suguo
/
googleapis
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Synchronize new proto/yaml changes. 

PiperOrigin-RevId: 206776782
This commit is contained in:
Google APIs 2018-07-31 09:44:25 -07:00 committed by Copybara-Service
parent 201d7be7f9
commit 8dfde277c7
15 changed files with 2509 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
google/devtools/containeranalysis/artman_containeranalysis_v1beta1.yaml Normal file
View File

@ -0,0 +1,56 @@
common:
api_name: containeranalysis
api_version: v1beta1
organization_name: google-cloud
proto_deps:
- name: google-common-protos
- name: google-iam-v1
src_proto_paths:
- v1beta1
service_yaml: containeranalysis_v1beta1.yaml
gapic_yaml: v1beta1/containeranalysis_gapic.yaml
artifacts:
- name: gapic_config
type: GAPIC_CONFIG
- name: java_gapic
type: GAPIC
language: JAVA
publish_targets:
- name: staging
type: GITHUB
location: git@github.com:googleapis/api-client-staging.git
directory_mappings:
- dest: generated/java/gapic-google-cloud-containeranalysis-v1beta1
- name: grpc
dest: generated/java/grpc-google-cloud-containeranalysis-v1beta1
- name: proto
dest: generated/java/proto-google-cloud-containeranalysis-v1beta1
- name: java
type: GITHUB
location: git@github.com:GoogleCloudPlatform/google-cloud-java.git
directory_mappings:
- dest: google-cloud-containeranalysis
- name: python_gapic
type: GAPIC
language: PYTHON
- name: nodejs_gapic
type: GAPIC
language: NODEJS
- name: php_gapic
type: GAPIC
language: PHP
publish_targets:
- name: staging
type: GITHUB
location: git@github.com:googleapis/api-client-staging.git
directory_mappings:
- dest: generated/php/google-cloud-containeranalysis-v1beta1
- name: go_gapic
type: GAPIC
language: GO
- name: ruby_gapic
type: GAPIC
language: RUBY
- name: csharp_gapic
type: GAPIC
language: CSHARP

68
google/devtools/containeranalysis/containeranalysis_v1beta1.yaml Normal file
View File

@ -0,0 +1,68 @@
type: google.api.Service
config_version: 3
name: containeranalysis.googleapis.com
title: Container Analysis API
apis:
- name: google.devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1
- name: grafeas.v1beta1.GrafeasV1Beta1
documentation:
summary: |-
An implementation of the Grafeas API, which stores, and enables querying and
retrieval of critical metadata about all of your software artifacts.
overview: |-
The Container Analysis API allows you to store and retrieve metadata for a
container resource.
backend:
rules:
- selector: google.devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1.SetIamPolicy
deadline: 30.0
- selector: google.devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1.GetIamPolicy
deadline: 30.0
- selector: google.devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1.TestIamPermissions
deadline: 30.0
- selector: google.devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1.GetScanConfig
deadline: 30.0
- selector: google.devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1.ListScanConfigs
deadline: 30.0
- selector: google.devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1.UpdateScanConfig
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.GetOccurrence
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.ListOccurrences
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.DeleteOccurrence
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.CreateOccurrence
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.BatchCreateOccurrences
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.UpdateOccurrence
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.GetOccurrenceNote
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.GetNote
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.ListNotes
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.DeleteNote
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.CreateNote
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.BatchCreateNotes
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.UpdateNote
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.ListNoteOccurrences
deadline: 30.0
- selector: grafeas.v1beta1.GrafeasV1Beta1.GetVulnerabilityOccurrencesSummary
deadline: 30.0
authentication:
rules:
- selector: '*'
oauth:
canonical_scopes: |-
https://www.googleapis.com/auth/cloud-platform

132
google/devtools/containeranalysis/v1beta1/attestation/attestation.proto Normal file
View File

@ -0,0 +1,132 @@
// Copyright 2018 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package grafeas.v1beta1.attestation;
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1/attestation;attestation";
option java_multiple_files = true;
option java_package = "io.grafeas.v1beta1.attestation";
option objc_class_prefix = "GRA";
// An attestation wrapper with a PGP-compatible signature. This message only
// supports `ATTACHED` signatures, where the payload that is signed is included
// alongside the signature itself in the same file.
message PgpSignedAttestation {
// The raw content of the signature, as output by GNU Privacy Guard (GPG) or
// equivalent. Since this message only supports attached signatures, the
// payload that was signed must be attached. While the signature format
// supported is dependent on the verification implementation, currently only
// ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
// `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
// --output=signature.gpg payload.json` will create the signature content
// expected in this field in `signature.gpg` for the `payload.json`
// attestation payload.
string signature = 1;
// Type (for example schema) of the attestation payload that was signed.
enum ContentType {
// `ContentType` is not set.
CONTENT_TYPE_UNSPECIFIED = 0;
// Atomic format attestation signature. See
// https://github.com/containers/image/blob/8a5d2f82a6e3263290c8e0276c3e0f64e77723e7/docs/atomic-signature.md
// The payload extracted from `signature` is a JSON blob conforming to the
// linked schema.
SIMPLE_SIGNING_JSON = 1;
}
// Type (for example schema) of the attestation payload that was signed.
// The verifier must ensure that the provided type is one that the verifier
// supports, and that the attestation payload is a valid instantiation of that
// type (for example by validating a JSON schema).
ContentType content_type = 3;
// This field is used by verifiers to select the public key used to validate
// the signature. Note that the policy of the verifier ultimately determines
// which public keys verify a signature based on the context of the
// verification. There is no guarantee validation will succeed if the
// verifier has no key matching this ID, even if it has a key under a
// different ID that would verify the signature. Note that this ID should also
// be present in the signature content above, but that is not expected to be
// used by the verifier.
oneof key_id {
// The cryptographic fingerprint of the key used to generate the signature,
// as output by, e.g. `gpg --list-keys`. This should be the version 4, full
// 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
// https://tools.ietf.org/html/rfc4880#section-12.2 for details.
// Implementations may choose to acknowledge "LONG", "SHORT", or other
// abbreviated key IDs, but only the full fingerprint is guaranteed to work.
// In gpg, the full fingerprint can be retrieved from the `fpr` field
// returned when calling --list-keys with --with-colons. For example:
// ```
// gpg --with-colons --with-fingerprint --force-v4-certs \
// --list-keys attester@example.com
// tru::1:1513631572:0:3:1:5
// pub:...<SNIP>...
// fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
// ```
// Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
string pgp_key_id = 2;
}
}
// Note kind that represents a logical attestation "role" or "authority". For
// example, an organization might have one `Authority` for "QA" and one for
// "build". This Note is intended to act strictly as a grouping mechanism for
// the attached Occurrences (Attestations). This grouping mechanism also
// provides a security boundary, since IAM ACLs gate the ability for a principle
// to attach an Occurrence to a given Note. It also provides a single point of
// lookup to find all attached Attestation Occurrences, even if they don't all
// live in the same project.
message Authority {
// This submessage provides human-readable hints about the purpose of the
// Authority. Because the name of a Note acts as its resource reference, it is
// important to disambiguate the canonical name of the Note (which might be a
// UUID for security purposes) from "readable" names more suitable for debug
// output. Note that these hints should NOT be used to look up authorities in
// security sensitive contexts, such as when looking up Attestations to
// verify.
message Hint {
// The human readable name of this Attestation Authority, for example "qa".
string human_readable_name = 1;
}
// Hint hints at the purpose of the attestation authority.
Hint hint = 1;
}
// Details of an attestation occurrence.
message Details {
// Attestation for the resource.
Attestation attestation = 1;
}
// Occurrence that represents a single "attestation". The authenticity of an
// Attestation can be verified using the attached signature. If the verifier
// trusts the public key of the signer, then verifying the signature is
// sufficient to establish trust. In this circumstance, the Authority to which
// this Attestation is attached is primarily useful for look-up (how to find
// this Attestation if you already know the Authority and artifact to be
// verified) and intent (which authority was this attestation intended to sign
// for).
message Attestation {
// The signature, generally over the `resource_url`, that verifies this
// attestation. The semantics of the signature veracity are ultimately
// determined by the verification engine.
oneof signature {
// A PGP signed attestation.
PgpSignedAttestation pgp_signed_attestation = 1;
}
}

96
google/devtools/containeranalysis/v1beta1/build/build.proto Normal file
View File

@ -0,0 +1,96 @@
// Copyright 2018 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package grafeas.v1beta1.build;
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1/build;build";
option java_multiple_files = true;
option java_package = "io.grafeas.v1beta1.build";
option objc_class_prefix = "GRA";
import "google/devtools/containeranalysis/v1beta1/provenance/provenance.proto";
// Note holding the version of the provider's builder and the signature of the
// provenance message in linked BuildDetails.
message Build {
// Version of the builder which produced this Note.
string builder_version = 1;
// Signature of the build in Occurrences pointing to the Note containing this
// `BuilderDetails`.
BuildSignature signature = 2;
}
// Message encapsulating the signature of the verified build.
message BuildSignature {
// Public key of the builder which can be used to verify that the related
// findings are valid and unchanged. If `key_type` is empty, this defaults
// to PEM encoded public keys.
//
// This field may be empty if `key_id` references an external key.
//
// For Cloud Container Builder based signatures, this is a PEM encoded public
// key. To verify the Cloud Container Builder signature, place the contents of
// this field into a file (public.pem). The signature field is base64-decoded
// into its binary representation in signature.bin, and the provenance bytes
// from `BuildDetails` are base64-decoded into a binary representation in
// signed.bin. OpenSSL can then verify the signature:
// `openssl sha256 -verify public.pem -signature signature.bin signed.bin`
string public_key = 1;
// Signature of the related `BuildProvenance`. In JSON, this is base-64
// encoded.
bytes signature = 2;
// An ID for the key used to sign. This could be either an Id for the key
// stored in `public_key` (such as the Id or fingerprint for a PGP key, or the
// CN for a cert), or a reference to an external key (such as a reference to a
// key in Cloud Key Management Service).
string key_id = 3;
// Public key formats
enum KeyType {
// `KeyType` is not set.
KEY_TYPE_UNSPECIFIED = 0;
// `PGP ASCII Armored` public key.
PGP_ASCII_ARMORED = 1;
// `PKIX PEM` public key.
PKIX_PEM = 2;
}
// The type of the key, either stored in `public_key` or referenced in
// `key_id`
KeyType key_type = 4;
}
// Details of a build occurrence.
message Details {
// The actual provenance for the build.
grafeas.v1beta1.provenance.BuildProvenance provenance = 1;
// Serialized JSON representation of the provenance, used in generating the
// `BuildSignature` in the corresponding Result. After verifying the
// signature, `provenance_bytes` can be unmarshalled and compared to the
// provenance to confirm that it is unchanged. A base64-encoded string
// representation of the provenance bytes is used for the signature in order
// to interoperate with openssl which expects this format for signature
// verification.
//
// The serialized form is captured both to avoid ambiguity in how the
// provenance is marshalled to json as well to prevent incompatibilities with
// future changes.
string provenance_bytes = 2;
}

50
google/devtools/containeranalysis/v1beta1/common/common.proto Normal file
View File

@ -0,0 +1,50 @@
// Copyright 2018 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package grafeas.v1beta1;
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1/common;common";
option java_multiple_files = true;
option java_package = "io.grafeas.v1beta1.common";
option objc_class_prefix = "GRA";
// Kind represents the kinds of notes supported.
enum NoteKind {
// Unknown.
NOTE_KIND_UNSPECIFIED = 0;
// The note and occurrence represent a package vulnerability.
VULNERABILITY = 1;
// The note and occurrence assert build provenance.
BUILD = 2;
// This represents an image basis relationship.
IMAGE = 3;
// This represents a package installed via a package manager.
PACKAGE = 4;
// The note and occurrence track deployment events.
DEPLOYMENT = 5;
// The note and occurrence track the initial discovery status of a resource.
DISCOVERY = 6;
// This represents a logical "role" that can attest to artifacts.
ATTESTATION = 7;
}
// Metadata for any related URL information.
message RelatedUrl {
// Specific URL associated with the resource.
string url = 1;
// Label to describe usage of the URL.
string label = 2;
}

186
google/devtools/containeranalysis/v1beta1/containeranalysis.proto Normal file
View File

@ -0,0 +1,186 @@
// Copyright 2018 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.devtools.containeranalysis.v1beta1;
import "google/api/annotations.proto";
import "google/iam/v1/iam_policy.proto";
import "google/iam/v1/policy.proto";
import "google/protobuf/timestamp.proto";
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1;containeranalysis";
option java_multiple_files = true;
option java_package = "com.google.containeranalysis.v1beta1";
option objc_class_prefix = "GCA";
// Retrieves analysis results of Cloud components such as Docker container
// images. The Container Analysis API is an implementation of the
// [Grafeas](grafeas.io) API.
//
// Analysis results are stored as a series of occurrences. An `Occurrence`
// contains information about a specific analysis instance on a resource. An
// occurrence refers to a `Note`. A note contains details describing the
// analysis and is generally stored in a separate project, called a `Provider`.
// Multiple occurrences can refer to the same note.
//
// For example, an SSL vulnerability could affect multiple images. In this case,
// there would be one note for the vulnerability and an occurrence for each
// image with the vulnerability referring to that note.
service ContainerAnalysisV1Beta1 {
// Sets the access control policy on the specified note or occurrence.
// Requires `containeranalysis.notes.setIamPolicy` or
// `containeranalysis.occurrences.setIamPolicy` permission if the resource is
// a note or an occurrence, respectively.
//
// The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
// notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
// occurrences.
rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest) returns (google.iam.v1.Policy) {
option (google.api.http) = {
post: "/v1beta1/{resource=projects/*/notes/*}:setIamPolicy"
body: "*"
additional_bindings {
post: "/v1beta1/{resource=projects/*/occurrences/*}:setIamPolicy"
body: "*"
}
};
}
// Gets the access control policy for a note or an occurrence resource.
// Requires `containeranalysis.notes.setIamPolicy` or
// `containeranalysis.occurrences.setIamPolicy` permission if the resource is
// a note or occurrence, respectively.
//
// The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
// notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
// occurrences.
rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest) returns (google.iam.v1.Policy) {
option (google.api.http) = {
post: "/v1beta1/{resource=projects/*/notes/*}:getIamPolicy"
body: "*"
additional_bindings {
post: "/v1beta1/{resource=projects/*/occurrences/*}:getIamPolicy"
body: "*"
}
};
}
// Returns the permissions that a caller has on the specified note or
// occurrence. Requires list permission on the project (for example,
// `containeranalysis.notes.list`).
//
// The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
// notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
// occurrences.
rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest) returns (google.iam.v1.TestIamPermissionsResponse) {
option (google.api.http) = {
post: "/v1beta1/{resource=projects/*/notes/*}:testIamPermissions"
body: "*"
additional_bindings {
post: "/v1beta1/{resource=projects/*/occurrences/*}:testIamPermissions"
body: "*"
}
};
}
// Gets the specified scan configuration.
rpc GetScanConfig(GetScanConfigRequest) returns (ScanConfig) {
option (google.api.http) = {
get: "/v1beta1/{name=projects/*/scanConfigs/*}"
};
}
// Lists scan configurations for the specified project.
rpc ListScanConfigs(ListScanConfigsRequest) returns (ListScanConfigsResponse) {
option (google.api.http) = {
get: "/v1beta1/{parent=projects/*}/scanConfigs"
};
}
// Updates the specified scan configuration.
rpc UpdateScanConfig(UpdateScanConfigRequest) returns (ScanConfig) {
option (google.api.http) = {
put: "/v1beta1/{name=projects/*/scanConfigs/*}"
body: "scan_config"
};
}
}
// A scan configuration specifies whether Cloud components in a project have a
// particular type of analysis being run. For example, it can configure whether
// vulnerability scanning is being done on Docker images or not.
message ScanConfig {
// Output only. The name of the scan configuration in the form of
// `projects/[PROJECT_ID]/scanConfigs/[SCAN_CONFIG_ID]`.
string name = 1;
// Output only. A human-readable description of what the scan configuration
// does.
string description = 2;
// Whether the scan is enabled.
bool enabled = 3;
// Output only. The time this scan config was created.
google.protobuf.Timestamp create_time = 4;
// Output only. The time this scan config was last updated.
google.protobuf.Timestamp update_time = 5;
}
// Request to get a scan configuration.
message GetScanConfigRequest {
// The name of the scan configuration in the form of
// `projects/[PROJECT_ID]/scanConfigs/[SCAN_CONFIG_ID]`.
string name = 1;
}
// Request to list scan configurations.
message ListScanConfigsRequest {
// The name of the project to list scan configurations for in the form of
// `projects/[PROJECT_ID]`.
string parent = 1;
// The filter expression.
string filter = 2;
// The number of scan configs to return in the list.
int32 page_size = 3;
// Token to provide to skip to a particular spot in the list.
string page_token = 4;
}
// Response for listing scan configurations.
message ListScanConfigsResponse {
// The scan configurations requested.
repeated ScanConfig scan_configs = 1;
// The next pagination token in the list response. It should be used as
// `page_token` for the following request. An empty value means no more
// results.
string next_page_token = 2;
}
// A request to update a scan configuration.
message UpdateScanConfigRequest {
// The name of the scan configuration in the form of
// `projects/[PROJECT_ID]/scanConfigs/[SCAN_CONFIG_ID]`.
string name = 1;
// The updated scan configuration.
ScanConfig scan_config = 2;
}

546
google/devtools/containeranalysis/v1beta1/containeranalysis_gapic.yaml Normal file
View File

@ -0,0 +1,546 @@
type: com.google.api.codegen.ConfigProto
config_schema_version: 1.0.0
# The settings of generated code in a specific language.
language_settings:
java:
package_name: com.google.cloud.devtools.containeranalysis.v1beta1
python:
package_name: google.cloud.devtools.containeranalysis_v1beta1.gapic
go:
package_name: cloud.google.com/go/devtools/containeranalysis/apiv1beta1
csharp:
package_name: Google.Devtools.Containeranalysis.V1beta1
ruby:
package_name: Google::Cloud::Devtools::Containeranalysis::V1beta1
php:
package_name: Google\Cloud\Devtools\Containeranalysis\V1beta1
nodejs:
package_name: containeranalysis.v1beta1
# The configuration for the license header to put on generated files.
license_header:
# The file containing the copyright line(s).
copyright_file: copyright-google.txt
# The file containing the raw license header without any copyright line(s).
license_file: license-header-apache-2.0.txt
# A list of API interface configurations.
interfaces:
# The fully qualified name of the API interface.
- name: google.devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1
# A list of resource collection configurations.
# Consists of a name_pattern and an entity_name.
# The name_pattern is a pattern to describe the names of the resources of this
# collection, using the platform's conventions for URI patterns. A generator
# may use this to generate methods to compose and decompose such names. The
# pattern should use named placeholders as in `shelves/{shelf}/books/{book}`;
# those will be taken as hints for the parameter names of the generated
# methods. If empty, no name methods are generated.
# The entity_name is the name to be used as a basis for generated methods and
# classes.
collections:
- name_pattern: projects/{project}
entity_name: project
- name_pattern: projects/{project}/notes/{note}
entity_name: note
- name_pattern: projects/{project}/scanConfigs/{scan_config}
entity_name: scan_config
# Definition for retryable codes.
retry_codes_def:
- name: idempotent
retry_codes:
- UNAVAILABLE
- DEADLINE_EXCEEDED
- name: non_idempotent
retry_codes: []
# Definition for retry/backoff parameters.
retry_params_def:
- name: default
initial_retry_delay_millis: 100
retry_delay_multiplier: 1.3
max_retry_delay_millis: 60000
initial_rpc_timeout_millis: 20000
rpc_timeout_multiplier: 1
max_rpc_timeout_millis: 20000
total_timeout_millis: 600000
# A list of method configurations.
# Common properties:
#
# name - The simple name of the method.
#
# flattening - Specifies the configuration for parameter flattening.
# Describes the parameter groups for which a generator should produce method
# overloads which allow a client to directly pass request message fields as
# method parameters. This information may or may not be used, depending on
# the target language.
# Consists of groups, which each represent a list of parameters to be
# flattened. Each parameter listed must be a field of the request message.
#
# required_fields - Fields that are always required for a request to be
# valid.
#
# request_object_method - Turns on or off the generation of a method whose
# sole parameter is a request object. Not all languages will generate this
# method.
#
# resource_name_treatment - An enum that specifies how to treat the resource
# name formats defined in the field_name_patterns and
# response_field_name_patterns fields.
# UNSET: default value
# NONE: the collection configs will not be used by the generated code.
# VALIDATE: string fields will be validated by the client against the
# specified resource name formats.
# STATIC_TYPES: the client will use generated types for resource names.
#
# page_streaming - Specifies the configuration for paging.
# Describes information for generating a method which transforms a paging
# list RPC into a stream of resources.
# Consists of a request and a response.
# The request specifies request information of the list method. It defines
# which fields match the paging pattern in the request. The request consists
# of a page_size_field and a token_field. The page_size_field is the name of
# the optional field specifying the maximum number of elements to be
# returned in the response. The token_field is the name of the field in the
# request containing the page token.
# The response specifies response information of the list method. It defines
# which fields match the paging pattern in the response. The response
# consists of a token_field and a resources_field. The token_field is the
# name of the field in the response containing the next page token. The
# resources_field is the name of the field in the response containing the
# list of resources belonging to the page.
#
# retry_codes_name - Specifies the configuration for retryable codes. The
# name must be defined in interfaces.retry_codes_def.
#
# retry_params_name - Specifies the configuration for retry/backoff
# parameters. The name must be defined in interfaces.retry_params_def.
#
# field_name_patterns - Maps the field name of the request type to
# entity_name of interfaces.collections.
# Specifies the string pattern that the field must follow.
#
# timeout_millis - Specifies the default timeout for a non-retrying call. If
# the call is retrying, refer to retry_params_name instead.
methods:
- name: SetIamPolicy
flattening:
groups:
- parameters:
- resource
- policy
required_fields:
- resource
- policy
request_object_method: true
retry_codes_name: non_idempotent
retry_params_name: default
field_name_patterns:
resource: note
timeout_millis: 30000
- name: GetIamPolicy
flattening:
groups:
- parameters:
- resource
required_fields:
- resource
request_object_method: false
retry_codes_name: non_idempotent
retry_params_name: default
field_name_patterns:
resource: note
timeout_millis: 30000
- name: TestIamPermissions
flattening:
groups:
- parameters:
- resource
- permissions
required_fields:
- resource
- permissions
request_object_method: true
retry_codes_name: non_idempotent
retry_params_name: default
field_name_patterns:
resource: note
timeout_millis: 30000
- name: GetScanConfig
flattening:
groups:
- parameters:
- name
required_fields:
- name
request_object_method: false
retry_codes_name: idempotent
retry_params_name: default
field_name_patterns:
name: scan_config
timeout_millis: 30000
- name: ListScanConfigs
flattening:
groups:
- parameters:
- parent
- filter
required_fields:
- parent
request_object_method: true
page_streaming:
request:
page_size_field: page_size
token_field: page_token
response:
token_field: next_page_token
resources_field: scan_configs
retry_codes_name: idempotent
retry_params_name: default
field_name_patterns:
parent: project
timeout_millis: 30000
- name: UpdateScanConfig
flattening:
groups:
- parameters:
- name
- scan_config
required_fields:
- name
- scan_config
request_object_method: true
retry_codes_name: non_idempotent
retry_params_name: default
field_name_patterns:
name: scan_config
timeout_millis: 30000
# The fully qualified name of the API interface.
- name: grafeas.v1beta1.GrafeasV1Beta1
# A list of resource collection configurations.
# Consists of a name_pattern and an entity_name.
# The name_pattern is a pattern to describe the names of the resources of this
# collection, using the platform's conventions for URI patterns. A generator
# may use this to generate methods to compose and decompose such names. The
# pattern should use named placeholders as in `shelves/{shelf}/books/{book}`;
# those will be taken as hints for the parameter names of the generated
# methods. If empty, no name methods are generated.
# The entity_name is the name to be used as a basis for generated methods and
# classes.
collections:
- name_pattern: projects/{project}
entity_name: project
- name_pattern: projects/{project}/notes/{note}
entity_name: note
- name_pattern: projects/{project}/occurrences/{occurrence}
entity_name: occurrence
# Definition for retryable codes.
retry_codes_def:
- name: idempotent
retry_codes:
- UNAVAILABLE
- DEADLINE_EXCEEDED
- name: non_idempotent
retry_codes: []
# Definition for retry/backoff parameters.
retry_params_def:
- name: default
initial_retry_delay_millis: 100
retry_delay_multiplier: 1.3
max_retry_delay_millis: 60000
initial_rpc_timeout_millis: 20000
rpc_timeout_multiplier: 1
max_rpc_timeout_millis: 20000
total_timeout_millis: 600000
# A list of method configurations.
# Common properties:
#
# name - The simple name of the method.
#
# flattening - Specifies the configuration for parameter flattening.
# Describes the parameter groups for which a generator should produce method
# overloads which allow a client to directly pass request message fields as
# method parameters. This information may or may not be used, depending on
# the target language.
# Consists of groups, which each represent a list of parameters to be
# flattened. Each parameter listed must be a field of the request message.
#
# required_fields - Fields that are always required for a request to be
# valid.
#
# request_object_method - Turns on or off the generation of a method whose
# sole parameter is a request object. Not all languages will generate this
# method.
#
# resource_name_treatment - An enum that specifies how to treat the resource
# name formats defined in the field_name_patterns and
# response_field_name_patterns fields.
# UNSET: default value
# NONE: the collection configs will not be used by the generated code.
# VALIDATE: string fields will be validated by the client against the
# specified resource name formats.
# STATIC_TYPES: the client will use generated types for resource names.
#
# page_streaming - Specifies the configuration for paging.
# Describes information for generating a method which transforms a paging
# list RPC into a stream of resources.
# Consists of a request and a response.
# The request specifies request information of the list method. It defines
# which fields match the paging pattern in the request. The request consists
# of a page_size_field and a token_field. The page_size_field is the name of
# the optional field specifying the maximum number of elements to be
# returned in the response. The token_field is the name of the field in the
# request containing the page token.
# The response specifies response information of the list method. It defines
# which fields match the paging pattern in the response. The response
# consists of a token_field and a resources_field. The token_field is the
# name of the field in the response containing the next page token. The
# resources_field is the name of the field in the response containing the
# list of resources belonging to the page.
#
# retry_codes_name - Specifies the configuration for retryable codes. The
# name must be defined in interfaces.retry_codes_def.
#
# retry_params_name - Specifies the configuration for retry/backoff
# parameters. The name must be defined in interfaces.retry_params_def.
#
# field_name_patterns - Maps the field name of the request type to
# entity_name of interfaces.collections.
# Specifies the string pattern that the field must follow.
#
# timeout_millis - Specifies the default timeout for a non-retrying call. If
# the call is retrying, refer to retry_params_name instead.
methods:
- name: GetOccurrence
flattening:
groups:
- parameters:
- name
required_fields:
- name
request_object_method: false
retry_codes_name: idempotent
retry_params_name: default
field_name_patterns:
name: occurrence
timeout_millis: 30000
- name: ListOccurrences
flattening:
groups:
- parameters:
- parent
- filter
required_fields:
- parent
request_object_method: true
page_streaming:
request:
page_size_field: page_size
token_field: page_token
response:
token_field: next_page_token
resources_field: occurrences
retry_codes_name: idempotent
retry_params_name: default
field_name_patterns:
parent: project
timeout_millis: 30000
- name: DeleteOccurrence
flattening:
groups:
- parameters:
- name
required_fields:
- name
request_object_method: false
retry_codes_name: idempotent
retry_params_name: default
field_name_patterns:
name: occurrence
timeout_millis: 30000
- name: CreateOccurrence
flattening:
groups:
- parameters:
- parent
- occurrence
required_fields:
- parent
- occurrence
request_object_method: true
retry_codes_name: non_idempotent
retry_params_name: default
field_name_patterns:
parent: project
timeout_millis: 30000
- name: BatchCreateOccurrences
flattening:
groups:
- parameters:
- parent
- occurrences
required_fields:
- parent
- occurrences
request_object_method: true
retry_codes_name: non_idempotent
retry_params_name: default
field_name_patterns:
parent: project
timeout_millis: 30000
- name: UpdateOccurrence
flattening:
groups:
- parameters:
- name
- occurrence
- update_mask
required_fields:
- name
- occurrence
request_object_method: true
retry_codes_name: non_idempotent
retry_params_name: default
field_name_patterns:
name: occurrence
timeout_millis: 30000
- name: GetOccurrenceNote
flattening:
groups:
- parameters:
- name
required_fields:
- name
request_object_method: false
retry_codes_name: idempotent
retry_params_name: default
field_name_patterns:
name: occurrence
timeout_millis: 30000
- name: GetNote
flattening:
groups:
- parameters:
- name
required_fields:
- name
request_object_method: false
retry_codes_name: idempotent
retry_params_name: default
field_name_patterns:
name: note
timeout_millis: 30000
- name: ListNotes
flattening:
groups:
- parameters:
- parent
- filter
required_fields:
- parent
request_object_method: true
page_streaming:
request:
page_size_field: page_size
token_field: page_token
response:
token_field: next_page_token
resources_field: notes
retry_codes_name: idempotent
retry_params_name: default
field_name_patterns:
parent: project
timeout_millis: 30000
- name: DeleteNote
flattening:
groups:
- parameters:
- name
required_fields:
- name
request_object_method: false
retry_codes_name: idempotent
retry_params_name: default
field_name_patterns:
name: note
timeout_millis: 30000
- name: CreateNote
flattening:
groups:
- parameters:
- parent
- note_id
- note
required_fields:
- parent
- note_id
- note
request_object_method: true
retry_codes_name: non_idempotent
retry_params_name: default
field_name_patterns:
parent: project
timeout_millis: 30000
- name: BatchCreateNotes
flattening:
groups:
- parameters:
- parent
- notes
required_fields:
- parent
- notes
request_object_method: true
retry_codes_name: non_idempotent
retry_params_name: default
field_name_patterns:
parent: project
timeout_millis: 30000
- name: UpdateNote
flattening:
groups:
- parameters:
- name
- note
- update_mask
required_fields:
- name
- note
request_object_method: true
retry_codes_name: non_idempotent
retry_params_name: default
field_name_patterns:
name: note
timeout_millis: 30000
- name: ListNoteOccurrences
flattening:
groups:
- parameters:
- name
- filter
required_fields:
- name
request_object_method: true
page_streaming:
request:
page_size_field: page_size
token_field: page_token
response:
token_field: next_page_token
resources_field: occurrences
retry_codes_name: idempotent
retry_params_name: default
field_name_patterns:
name: note
timeout_millis: 30000
- name: GetVulnerabilityOccurrencesSummary
flattening:
groups:
- parameters:
- parent
- filter
required_fields:
- parent
request_object_method: true
retry_codes_name: idempotent
retry_params_name: default
field_name_patterns:
parent: project
timeout_millis: 30000

74
google/devtools/containeranalysis/v1beta1/deployment/deployment.proto Normal file
View File

@ -0,0 +1,74 @@
// Copyright 2018 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package grafeas.v1beta1.deployment;
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1/deployment;deployment";
option java_multiple_files = true;
option java_package = "io.grafeas.v1beta1.deployment";
option objc_class_prefix = "GRA";
import "google/protobuf/timestamp.proto";
// An artifact that can be deployed in some runtime.
message Deployable {
// Resource URI for the artifact being deployed.
repeated string resource_uri = 1;
}
// Details of a deployment occurrence.
message Details {
// Deployment history for the resource.
Deployment deployment = 1;
}
// The period during which some deployable was active in a runtime.
message Deployment {
// Identity of the user that triggered this deployment.
string user_email = 1;
// Beginning of the lifetime of this deployment.
google.protobuf.Timestamp deploy_time = 2;
// End of the lifetime of this deployment.
google.protobuf.Timestamp undeploy_time = 3;
// Configuration used to create this deployment.
string config = 4;
// Address of the runtime element hosting this deployment.
string address = 5;
// Output only. Resource URI for the artifact being deployed taken from
// the deployable field with the same name.
repeated string resource_uri = 6;
// Types of platforms.
enum Platform {
// Unknown.
PLATFORM_UNSPECIFIED = 0;
// Google Container Engine.
GKE = 1;
// Google App Engine: Flexible Environment.
FLEX = 2;
// Custom user-defined platform.
CUSTOM = 3;
}
// Platform hosting this deployment.
Platform platform = 7;
// next_id = 8;
}

85
google/devtools/containeranalysis/v1beta1/discovery/discovery.proto Normal file
View File

@ -0,0 +1,85 @@
// Copyright 2018 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package grafeas.v1beta1.discovery;
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1/discovery;discovery";
option java_multiple_files = true;
option java_package = "io.grafeas.v1beta1.discovery";
option objc_class_prefix = "GRA";
import "google/devtools/containeranalysis/v1beta1/common/common.proto";
import "google/protobuf/timestamp.proto";
import "google/rpc/status.proto";
// A note that indicates a type of analysis a provider would perform. This note
// exists in a provider's project. A `Discovery` occurrence is created in a
// consumer's project at the start of analysis.
message Discovery {
// The kind of analysis that is handled by this discovery.
grafeas.v1beta1.NoteKind analysis_kind = 1;
}
// Details of a discovery occurrence.
message Details {
// Analysis status for the discovered resource.
Discovered discovered = 1;
}
// Provides information about the analysis status of a discovered resource.
message Discovered {
// Whether the resource is continuously analyzed.
enum ContinuousAnalysis {
// Unknown.
CONTINUOUS_ANALYSIS_UNSPECIFIED = 0;
// The resource is continuously analyzed.
ACTIVE = 1;
// The resource is ignored for continuous analysis.
INACTIVE = 2;
}
// Whether the resource is continuously analyzed.
ContinuousAnalysis continuous_analysis = 1;
// The last time continuous analysis was done for this resource.
google.protobuf.Timestamp last_analysis_time = 2;
// Analysis status for a resource. Currently for initial analysis only (not
// updated in continuous analysis).
enum AnalysisStatus {
// Unknown.
ANALYSIS_STATUS_UNSPECIFIED = 0;
// Resource is known but no action has been taken yet.
PENDING = 1;
// Resource is being analyzed.
SCANNING = 2;
// Analysis has finished successfully.
FINISHED_SUCCESS = 3;
// Analysis has finished unsuccessfully, the analysis itself is in a bad
// state.
FINISHED_FAILED = 4;
// The resource is known not to be supported
FINISHED_UNSUPPORTED = 5;
}
// The status of discovery for the resource.
AnalysisStatus analysis_status = 3;
// When an error is encountered this will contain a LocalizedMessage under
// details to show to the user. The LocalizedMessage is output only and
// populated by the API.
google.rpc.Status analysis_status_error = 4;
}

502
google/devtools/containeranalysis/v1beta1/grafeas/grafeas.proto Normal file
View File

@ -0,0 +1,502 @@
// Copyright 2018 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package grafeas.v1beta1;
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1/grafeas;grafeas";
option java_multiple_files = true;
option java_package = "io.grafeas.v1beta1";
option objc_class_prefix = "GRA";
import "google/api/annotations.proto";
import "google/devtools/containeranalysis/v1beta1/attestation/attestation.proto";
import "google/devtools/containeranalysis/v1beta1/build/build.proto";
import "google/devtools/containeranalysis/v1beta1/common/common.proto";
import "google/devtools/containeranalysis/v1beta1/deployment/deployment.proto";
import "google/devtools/containeranalysis/v1beta1/discovery/discovery.proto";
import "google/devtools/containeranalysis/v1beta1/image/image.proto";
import "google/devtools/containeranalysis/v1beta1/package/package.proto";
import "google/devtools/containeranalysis/v1beta1/provenance/provenance.proto";
import "google/devtools/containeranalysis/v1beta1/vulnerability/vulnerability.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";
// [Grafeas](grafeas.io) API.
//
// Retrieves analysis results of Cloud components such as Docker container
// images.
//
// Analysis results are stored as a series of occurrences. An `Occurrence`
// contains information about a specific analysis instance on a resource. An
// occurrence refers to a `Note`. A note contains details describing the
// analysis and is generally stored in a separate project, called a `Provider`.
// Multiple occurrences can refer to the same note.
//
// For example, an SSL vulnerability could affect multiple images. In this case,
// there would be one note for the vulnerability and an occurrence for each
// image with the vulnerability referring to that note.
service GrafeasV1Beta1 {
// Gets the specified occurrence.
rpc GetOccurrence(GetOccurrenceRequest) returns (Occurrence) {
option (google.api.http) = {
get: "/v1beta1/{name=projects/*/occurrences/*}"
};
};
// Lists occurrences for the specified project.
rpc ListOccurrences(ListOccurrencesRequest)
returns (ListOccurrencesResponse) {
option (google.api.http) = {
get: "/v1beta1/{parent=projects/*}/occurrences"
};
};
// Deletes the specified occurrence. For example, use this method to delete an
// occurrence when the occurrence is no longer applicable for the given
// resource.
rpc DeleteOccurrence(DeleteOccurrenceRequest)
returns (google.protobuf.Empty) {
option (google.api.http) = {
delete: "/v1beta1/{name=projects/*/occurrences/*}"
};
};
// Creates a new occurrence.
rpc CreateOccurrence(CreateOccurrenceRequest) returns (Occurrence) {
option (google.api.http) = {
post: "/v1beta1/{parent=projects/*}/occurrences"
body: "occurrence"
};
};
// Creates new occurrences in batch.
rpc BatchCreateOccurrences(BatchCreateOccurrencesRequest)
returns (BatchCreateOccurrencesResponse) {
option (google.api.http) = {
post: "/v1beta1/{parent=projects/*}/occurrences:batchCreate"
body: "*"
};
};
// Updates the specified occurrence.
rpc UpdateOccurrence(UpdateOccurrenceRequest) returns (Occurrence) {
option (google.api.http) = {
patch: "/v1beta1/{name=projects/*/occurrences/*}"
body: "occurrence"
};
};
// Gets the note attached to the specified occurrence. Consumer projects can
// use this method to get a note that belongs to a provider project.
rpc GetOccurrenceNote(GetOccurrenceNoteRequest) returns (Note) {
option (google.api.http) = {
get: "/v1beta1/{name=projects/*/occurrences/*}/notes"
};
};
// Gets the specified note.
rpc GetNote(GetNoteRequest) returns (Note) {
option (google.api.http) = {
get: "/v1beta1/{name=projects/*/notes/*}"
};
};
// Lists notes for the specified project.
rpc ListNotes(ListNotesRequest) returns (ListNotesResponse) {
option (google.api.http) = {
get: "/v1beta1/{parent=projects/*}/notes"
};
};
// Deletes the specified note.
rpc DeleteNote(DeleteNoteRequest) returns (google.protobuf.Empty) {
option (google.api.http) = {
delete: "/v1beta1/{name=projects/*/notes/*}"
};
};
// Creates a new note.
rpc CreateNote(CreateNoteRequest) returns (Note) {
option (google.api.http) = {
post: "/v1beta1/{parent=projects/*}/notes"
body: "note"
};
};
// Creates new notes in batch.
rpc BatchCreateNotes(BatchCreateNotesRequest)
returns (BatchCreateNotesResponse) {
option (google.api.http) = {
post: "/v1beta1/{parent=projects/*}/notes:batchCreate"
body: "*"
};
};
// Updates the specified note.
rpc UpdateNote(UpdateNoteRequest) returns (Note) {
option (google.api.http) = {
patch: "/v1beta1/{name=projects/*/notes/*}"
body: "note"
};
};
// Lists occurrences referencing the specified note. Provider projects can use
// this method to get all occurrences across consumer projects referencing the
// specified note.
rpc ListNoteOccurrences(ListNoteOccurrencesRequest)
returns (ListNoteOccurrencesResponse) {
option (google.api.http) = {
get: "/v1beta1/{name=projects/*/notes/*}/occurrences"
};
};
// Gets a summary of the number and severity of occurrences.
rpc GetVulnerabilityOccurrencesSummary(
GetVulnerabilityOccurrencesSummaryRequest)
returns (VulnerabilityOccurrencesSummary) {
option (google.api.http) = {
get: "/v1beta1/{parent=projects/*}/occurrences:vulnerabilitySummary"
};
};
};
// An instance of an analysis type that has been found on a resource.
message Occurrence {
// Output only. The name of the occurrence in the form of
// `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
string name = 1;
// Required. Immutable. The resource for which the occurrence applies.
Resource resource = 2;
// Required. Immutable. The analysis note associated with this occurrence, in
// the form of `projects[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be used
// as a filter in list requests.
string note_name = 3;
// Output only. This explicitly denotes which of the occurrence details are
// specified. This field can be used as a filter in list requests.
grafeas.v1beta1.NoteKind kind = 4;
// A description of actions that can be taken to remedy the note.
string remediation = 5;
// Output only. The time this occurrence was created.
google.protobuf.Timestamp create_time = 6;
// Output only. The time this occurrence was last updated.
google.protobuf.Timestamp update_time = 7;
// Required. Immutable. Describes the details of the note kind found on this
// resource.
oneof details {
// Describes a security vulnerability.
grafeas.v1beta1.vulnerability.Details vulnerability = 8;
// Describes a verifiable build.
grafeas.v1beta1.build.Details build = 9;
// Describes how this resource derives from the basis in the associated
// note.
grafeas.v1beta1.image.Details derived_image = 10;
// Describes the installation of a package on the linked resource.
grafeas.v1beta1.package.Details installation = 11;
// Describes the deployment of an artifact on a runtime.
grafeas.v1beta1.deployment.Details deployment = 12;
// Describes when a resource was discovered.
grafeas.v1beta1.discovery.Details discovered = 13;
// Describes an attestation of an artifact.
grafeas.v1beta1.attestation.Details attestation = 14;
}
// next_id = 15;
}
// An entity that can have metadata. For example, a Docker image.
message Resource {
// The name of the resource. For example, the name of a Docker image -
// "Debian".
string name = 1;
// The unique URI of the resource. For example,
// `https://gcr.io/project/image@sha256:foo` for a Docker image.
string uri = 2;
// The hash of the resource content. For example, the Docker digest.
grafeas.v1beta1.provenance.Hash content_hash = 3;
// next_id = 4;
}
// A type of analysis that can be done for a resource.
message Note {
// Output only. The name of the note in the form of
// `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
string name = 1;
// A one sentence description of this note.
string short_description = 2;
// A detailed description of this note.
string long_description = 3;
// Output only. The type of analysis. This field can be used as a filter in
// list requests.
grafeas.v1beta1.NoteKind kind = 4;
// URLs associated with this note.
repeated grafeas.v1beta1.RelatedUrl related_url = 5;
// Time of expiration for this note. Empty if note does not expire.
google.protobuf.Timestamp expiration_time = 6;
// Output only. The time this note was created. This field can be used as a
// filter in list requests.
google.protobuf.Timestamp create_time = 7;
// Output only. The time this note was last updated. This field can be used as
// a filter in list requests.
google.protobuf.Timestamp update_time = 8;
// Other notes related to this note.
repeated string related_note_names = 9;
// Required. Immutable. The type of analysis this note represents.
oneof type {
// A note describing a package vulnerability.
grafeas.v1beta1.vulnerability.Vulnerability vulnerability = 10;
// A note describing build provenance for a verifiable build.
grafeas.v1beta1.build.Build build = 11;
// A note describing a base image.
grafeas.v1beta1.image.Basis base_image = 12;
// A note describing a package hosted by various package managers.
grafeas.v1beta1.package.Package package = 13;
// A note describing something that can be deployed.
grafeas.v1beta1.deployment.Deployable deployable = 14;
// A note describing the initial analysis of a resource.
grafeas.v1beta1.discovery.Discovery discovery = 15;
// A note describing an attestation role.
grafeas.v1beta1.attestation.Authority attestation_authority = 16;
}
// next_id = 17;
}
// Request to get an occurrence.
message GetOccurrenceRequest {
// The name of the occurrence in the form of
// `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
string name = 1;
}
// Request to list occurrences.
message ListOccurrencesRequest {
// The name of the project to list occurrences for in the form of
// `projects/[PROJECT_ID]`.
string parent = 1;
// The filter expression.
string filter = 2;
// Number of occurrences to return in the list.
int32 page_size = 3;
// Token to provide to skip to a particular spot in the list.
string page_token = 4;
// next_id = 5;
}
// Response for listing occurrences.
message ListOccurrencesResponse {
// The occurrences requested.
repeated Occurrence occurrences = 1;
// The next pagination token in the list response. It should be used as
// `page_token` for the following request. An empty value means no more
// results.
string next_page_token = 2;
}
// Request to delete a occurrence.
message DeleteOccurrenceRequest {
// The name of the occurrence in the form of
// `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
string name = 1;
}
// Request to create a new occurrence.
message CreateOccurrenceRequest {
// The name of the project in the form of `projects/[PROJECT_ID]`, under which
// the occurrence is to be created.
string parent = 1;
// The occurrence to create.
Occurrence occurrence = 2;
}
// Request to update an occurrence.
message UpdateOccurrenceRequest {
// The name of the occurrence in the form of
// `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
string name = 1;
// The updated occurrence.
Occurrence occurrence = 2;
// The fields to update.
google.protobuf.FieldMask update_mask = 3;
}
// Request to get a note.
message GetNoteRequest {
// The name of the note in the form of
// `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
string name = 1;
}
// Request to get the note to which the specified occurrence is attached.
message GetOccurrenceNoteRequest {
// The name of the occurrence in the form of
// `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
string name = 1;
}
// Request to list notes.
message ListNotesRequest {
// The name of the project to list notes for in the form of
// `projects/[PROJECT_ID]`.
string parent = 1;
// The filter expression.
string filter = 2;
// Number of notes to return in the list.
int32 page_size = 3;
// Token to provide to skip to a particular spot in the list.
string page_token = 4;
}
// Response for listing notes.
message ListNotesResponse {
// The notes requested.
repeated Note notes = 1;
// The next pagination token in the list response. It should be used as
// `page_token` for the following request. An empty value means no more
// results.
string next_page_token = 2;
}
// Request to delete a note.
message DeleteNoteRequest {
// The name of the note in the form of
// `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
string name = 1;
}
// Request to create a new note.
message CreateNoteRequest {
// The name of the project in the form of `projects/[PROJECT_ID]`, under which
// the note is to be created.
string parent = 1;
// The ID to use for this note.
string note_id = 2;
// The note to create.
Note note = 3;
}
// Request to update a note.
message UpdateNoteRequest {
// The name of the note in the form of
// `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
string name = 1;
// The updated note.
Note note = 2;
// The fields to update.
google.protobuf.FieldMask update_mask = 3;
}
// Request to list occurrences for a note.
message ListNoteOccurrencesRequest {
// The name of the note to list occurrences for in the form of
// `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
string name = 1;
// The filter expression.
string filter = 2;
// Number of occurrences to return in the list.
int32 page_size = 3;
// Token to provide to skip to a particular spot in the list.
string page_token = 4;
}
// Response for listing occurrences for a note.
message ListNoteOccurrencesResponse {
// The occurrences attached to the specified note.
repeated Occurrence occurrences = 1;
// Token to provide to skip to a particular spot in the list.
string next_page_token = 2;
}
// Request to create notes in batch.
message BatchCreateNotesRequest {
// The name of the project in the form of `projects/[PROJECT_ID]`, under which
// the notes are to be created.
string parent = 1;
// The notes to create.
map<string, Note> notes = 2;
}
// Response for creating notes in batch.
message BatchCreateNotesResponse {
// The notes that were created.
repeated Note notes = 1;
}
// Request to create occurrences in batch.
message BatchCreateOccurrencesRequest {
// The name of the project in the form of `projects/[PROJECT_ID]`, under which
// the occurrences are to be created.
string parent = 1;
// The occurrences to create.
repeated Occurrence occurrences = 2;
}
// Response for creating occurrences in batch.
message BatchCreateOccurrencesResponse {
// The occurrences that were created.
repeated Occurrence occurrences = 1;
}
// Request to get a vulnerability summary for some set of occurrences.
message GetVulnerabilityOccurrencesSummaryRequest {
// The name of the project to get a vulnerability summary for in the form of
// `projects/[PROJECT_ID]`.
string parent = 1;
// The filter expression.
string filter = 2;
}
// A summary of how many vulnerability occurrences there are per resource and
// severity type.
message VulnerabilityOccurrencesSummary {
// A listing by resource of the number of fixable and total vulnerabilities.
repeated FixableTotalByDigest counts = 1;
// Per resource and severity counts of fixable and total vulnerabilites.
message FixableTotalByDigest {
// The affected resource.
Resource resource = 1;
// The severity for this count. SEVERITY_UNSPECIFIED indicates total across
// all severities.
grafeas.v1beta1.vulnerability.Severity severity = 2;
// The number of fixable vulnerabilities associated with this resource.
int64 fixable_count = 3;
// The total number of vulnerabilities associated with this resource.
int64 total_count = 4;
}
}

144
google/devtools/containeranalysis/v1beta1/image/image.proto Normal file
View File

@ -0,0 +1,144 @@
// Copyright 2018 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package grafeas.v1beta1.image;
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1/image;image";
option java_multiple_files = true;
option java_package = "io.grafeas.v1beta1.image";
option objc_class_prefix = "GRA";
// Layer holds metadata specific to a layer of a Docker image.
message Layer {
// Instructions from Dockerfile.
enum Directive {
// Default value for unsupported/missing directive.
DIRECTIVE_UNSPECIFIED = 0;
// https://docs.docker.com/reference/builder/#maintainer
MAINTAINER = 1;
// https://docs.docker.com/reference/builder/#run
RUN = 2;
// https://docs.docker.com/reference/builder/#cmd
CMD = 3;
// https://docs.docker.com/reference/builder/#label
LABEL = 4;
// https://docs.docker.com/reference/builder/#expose
EXPOSE = 5;
// https://docs.docker.com/reference/builder/#env
ENV = 6;
// https://docs.docker.com/reference/builder/#add
ADD = 7;
// https://docs.docker.com/reference/builder/#copy
COPY = 8;
// https://docs.docker.com/reference/builder/#entrypoint
ENTRYPOINT = 9;
// https://docs.docker.com/reference/builder/#volume
VOLUME = 10;
// https://docs.docker.com/reference/builder/#user
USER = 11;
// https://docs.docker.com/reference/builder/#workdir
WORKDIR = 12;
// https://docs.docker.com/reference/builder/#arg
ARG = 13;
// https://docs.docker.com/reference/builder/#onbuild
ONBUILD = 14;
// https://docs.docker.com/reference/builder/#stopsignal
STOPSIGNAL = 15;
// https://docs.docker.com/reference/builder/#healthcheck
HEALTHCHECK = 16;
// https://docs.docker.com/reference/builder/#shell
SHELL = 17;
}
// The recovered Dockerfile directive used to construct this layer.
Directive directive = 1;
// The recovered arguments to the Dockerfile directive.
string arguments = 2;
}
// A set of properties that uniquely identify a given Docker image.
message Fingerprint {
// The layer-id of the final layer in the Docker image's v1 representation.
string v1_name = 1;
// The ordered list of v2 blobs that represent a given image.
repeated string v2_blob = 2;
// Output only. The name of the image's v2 blobs computed via:
// [bottom] := v2_blob[bottom]
// [N] := sha256(v2_blob[N] + " " + v2_name[N+1])
// Only the name of the final blob is kept.
string v2_name = 3;
}
// Basis describes the base image portion (Note) of the DockerImage
// relationship. Linked occurrences are derived from this or an
// equivalent image via:
// FROM <Basis.resource_url>
// Or an equivalent reference, e.g. a tag of the resource_url.
message Basis {
// The resource_url for the resource representing the basis of
// associated occurrence images.
string resource_url = 1;
// The fingerprint of the base image.
Fingerprint fingerprint = 2;
}
// Details of an image occurrence.
message Details {
// The child image derived from the base image.
Derived derived_image = 1;
}
// Derived describes the derived image portion (Occurrence) of the DockerImage
// relationship. This image would be produced from a Dockerfile with FROM
// <DockerImage.Basis in attached Note>.
message Derived {
// The fingerprint of the derived image.
Fingerprint fingerprint = 1;
// Output only. The number of layers by which this image differs from the
// associated image basis.
int32 distance = 2;
// This contains layer-specific metadata, if populated it has length
// "distance" and is ordered with [distance] being the layer immediately
// following the base image and [1] being the final layer.
repeated Layer layer_info = 3;
// Output only. This contains the base image URL for the derived image
// occurrence.
string base_resource_url = 4;
}

127
google/devtools/containeranalysis/v1beta1/package/package.proto Normal file
View File

@ -0,0 +1,127 @@
// Copyright 2018 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package grafeas.v1beta1.package;
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1/package;package";
option java_multiple_files = true;
option java_package = "io.grafeas.v1beta1.package";
option objc_class_prefix = "GRA";
// Instruction set architectures supported by various package managers.
enum Architecture {
// Unknown architecture.
ARCHITECTURE_UNSPECIFIED = 0;
// X86 architecture.
X86 = 1;
// X64 architecture.
X64 = 2;
}
// This represents a particular channel of distribution for a given package.
// E.g., Debian's jessie-backports dpkg mirror.
message Distribution {
// The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)
// denoting the package manager version distributing a package.
string cpe_uri = 1;
// The CPU architecture for which packages in this distribution channel were
// built.
Architecture architecture = 2;
// The latest available version of this package in this distribution
// channel.
Version latest_version = 3;
// A freeform string denoting the maintainer of this package.
string maintainer = 4;
// The distribution channel-specific homepage for this package.
string url = 5;
// The distribution channel-specific description of this package.
string description = 6;
}
// An occurrence of a particular package installation found within a system's
// filesystem. E.g., glibc was found in /var/lib/dpkg/status.
message Location {
// The cpe_uri in [cpe format](https://cpe.mitre.org/specification/)
// denoting the package manager version distributing a package.
string cpe_uri = 1;
// The version installed at this location.
Version version = 2;
// The path from which we gathered that this package/version is installed.
string path = 3;
}
// This represents a particular package that is distributed over various
// channels. E.g., glibc (aka libc6) is distributed by many, at various
// versions.
message Package {
// The name of the package.
string name = 1;
// The various channels by which a package is distributed.
repeated Distribution distribution = 10;
}
// Details of a package occurrence.
message Details {
// Where the package was installed.
Installation installation = 1;
}
// This represents how a particular software package may be installed on a
// system.
message Installation {
// Output only. The name of the installed package.
string name = 1;
// All of the places within the filesystem versions of this package
// have been found.
repeated Location location = 2;
}
// Version contains structured information about the version of a package.
message Version {
// Used to correct mistakes in the version numbering scheme.
int32 epoch = 1;
// The main part of the version name.
string name = 2;
// The iteration of the package build from the above version.
string revision = 3;
// Whether this is an ordinary package version or a sentinel MIN/MAX version.
enum VersionKind {
// Unknown.
VERSION_KIND_UNSPECIFIED = 0;
// A standard package version, defined by the other fields.
NORMAL = 1;
// A special version representing negative infinity, other fields are
// ignored.
MINIMUM = 2;
// A special version representing positive infinity, other fields are
// ignored.
MAXIMUM = 3;
};
// Distinguish between sentinel MIN/MAX versions and normal versions. If
// kind is not NORMAL, then the other fields are ignored.
VersionKind kind = 4;
}

164
google/devtools/containeranalysis/v1beta1/provenance/provenance.proto Normal file
View File

@ -0,0 +1,164 @@
// Copyright 2018 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package grafeas.v1beta1.provenance;
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1/provenance;provenance";
option java_multiple_files = true;
option java_package = "io.grafeas.v1beta1.provenance";
option objc_class_prefix = "GRA";
import "google/protobuf/timestamp.proto";
import "google/devtools/containeranalysis/v1beta1/source/source.proto";
// Provenance of a build. Contains all information needed to verify the full
// details about the build from source to completion.
message BuildProvenance {
// Unique identifier of the build.
string id = 1;
// ID of the project.
string project_id = 2;
// Commands requested by the build.
repeated Command commands = 3;
// Output of the build.
repeated Artifact built_artifacts = 4;
// Time at which the build was created.
google.protobuf.Timestamp create_time = 5;
// Time at which execution of the build was started.
google.protobuf.Timestamp start_time = 6;
// Time at which execution of the build was finished.
google.protobuf.Timestamp end_time = 7;
// E-mail address of the user who initiated this build. Note that this was the
// user's e-mail address at the time the build was initiated; this address may
// not represent the same end-user for all time.
string creator = 8;
// URI where any logs for this provenance were written.
string logs_uri = 9;
// Details of the Source input to the build.
Source source_provenance = 10;
// Trigger identifier if the build was triggered automatically; empty if not.
string trigger_id = 11;
// Special options applied to this build. This is a catch-all field where
// build providers can enter any desired additional details.
map<string, string> build_options = 12;
// Version string of the builder at the time this build was executed.
string builder_version = 13;
// next_id = 14
}
// Source describes the location of the source used for the build.
message Source {
// If provided, the input binary artifacts for the build came from this
// location.
string artifact_storage_source_uri = 1;
// Hash(es) of the build source, which can be used to verify that the original
// source integrity was maintained in the build.
//
// The keys to this map are file paths used as build source and the values
// contain the hash values for those files.
//
// If the build source came in a single package such as a gzipped tarfile
// (.tar.gz), the FileHash will be for the single path to that file.
map<string, FileHashes> file_hashes = 2;
// If provided, the source code used for the build came from this location.
grafeas.v1beta1.source.SourceContext context = 3;
// If provided, some of the source code used for the build may be found in
// these locations, in the case where the source repository had multiple
// remotes or submodules. This list will not include the context specified in
// the context field.
repeated grafeas.v1beta1.source.SourceContext additional_contexts = 4;
}
// Container message for hashes of byte content of files, used in Source
// messages to verify integrity of source input to the build.
message FileHashes {
// Collection of file hashes.
repeated Hash file_hash = 1;
}
// Container message for hash values.
message Hash {
// Specifies the hash algorithm, if any.
enum HashType {
// Unknown.
HASH_TYPE_UNSPECIFIED = 0;
// A SHA-256 hash.
SHA256 = 1;
}
// The type of hash that was performed.
HashType type = 1;
// The hash value.
bytes value = 2;
}
// Command describes a step performed as part of the build pipeline.
message Command {
// Name of the command, as presented on the command line, or if the command is
// packaged as a Docker container, as presented to `docker pull`.
string name = 1;
// Environment variables set before running this command.
repeated string env = 2;
// Command-line arguments used when executing this command.
repeated string args = 3;
// Working directory (relative to project source root) used when running this
// command.
string dir = 4;
// Optional unique identifier for this command, used in wait_for to reference
// this command as a dependency.
string id = 5;
// The ID(s) of the command(s) that this command depends on.
repeated string wait_for = 6;
}
// Artifact describes a build product.
message Artifact {
// Hash or checksum value of a binary, or Docker Registry 2.0 digest of a
// container.
string checksum = 1;
// Artifact ID, if any; for container images, this will be a URL by digest
// like `gcr.io/projectID/imagename@sha256:123456`.
string id = 2;
// Related artifact names. This may be the path to a binary or jar file, or in
// the case of a container build, the name used to push the container image to
// Google Container Registry, as presented to `docker push`. Note that a
// single Artifact ID can have multiple names, for example if two tags are
// applied to one image.
repeated string names = 3;
}

134
google/devtools/containeranalysis/v1beta1/source/source.proto Normal file
View File

@ -0,0 +1,134 @@
// Copyright 2018 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package grafeas.v1beta1.source;
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1/source;source";
option java_multiple_files = true;
option java_package = "io.grafeas.v1beta1.source";
option objc_class_prefix = "GRA";
// A SourceContext is a reference to a tree of files. A SourceContext together
// with a path point to a unique revision of a single file or directory.
message SourceContext {
// A SourceContext can refer any one of the following types of repositories.
oneof context {
// A SourceContext referring to a revision in a Google Cloud Source Repo.
CloudRepoSourceContext cloud_repo = 1;
// A SourceContext referring to a Gerrit project.
GerritSourceContext gerrit = 2;
// A SourceContext referring to any third party Git repo (e.g., GitHub).
GitSourceContext git = 3;
}
// Labels with user defined metadata.
map<string, string> labels = 4;
}
// An alias to a repo revision.
message AliasContext {
// The type of an alias.
enum Kind {
// Unknown.
KIND_UNSPECIFIED = 0;
// Git tag.
FIXED = 1;
// Git branch.
MOVABLE = 2;
// Used to specify non-standard aliases. For example, if a Git repo has a
// ref named "refs/foo/bar".
OTHER = 4;
}
// The alias kind.
Kind kind = 1;
// The alias name.
string name = 2;
}
// A CloudRepoSourceContext denotes a particular revision in a Google Cloud
// Source Repo.
message CloudRepoSourceContext {
// The ID of the repo.
RepoId repo_id = 1;
// A revision in a Cloud Repo can be identified by either its revision ID or
// its alias.
oneof revision {
// A revision ID.
string revision_id = 2;
// An alias, which may be a branch or tag.
AliasContext alias_context = 3;
}
}
// A SourceContext referring to a Gerrit project.
message GerritSourceContext {
// The URI of a running Gerrit instance.
string host_uri = 1;
// The full project name within the host. Projects may be nested, so
// "project/subproject" is a valid project name. The "repo name" is the
// hostURI/project.
string gerrit_project = 2;
// A revision in a Gerrit project can be identified by either its revision ID
// or its alias.
oneof revision {
// A revision (commit) ID.
string revision_id = 3;
// An alias, which may be a branch or tag.
AliasContext alias_context = 4;
}
}
// A GitSourceContext denotes a particular revision in a third party Git
// repository (e.g., GitHub).
message GitSourceContext {
// Git repository URL.
string url = 1;
// Git commit hash.
string revision_id = 2;
}
// A unique identifier for a Cloud Repo.
message RepoId {
// A cloud repo can be identified by either its project ID and repository name
// combination, or its globally unique identifier.
oneof id {
// A combination of a project ID and a repo name.
ProjectRepoId project_repo_id = 1;
// A server-assigned, globally unique identifier.
string uid = 2;
}
}
// Selects a repo using a Google Cloud Platform project ID (e.g.,
// winged-cargo-31) and a repo name within that project.
message ProjectRepoId {
// The ID of the project.
string project_id = 1;
// The name of the repo. Leave empty for the default repo.
string repo_name = 2;
}

145
google/devtools/containeranalysis/v1beta1/vulnerability/vulnerability.proto Normal file
View File

@ -0,0 +1,145 @@
// Copyright 2018 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package grafeas.v1beta1.vulnerability;
option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1/vulnerability;vulnerability";
option java_multiple_files = true;
option java_package = "io.grafeas.v1beta1.vulnerability";
option objc_class_prefix = "GRA";
import "google/devtools/containeranalysis/v1beta1/common/common.proto";
import "google/devtools/containeranalysis/v1beta1/package/package.proto";
// Note provider-assigned severity/impact ranking.
enum Severity {
// Unknown.
SEVERITY_UNSPECIFIED = 0;
// Minimal severity.
MINIMAL = 1;
// Low severity.
LOW = 2;
// Medium severity.
MEDIUM = 3;
// High severity.
HIGH = 4;
// Critical severity.
CRITICAL = 5;
}
// Vulnerability provides metadata about a security vulnerability.
message Vulnerability {
// The CVSS score for this vulnerability.
float cvss_score = 1;
// Note provider assigned impact of the vulnerability.
Severity severity = 2;
// All information about the package to specifically identify this
// vulnerability. One entry per (version range and cpe_uri) the package
// vulnerability has manifested in.
repeated Detail details = 3;
// Identifies all occurrences of this vulnerability in the package for a
// specific distro/location. For example: glibc in
// cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2
message Detail {
// The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in
// which the vulnerability manifests. Examples include distro or storage
// location for vulnerable jar.
string cpe_uri = 1;
// The name of the package where the vulnerability was found.
string package = 2;
// The min version of the package in which the vulnerability exists.
grafeas.v1beta1.package.Version min_affected_version = 3;
// The max version of the package in which the vulnerability exists.
grafeas.v1beta1.package.Version max_affected_version = 4;
// The severity (eg: distro assigned severity) for this vulnerability.
string severity_name = 5;
// A vendor-specific description of this note.
string description = 6;
// The fix for this specific package version.
VulnerabilityLocation fixed_location = 7;
// The type of package; whether native or non native(ruby gems, node.js
// packages etc).
string package_type = 8;
// Whether this detail is obsolete. Occurrences are expected not to point to
// obsolete details.
bool is_obsolete = 9;
}
}
// Details of a vulnerability occurrence.
message Details {
// The type of package; whether native or non native(ruby gems, node.js
// packages etc)
string type = 1;
// Output only. The note provider assigned Severity of the vulnerability.
Severity severity = 2;
// Output only. The CVSS score of this vulnerability. CVSS score is on a
// scale of 0-10 where 0 indicates low severity and 10 indicates high
// severity.
float cvss_score = 3;
// The set of affected locations and their fixes (if available) within the
// associated resource.
repeated PackageIssue package_issue = 4;
// Output only. A one sentence description of this vulnerability.
string short_description = 5;
// Output only. A detailed description of this vulnerability.
string long_description = 6;
// Output only. URLs related to this vulnerability.
repeated grafeas.v1beta1.RelatedUrl related_urls = 7;
}
// This message wraps a location affected by a vulnerability and its
// associated fix (if one is available).
message PackageIssue {
// The location of the vulnerability.
VulnerabilityLocation affected_location = 1;
// The location of the available fix for vulnerability.
VulnerabilityLocation fixed_location = 2;
// The severity (e.g., distro assigned severity) for this vulnerability.
string severity_name = 3;
}
// The location of the vulnerability.
message VulnerabilityLocation {
// The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/)
// format. Examples include distro or storage location for vulnerable jar.
string cpe_uri = 1;
// The package being described.
string package = 2;
// The version of the package being described.
grafeas.v1beta1.package.Version version = 3;
}