Namespace Grafeas.V1 (2.3.0)

An alias to a repo revision.

Container for nested types declared in the AliasContext message type.

Artifact describes a build product.

Note kind that represents a logical attestation "role" or "authority". For example, an organization might have one Authority for "QA" and one for "build". This note is intended to act strictly as a grouping mechanism for the attached occurrences (Attestations). This grouping mechanism also provides a security boundary, since IAM ACLs gate the ability for a principle to attach an occurrence to a given note. It also provides a single point of lookup to find all attached attestation occurrences, even if they don't all live in the same project.

Container for nested types declared in the AttestationNote message type.

This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from "readable" names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.

Occurrence that represents a single "attestation". The authenticity of an attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the authority to which this attestation is attached is primarily useful for lookup (how to find this attestation if you already know the authority and artifact to be verified) and intent (for which authority this attestation was intended to sign.

Request to create notes in batch.

Response for creating notes in batch.

Request to create occurrences in batch.

Response for creating occurrences in batch.

Note holding the version of the provider's builder and the signature of the provenance message in the build details occurrence.

Details of a build occurrence.

Provenance of a build. Contains all information needed to verify the full details about the build from source to completion.

A CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.

Command describes a step performed as part of the build pipeline.

Request to create a new note.

Request to create a new occurrence.

Common Vulnerability Scoring System version 3. For details, see https://www.first.org/cvss/specification-document

Container for nested types declared in the CVSSv3 message type.

Request to delete a note.

Request to delete an occurrence.

An artifact that can be deployed in some runtime.

The period during which some deployable was active in a runtime.

Container for nested types declared in the DeploymentOccurrence message type.

A note that indicates a type of analysis a provider would perform. This note exists in a provider's project. A Discovery occurrence is created in a consumer's project at the start of analysis.

Provides information about the analysis status of a discovered resource.

Container for nested types declared in the DiscoveryOccurrence message type.

This represents a particular channel of distribution for a given package. E.g., Debian's jessie-backports dpkg mirror.

Container message for hashes of byte content of files, used in source messages to verify integrity of source input to the build.

A set of properties that uniquely identify a given Docker image.

A SourceContext referring to a Gerrit project.

Request to get a note.

Request to get the note to which the specified occurrence is attached.

Request to get an occurrence.

A GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).

Grafeas API.

Retrieves analysis results of Cloud components such as Docker container images.

Analysis results are stored as a series of occurrences. An Occurrence contains information about a specific analysis instance on a resource. An occurrence refers to a Note. A note contains details describing the analysis and is generally stored in a separate project, called a Provider. Multiple occurrences can refer to the same note.

For example, an SSL vulnerability could affect multiple images. In this case, there would be one note for the vulnerability and an occurrence for each image with the vulnerability referring to that note.

Base class for server-side implementations of Grafeas

Client for Grafeas

Grafeas client wrapper, for convenient use.

Builder class for GrafeasClient to provide simple configuration of credentials, endpoint etc.

Grafeas client wrapper implementation, for convenient use.

Settings for GrafeasClient instances.

Container message for hash values.

Basis describes the base image portion (Note) of the DockerImage relationship. Linked occurrences are derived from this or an equivalent image via: FROM <Basis.resource_url> Or an equivalent reference, e.g., a tag of the resource_url.

Details of the derived image portion of the DockerImage relationship. This image would be produced from a Dockerfile with FROM <DockerImage.Basis in attached Note>.

Layer holds metadata specific to a layer of a Docker image.

Request to list occurrences for a note.

Response for listing occurrences for a note.

Request to list notes.

Response for listing notes.

Request to list occurrences.

Response for listing occurrences.

An occurrence of a particular package installation found within a system's filesystem. E.g., glibc was found in /var/lib/dpkg/status.

A type of analysis that can be done for a resource.

Resource name for the Note resource.

An instance of an analysis type that has been found on a resource.

Resource name for the Occurrence resource.

This represents a particular package that is distributed over various channels. E.g., glibc (aka libc6) is distributed by many, at various versions.

Details on how a particular software package was installed on a system.

Resource name for the Project resource.

Selects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.

Metadata for any related URL information.

A unique identifier for a Cloud Repo.

Verifiers (e.g. Kritis implementations) MUST verify signatures with respect to the trust anchors defined in policy (e.g. a Kritis policy). Typically this means that the verifier has been configured with a map from public_key_id to public key material (and any required parameters, e.g. signing algorithm).

In particular, verification implementations MUST NOT treat the signature public_key_id as anything more than a key lookup hint. The public_key_id DOES NOT validate or authenticate a public key; it only provides a mechanism for quickly selecting a public key ALREADY CONFIGURED on the verifier through a trusted channel. Verification implementations MUST reject signatures in any of the following circumstances:

• The public_key_id is not recognized by the verifier.
• The public key that public_key_id refers to does not verify the signature with respect to the payload.

The signature contents SHOULD NOT be "attached" (where the payload is included with the serialized signature bytes). Verifiers MUST ignore any "attached" payload and only verify signatures with respect to explicitly provided payload (e.g. a payload field on the proto message that holds this Signature, or the canonical serialization of the proto message that holds this signature).

Source describes the location of the source used for the build.

A SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.

Request to update a note.

Request to update an occurrence.

The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities.

An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be an Upgrade Note. For Windows, windows_update field represents the information related to the update.

An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). For Windows, both distribution and windows_update contain information for the Windows update.

Version contains structured information about the version of a package.

Container for nested types declared in the Version message type.

A security vulnerability that can be found in resources.

Container for nested types declared in the VulnerabilityNote message type.

A detail for a distro and package affected by this vulnerability and its associated fix (if one is available).

Container for nested types declared in the WindowsDetail message type.

An occurrence of a severity vulnerability on a resource.

Container for nested types declared in the VulnerabilityOccurrence message type.

A detail for a distro and package this vulnerability occurrence was found in and its associated fix (if one is available).

Windows Update represents the metadata about the update for the Windows operating system. The fields in this message come from the Windows Update API documented at https://docs.microsoft.com/en-us/windows/win32/api/wuapi/nn-wuapi-iupdate.

Container for nested types declared in the WindowsUpdate message type.

The category to which the update belongs.

The unique identifier of the update.

The type of an alias.

Instruction set architectures supported by various package managers.

Enum of possible cases for the "revision" oneof.

Types of platforms.

Analysis status for a resource. Currently for initial analysis only (not updated in continuous analysis).

Whether the resource is continuously analyzed.

Enum of possible cases for the "revision" oneof.

Enum of possible cases for the "type" oneof.

Kind represents the kinds of notes supported.

The possible contents of NoteName.

Enum of possible cases for the "details" oneof.

The possible contents of OccurrenceName.

The possible contents of ProjectName.

Enum of possible cases for the "id" oneof.

Note provider assigned severity/impact ranking.

Enum of possible cases for the "context" oneof.

Whether this is an ordinary package version or a sentinel MIN/MAX version.