite). A `role` is a named list of
5220 # permissions; each `role` can be an IAM predefined role or a user-created
5221 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5222 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5223 # Optionally, a `binding` can specify a `condition`, which is a logical
5224 # expression that allows access to a resource only if the expression evaluates
5225 # to `true`. A condition can add constraints based on attributes of the
5226 # request, the resource, or both.
5227 #
5228 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5229 #
5230 # {
5231 # "bindings": [
5232 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5233 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5234 # "members": [
5235 # "user:mike@example.com",
5236 # "group:admins@example.com",
5237 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5238 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5239 # ]
5240 # },
5241 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5242 # "role": "roles/resourcemanager.organizationViewer",
5243 # "members": ["user:eve@example.com"],
5244 # "condition": {
5245 # "title": "expirable access",
5246 # "description": "Does not grant access after Sep 2020",
5247 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
5248 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5249 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5250 # ],
5251 # "etag": "BwWWja0YfJA=",
5252 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5253 # }
5254 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5255 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5256 #
5257 # bindings:
5258 # - members:
5259 # - user:mike@example.com
5260 # - group:admins@example.com
5261 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5262 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
5263 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5264 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5265 # - user:eve@example.com
5266 # role: roles/resourcemanager.organizationViewer
5267 # condition:
5268 # title: expirable access
5269 # description: Does not grant access after Sep 2020
5270 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
5271 # - etag: BwWWja0YfJA=
5272 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5273 #
5274 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5275 # [IAM documentation](https://cloud.google.com/iam/docs/).
5276 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
5277 # `condition` that determines how and when the `bindings` are applied. Each
5278 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5279 { # Associates `members` with a `role`.
5280 "role": "A String", # Role that is assigned to `members`.
5281 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5282 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
5283 # NOTE: An unsatisfied condition will not allow user access via current
5284 # binding. Different bindings, including their conditions, are examined
5285 # independently.
5286 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
5287 # are documented at https://github.com/google/cel-spec.
5288 #
5289 # Example (Comparison):
5290 #
5291 # title: "Summary size limit"
5292 # description: "Determines if a summary is less than 100 chars"
5293 # expression: "document.summary.size() &lt; 100"
5294 #
5295 # Example (Equality):
5296 #
5297 # title: "Requestor is owner"
5298 # description: "Determines if requestor is the document owner"
5299 # expression: "document.owner == request.auth.claims.email"
5300 #
5301 # Example (Logic):
5302 #
5303 # title: "Public documents"
5304 # description: "Determine whether the document should be publicly visible"
5305 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
5306 #
5307 # Example (Data Manipulation):
5308 #
5309 # title: "Notification string"
5310 # description: "Create a notification string with a timestamp."
5311 # expression: "'New message received at ' + string(document.create_time)"
5312 #
5313 # The exact variables and functions that may be referenced within an expression
5314 # are determined by the service that evaluates it. See the service
5315 # documentation for additional information.
5316 "description": "A String", # Optional. Description of the expression. This is a longer text which
5317 # describes the expression, e.g. when hovered over it in a UI.
5318 "expression": "A String", # Textual representation of an expression in Common Expression Language
5319 # syntax.
5320 "location": "A String", # Optional. String indicating the location of the expression for error
5321 # reporting, e.g. a file name and a position in the file.
5322 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
5323 # its purpose. This can be used e.g. in UIs which allow to enter the
5324 # expression.
5325 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5326 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
5327 # `members` can have the following values:
5328 #
5329 # * `allUsers`: A special identifier that represents anyone who is
5330 # on the internet; with or without a Google account.
5331 #
5332 # * `allAuthenticatedUsers`: A special identifier that represents anyone
5333 # who is authenticated with a Google account or a service account.
5334 #
5335 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5336 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5337 #
5338 #
5339 # * `serviceAccount:{emailid}`: An email address that represents a service
5340 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
5341 #
5342 # * `group:{emailid}`: An email address that represents a Google group.
5343 # For example, `admins@example.com`.
5344 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5345 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
5346 # identifier) representing a user that has been recently deleted. For
5347 # example, `alice@example.com?uid=123456789012345678901`. If the user is
5348 # recovered, this value reverts to `user:{emailid}` and the recovered user
5349 # retains the role in the binding.
5350 #
5351 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
5352 # unique identifier) representing a service account that has been recently
5353 # deleted. For example,
5354 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
5355 # If the service account is undeleted, this value reverts to
5356 # `serviceAccount:{emailid}` and the undeleted service account retains the
5357 # role in the binding.
5358 #
5359 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
5360 # identifier) representing a Google group that has been recently
5361 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
5362 # the group is recovered, this value reverts to `group:{emailid}` and the
5363 # recovered group retains the role in the binding.
5364 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5365 #
5366 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
5367 # users of that domain. For example, `google.com` or `example.com`.
5368 #
5369 "A String",
5370 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5371 },
5372 ],
5373 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
5374 # prevent simultaneous updates of a policy from overwriting each other.
5375 # It is strongly suggested that systems make use of the `etag` in the
5376 # read-modify-write cycle to perform policy updates in order to avoid race
5377 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
5378 # systems are expected to put that etag in the request to `setIamPolicy` to
5379 # ensure that their change will be applied to the same version of the policy.
5380 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5381 # **Important:** If you use IAM Conditions, you must include the `etag` field
5382 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
5383 # you to overwrite a version `3` policy with a version `1` policy, and all of
5384 # the conditions in the version `3` policy are lost.
5385 "version": 42, # Specifies the format of the policy.
5386 #
5387 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
5388 # are rejected.
5389 #
5390 # Any operation that affects conditional role bindings must specify version
5391 # `3`. This requirement applies to the following operations:
5392 #
5393 # * Getting a policy that includes a conditional role binding
5394 # * Adding a conditional role binding to a policy
5395 # * Changing a conditional role binding in a policy
5396 # * Removing any role binding, with or without a condition, from a policy
5397 # that includes conditions
5398 #
5399 # **Important:** If you use IAM Conditions, you must include the `etag` field
5400 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
5401 # you to overwrite a version `3` policy with a version `1` policy, and all of
5402 # the conditions in the version `3` policy are lost.
5403 #
5404 # If a policy does not include any conditions, operations on that policy may
5405 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5406 }</pre>
5407</div>
5408
5409<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5410 <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5411 <pre>Returns the permissions that a caller has on the specified note or
5412occurrence. Requires list permission on the project (for example,
5413`containeranalysis.notes.list`).
5414
5415The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
5416notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
5417occurrences.
5418
5419Args:
5420 resource: string, REQUIRED: The resource for which the policy detail is being requested.
5421See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]5422 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]5423 The object takes the form of:
5424
5425{ # Request message for `TestIamPermissions` method.
5426 "permissions": [ # The set of permissions to check for the `resource`. Permissions with
5427 # wildcards (such as '*' or 'storage.*') are not allowed. For more
5428 # information see
5429 # [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
5430 "A String",
5431 ],
5432 }
5433
5434 x__xgafv: string, V1 error format.
5435 Allowed values
5436 1 - v1 error format
5437 2 - v2 error format
5438
5439Returns:
5440 An object of the form:
5441
5442 { # Response message for `TestIamPermissions` method.
5443 "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is
5444 # allowed.
5445 "A String",
5446 ],
5447 }</pre>
5448</div>
5449
5450</body></html>