Types for Grafeas Grafeas v1 API¶
- class grafeas.grafeas_v1.types.AliasContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
An alias to a repo revision.
- kind¶
The alias kind.
- class Kind(value)[source]¶
Bases:
proto.enums.Enum
The type of an alias.
- Values:
- KIND_UNSPECIFIED (0):
Unknown.
- FIXED (1):
Git tag.
- MOVABLE (2):
Git branch.
- OTHER (4):
Used to specify non-standard aliases. For example, if a Git repo has a ref named “refs/foo/bar”.
- class grafeas.grafeas_v1.types.Architecture(value)[source]¶
Bases:
proto.enums.Enum
Instruction set architectures supported by various package managers.
- Values:
- ARCHITECTURE_UNSPECIFIED (0):
Unknown architecture.
- X86 (1):
X86 architecture.
- X64 (2):
X64 architecture.
- class grafeas.grafeas_v1.types.Artifact(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Artifact describes a build product.
- checksum¶
Hash or checksum value of a binary, or Docker Registry 2.0 digest of a container.
- Type
- id¶
Artifact ID, if any; for container images, this will be a URL by digest like
gcr.io/projectID/imagename@sha256:123456
.- Type
- names¶
Related artifact names. This may be the path to a binary or jar file, or in the case of a container build, the name used to push the container image to Google Container Registry, as presented to
docker push
. Note that a single Artifact ID can have multiple names, for example if two tags are applied to one image.- Type
MutableSequence[str]
- class grafeas.grafeas_v1.types.AttestationNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Note kind that represents a logical attestation “role” or “authority”. For example, an organization might have one
Authority
for “QA” and one for “build”. This note is intended to act strictly as a grouping mechanism for the attached occurrences (Attestations). This grouping mechanism also provides a security boundary, since IAM ACLs gate the ability for a principle to attach an occurrence to a given note. It also provides a single point of lookup to find all attached attestation occurrences, even if they don’t all live in the same project.- hint¶
Hint hints at the purpose of the attestation authority.
- class Hint(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from “readable” names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.
- class grafeas.grafeas_v1.types.AttestationOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Occurrence that represents a single “attestation”. The authenticity of an attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the authority to which this attestation is attached is primarily useful for lookup (how to find this attestation if you already know the authority and artifact to be verified) and intent (for which authority this attestation was intended to sign.
- serialized_payload¶
Required. The serialized payload that is verified by one or more
signatures
.- Type
- signatures¶
One or more signatures over
serialized_payload
. Verifier implementations should consider this attestation message verified if at least onesignature
verifiesserialized_payload
. SeeSignature
in common.proto for more details on signature structure and verification.- Type
MutableSequence[grafeas.grafeas_v1.types.Signature]
- jwts¶
One or more JWTs encoding a self-contained attestation. Each JWT encodes the payload that it verifies within the JWT itself. Verifier implementation SHOULD ignore the
serialized_payload
field when verifying these JWTs. If only JWTs are present on this AttestationOccurrence, then theserialized_payload
SHOULD be left empty. Each JWT SHOULD encode a claim specific to theresource_uri
of this Occurrence, but this is not validated by Grafeas metadata API implementations. The JWT itself is opaque to Grafeas.- Type
MutableSequence[grafeas.grafeas_v1.types.Jwt]
- class grafeas.grafeas_v1.types.BatchCreateNotesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to create notes in batch.
- parent¶
The name of the project in the form of
projects/[PROJECT_ID]
, under which the notes are to be created.- Type
- notes¶
The notes to create. Max allowed length is 1000.
- Type
MutableMapping[str, grafeas.grafeas_v1.types.Note]
- class NotesEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.BatchCreateNotesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Response for creating notes in batch.
- notes¶
The notes that were created.
- Type
MutableSequence[grafeas.grafeas_v1.types.Note]
- class grafeas.grafeas_v1.types.BatchCreateOccurrencesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to create occurrences in batch.
- parent¶
The name of the project in the form of
projects/[PROJECT_ID]
, under which the occurrences are to be created.- Type
- occurrences¶
The occurrences to create. Max allowed length is 1000.
- Type
MutableSequence[grafeas.grafeas_v1.types.Occurrence]
- class grafeas.grafeas_v1.types.BatchCreateOccurrencesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Response for creating occurrences in batch.
- occurrences¶
The occurrences that were created.
- Type
MutableSequence[grafeas.grafeas_v1.types.Occurrence]
- class grafeas.grafeas_v1.types.BuildNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Note holding the version of the provider’s builder and the signature of the provenance message in the build details occurrence.
- class grafeas.grafeas_v1.types.BuildOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Details of a build occurrence.
- provenance¶
The actual provenance for the build.
- provenance_bytes¶
Serialized JSON representation of the provenance, used in generating the build signature in the corresponding build note. After verifying the signature,
provenance_bytes
can be unmarshalled and compared to the provenance to confirm that it is unchanged. A base64-encoded string representation of the provenance bytes is used for the signature in order to interoperate with openssl which expects this format for signature verification.The serialized form is captured both to avoid ambiguity in how the provenance is marshalled to json as well to prevent incompatibilities with future changes.
- Type
- intoto_provenance¶
Deprecated. See InTotoStatement for the replacement. In-toto Provenance representation as defined in spec.
- intoto_statement¶
In-toto Statement representation as defined in spec. The intoto_statement can contain any type of provenance. The serialized payload of the statement can be stored and signed in the Occurrence’s envelope.
- class grafeas.grafeas_v1.types.BuildProvenance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Provenance of a build. Contains all information needed to verify the full details about the build from source to completion.
- commands¶
Commands requested by the build.
- Type
MutableSequence[grafeas.grafeas_v1.types.Command]
- built_artifacts¶
Output of the build.
- Type
MutableSequence[grafeas.grafeas_v1.types.Artifact]
- create_time¶
Time at which the build was created.
- start_time¶
Time at which execution of the build was started.
- end_time¶
Time at which execution of the build was finished.
- creator¶
E-mail address of the user who initiated this build. Note that this was the user’s e-mail address at the time the build was initiated; this address may not represent the same end-user for all time.
- Type
- source_provenance¶
Details of the Source input to the build.
- build_options¶
Special options applied to this build. This is a catch-all field where build providers can enter any desired additional details.
- class BuildOptionsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.BuilderConfig(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.CVSS(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Common Vulnerability Scoring System. For details, see https://www.first.org/cvss/specification-document This is a message we will try to use for storing various versions of CVSS rather than making a separate proto for storing a specific version.
- attack_vector¶
Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments.
- attack_complexity¶
- authentication¶
- privileges_required¶
- user_interaction¶
- scope¶
- confidentiality_impact¶
- integrity_impact¶
- availability_impact¶
- class AttackComplexity(value)[source]¶
Bases:
proto.enums.Enum
- Values:
ATTACK_COMPLEXITY_UNSPECIFIED (0):
ATTACK_COMPLEXITY_LOW (1):
ATTACK_COMPLEXITY_HIGH (2):
- class AttackVector(value)[source]¶
Bases:
proto.enums.Enum
- Values:
ATTACK_VECTOR_UNSPECIFIED (0):
ATTACK_VECTOR_NETWORK (1):
ATTACK_VECTOR_ADJACENT (2):
ATTACK_VECTOR_LOCAL (3):
ATTACK_VECTOR_PHYSICAL (4):
- class Authentication(value)[source]¶
Bases:
proto.enums.Enum
- Values:
AUTHENTICATION_UNSPECIFIED (0):
AUTHENTICATION_MULTIPLE (1):
AUTHENTICATION_SINGLE (2):
AUTHENTICATION_NONE (3):
- class Impact(value)[source]¶
Bases:
proto.enums.Enum
- Values:
IMPACT_UNSPECIFIED (0):
IMPACT_HIGH (1):
IMPACT_LOW (2):
IMPACT_NONE (3):
- class PrivilegesRequired(value)[source]¶
Bases:
proto.enums.Enum
- Values:
PRIVILEGES_REQUIRED_UNSPECIFIED (0):
PRIVILEGES_REQUIRED_NONE (1):
PRIVILEGES_REQUIRED_LOW (2):
PRIVILEGES_REQUIRED_HIGH (3):
- class Scope(value)[source]¶
Bases:
proto.enums.Enum
- Values:
SCOPE_UNSPECIFIED (0):
SCOPE_UNCHANGED (1):
SCOPE_CHANGED (2):
- class UserInteraction(value)[source]¶
Bases:
proto.enums.Enum
- Values:
USER_INTERACTION_UNSPECIFIED (0):
USER_INTERACTION_NONE (1):
USER_INTERACTION_REQUIRED (2):
- class grafeas.grafeas_v1.types.CVSSVersion(value)[source]¶
Bases:
proto.enums.Enum
CVSS Version.
- Values:
CVSS_VERSION_UNSPECIFIED (0):
CVSS_VERSION_2 (1):
CVSS_VERSION_3 (2):
- class grafeas.grafeas_v1.types.CVSSv3(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Common Vulnerability Scoring System version 3. For details, see https://www.first.org/cvss/specification-document
- attack_vector¶
Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments.
- attack_complexity¶
- privileges_required¶
- user_interaction¶
- scope¶
- confidentiality_impact¶
- integrity_impact¶
- availability_impact¶
- class AttackComplexity(value)[source]¶
Bases:
proto.enums.Enum
- Values:
ATTACK_COMPLEXITY_UNSPECIFIED (0):
ATTACK_COMPLEXITY_LOW (1):
ATTACK_COMPLEXITY_HIGH (2):
- class AttackVector(value)[source]¶
Bases:
proto.enums.Enum
- Values:
ATTACK_VECTOR_UNSPECIFIED (0):
ATTACK_VECTOR_NETWORK (1):
ATTACK_VECTOR_ADJACENT (2):
ATTACK_VECTOR_LOCAL (3):
ATTACK_VECTOR_PHYSICAL (4):
- class Impact(value)[source]¶
Bases:
proto.enums.Enum
- Values:
IMPACT_UNSPECIFIED (0):
IMPACT_HIGH (1):
IMPACT_LOW (2):
IMPACT_NONE (3):
- class PrivilegesRequired(value)[source]¶
Bases:
proto.enums.Enum
- Values:
PRIVILEGES_REQUIRED_UNSPECIFIED (0):
PRIVILEGES_REQUIRED_NONE (1):
PRIVILEGES_REQUIRED_LOW (2):
PRIVILEGES_REQUIRED_HIGH (3):
- class Scope(value)[source]¶
Bases:
proto.enums.Enum
- Values:
SCOPE_UNSPECIFIED (0):
SCOPE_UNCHANGED (1):
SCOPE_CHANGED (2):
- class UserInteraction(value)[source]¶
Bases:
proto.enums.Enum
- Values:
USER_INTERACTION_UNSPECIFIED (0):
USER_INTERACTION_NONE (1):
USER_INTERACTION_REQUIRED (2):
- class grafeas.grafeas_v1.types.CloudRepoSourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
A CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- repo_id¶
The ID of the repo.
- class grafeas.grafeas_v1.types.Command(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Command describes a step performed as part of the build pipeline.
- name¶
Required. Name of the command, as presented on the command line, or if the command is packaged as a Docker container, as presented to
docker pull
.- Type
- id¶
Optional unique identifier for this command, used in wait_for to reference this command as a dependency.
- Type
- class grafeas.grafeas_v1.types.Completeness(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Indicates that the builder claims certain fields in this message to be complete.
- arguments¶
If true, the builder claims that recipe.arguments is complete, meaning that all external inputs are properly captured in the recipe.
- Type
- environment¶
If true, the builder claims that recipe.environment is claimed to be complete.
- Type
- class grafeas.grafeas_v1.types.ComplianceNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- version¶
The OS and config versions the benchmark applies to.
- Type
MutableSequence[grafeas.grafeas_v1.types.ComplianceVersion]
- class grafeas.grafeas_v1.types.ComplianceOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
An indication that the compliance checks in the associated ComplianceNote were not satisfied for particular resources or a specified reason.
- non_compliant_files¶
- Type
MutableSequence[grafeas.grafeas_v1.types.NonCompliantFile]
- class grafeas.grafeas_v1.types.ComplianceVersion(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Describes the CIS benchmark version that is applicable to a given OS and os version.
- cpe_uri¶
The CPE URI (https://cpe.mitre.org/specification/) this benchmark is applicable to.
- Type
- benchmark_document¶
The name of the document that defines this benchmark, e.g. “CIS Container-Optimized OS”.
- Type
- class grafeas.grafeas_v1.types.CreateNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to create a new note.
- parent¶
The name of the project in the form of
projects/[PROJECT_ID]
, under which the note is to be created.- Type
- note¶
The note to create.
- class grafeas.grafeas_v1.types.CreateOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to create a new occurrence.
- parent¶
The name of the project in the form of
projects/[PROJECT_ID]
, under which the occurrence is to be created.- Type
- occurrence¶
The occurrence to create.
- class grafeas.grafeas_v1.types.DSSEAttestationNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- hint¶
DSSEHint hints at the purpose of the attestation authority.
- class DSSEHint(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from “readable” names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.
- class grafeas.grafeas_v1.types.DSSEAttestationOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Deprecated. Prefer to use a regular Occurrence, and populate the Envelope at the top level of the Occurrence.
- envelope¶
If doing something security critical, make sure to verify the signatures in this metadata.
- class grafeas.grafeas_v1.types.DeleteNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to delete a note.
- class grafeas.grafeas_v1.types.DeleteOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to delete an occurrence.
- class grafeas.grafeas_v1.types.DeploymentNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
An artifact that can be deployed in some runtime.
- class grafeas.grafeas_v1.types.DeploymentOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
The period during which some deployable was active in a runtime.
- deploy_time¶
Required. Beginning of the lifetime of this deployment.
- undeploy_time¶
End of the lifetime of this deployment.
- resource_uri¶
Output only. Resource URI for the artifact being deployed taken from the deployable field with the same name.
- Type
MutableSequence[str]
- platform¶
Platform hosting this deployment.
- class Platform(value)[source]¶
Bases:
proto.enums.Enum
Types of platforms.
- Values:
- PLATFORM_UNSPECIFIED (0):
Unknown.
- GKE (1):
Google Container Engine.
- FLEX (2):
Google App Engine: Flexible Environment.
- CUSTOM (3):
Custom user-defined platform.
- class grafeas.grafeas_v1.types.Digest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Digest information.
- class grafeas.grafeas_v1.types.DiscoveryNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
A note that indicates a type of analysis a provider would perform. This note exists in a provider’s project. A
Discovery
occurrence is created in a consumer’s project at the start of analysis.- analysis_kind¶
Required. Immutable. The kind of analysis that is handled by this discovery.
- class grafeas.grafeas_v1.types.DiscoveryOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Provides information about the analysis status of a discovered resource.
- continuous_analysis¶
Whether the resource is continuously analyzed.
- analysis_status¶
The status of discovery for the resource.
- analysis_completed¶
- analysis_error¶
Indicates any errors encountered during analysis of a resource. There could be 0 or more of these errors.
- Type
MutableSequence[google.rpc.status_pb2.Status]
- analysis_status_error¶
When an error is encountered this will contain a LocalizedMessage under details to show to the user. The LocalizedMessage is output only and populated by the API.
- Type
google.rpc.status_pb2.Status
- last_scan_time¶
The last time this resource was scanned.
- archive_time¶
The time occurrences related to this discovery occurrence were archived.
- class AnalysisCompleted(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Indicates which analysis completed successfully. Multiple types of analysis can be performed on a single resource.
- class AnalysisStatus(value)[source]¶
Bases:
proto.enums.Enum
Analysis status for a resource. Currently for initial analysis only (not updated in continuous analysis).
- Values:
- ANALYSIS_STATUS_UNSPECIFIED (0):
Unknown.
- PENDING (1):
Resource is known but no action has been taken yet.
- SCANNING (2):
Resource is being analyzed.
- FINISHED_SUCCESS (3):
Analysis has finished successfully.
- COMPLETE (3):
Analysis has completed.
- FINISHED_FAILED (4):
Analysis has finished unsuccessfully, the analysis itself is in a bad state.
- FINISHED_UNSUPPORTED (5):
The resource is known not to be supported.
- class ContinuousAnalysis(value)[source]¶
Bases:
proto.enums.Enum
Whether the resource is continuously analyzed.
- Values:
- CONTINUOUS_ANALYSIS_UNSPECIFIED (0):
Unknown.
- ACTIVE (1):
The resource is continuously analyzed.
- INACTIVE (2):
The resource is ignored for continuous analysis.
- class grafeas.grafeas_v1.types.Distribution(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
This represents a particular channel of distribution for a given package. E.g., Debian’s jessie-backports dpkg mirror.
- cpe_uri¶
The cpe_uri in CPE format denoting the package manager version distributing a package.
- Type
- architecture¶
The CPU architecture for which packages in this distribution channel were built.
- latest_version¶
The latest available version of this package in this distribution channel.
- class grafeas.grafeas_v1.types.Envelope(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
MUST match https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An authenticated message of arbitrary type.
- signatures¶
- Type
MutableSequence[grafeas.grafeas_v1.types.EnvelopeSignature]
- class grafeas.grafeas_v1.types.EnvelopeSignature(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.FileHashes(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Container message for hashes of byte content of files, used in source messages to verify integrity of source input to the build.
- file_hash¶
Required. Collection of file hashes.
- Type
MutableSequence[grafeas.grafeas_v1.types.Hash]
- class grafeas.grafeas_v1.types.FileLocation(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Indicates the location at which a package was found.
- class grafeas.grafeas_v1.types.Fingerprint(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
A set of properties that uniquely identify a given Docker image.
- v1_name¶
Required. The layer ID of the final layer in the Docker image’s v1 representation.
- Type
- class grafeas.grafeas_v1.types.GerritSourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
A SourceContext referring to a Gerrit project.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- gerrit_project¶
The full project name within the host. Projects may be nested, so “project/subproject” is a valid project name. The “repo name” is the hostURI/project.
- Type
- class grafeas.grafeas_v1.types.GetNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to get a note.
- class grafeas.grafeas_v1.types.GetOccurrenceNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to get the note to which the specified occurrence is attached.
- class grafeas.grafeas_v1.types.GetOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to get an occurrence.
- class grafeas.grafeas_v1.types.GitSourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
A GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).
- class grafeas.grafeas_v1.types.Hash(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Container message for hash values.
- class grafeas.grafeas_v1.types.ImageNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Basis describes the base image portion (Note) of the DockerImage relationship. Linked occurrences are derived from this or an equivalent image via: FROM <Basis.resource_url> Or an equivalent reference, e.g., a tag of the resource_url.
- resource_url¶
Required. Immutable. The resource_url for the resource representing the basis of associated occurrence images.
- Type
- fingerprint¶
Required. Immutable. The fingerprint of the base image.
- class grafeas.grafeas_v1.types.ImageOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Details of the derived image portion of the DockerImage relationship. This image would be produced from a Dockerfile with FROM <DockerImage.Basis in attached Note>.
- fingerprint¶
Required. The fingerprint of the derived image.
- distance¶
Output only. The number of layers by which this image differs from the associated image basis.
- Type
- layer_info¶
This contains layer-specific metadata, if populated it has length “distance” and is ordered with [distance] being the layer immediately following the base image and [1] being the final layer.
- Type
MutableSequence[grafeas.grafeas_v1.types.Layer]
- class grafeas.grafeas_v1.types.InTotoProvenance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- builder_config¶
required
- recipe¶
Identifies the configuration used for the build. When combined with materials, this SHOULD fully describe the build, such that re-running this recipe results in bit-for-bit identical output (if the build is reproducible).
- metadata¶
- class grafeas.grafeas_v1.types.InTotoStatement(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Spec defined at https://github.com/in-toto/attestation/tree/main/spec#statement The serialized InTotoStatement will be stored as Envelope.payload. Envelope.payloadType is always “application/vnd.in-toto+json”.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- subject¶
- Type
MutableSequence[grafeas.grafeas_v1.types.Subject]
- class grafeas.grafeas_v1.types.Jwt(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- compact_jwt¶
The compact encoding of a JWS, which is always three base64 encoded strings joined by periods. For details, see: https://tools.ietf.org/html/rfc7515.html#section-3.1
- Type
- class grafeas.grafeas_v1.types.Layer(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Layer holds metadata specific to a layer of a Docker image.
- directive¶
Required. The recovered Dockerfile directive used to construct this layer. See https://docs.docker.com/engine/reference/builder/ for more information.
- Type
- class grafeas.grafeas_v1.types.License(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
License information.
- expression¶
Often a single license can be used to represent the licensing terms. Sometimes it is necessary to include a choice of one or more licenses or some combination of license identifiers. Examples: “LGPL-2.1-only OR MIT”, “LGPL-2.1-only AND MIT”, “GPL-2.0-or-later WITH Bison-exception-2.2”.
- Type
- class grafeas.grafeas_v1.types.ListNoteOccurrencesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to list occurrences for a note.
- name¶
The name of the note to list occurrences for in the form of
projects/[PROVIDER_ID]/notes/[NOTE_ID]
.- Type
- class grafeas.grafeas_v1.types.ListNoteOccurrencesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Response for listing occurrences for a note.
- occurrences¶
The occurrences attached to the specified note.
- Type
MutableSequence[grafeas.grafeas_v1.types.Occurrence]
- class grafeas.grafeas_v1.types.ListNotesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to list notes.
- page_size¶
Number of notes to return in the list. Must be positive. Max allowed page size is 1000. If not specified, page size defaults to 20.
- Type
- class grafeas.grafeas_v1.types.ListNotesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Response for listing notes.
- notes¶
The notes requested.
- Type
MutableSequence[grafeas.grafeas_v1.types.Note]
- class grafeas.grafeas_v1.types.ListOccurrencesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to list occurrences.
- parent¶
The name of the project to list occurrences for in the form of
projects/[PROJECT_ID]
.- Type
- page_size¶
Number of occurrences to return in the list. Must be positive. Max allowed page size is 1000. If not specified, page size defaults to 20.
- Type
- class grafeas.grafeas_v1.types.ListOccurrencesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Response for listing occurrences.
- occurrences¶
The occurrences requested.
- Type
MutableSequence[grafeas.grafeas_v1.types.Occurrence]
- class grafeas.grafeas_v1.types.Location(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
An occurrence of a particular package installation found within a system’s filesystem. E.g., glibc was found in
/var/lib/dpkg/status
.- cpe_uri¶
Deprecated. The CPE URI in CPE format
- Type
- version¶
Deprecated. The version installed at this location.
- class grafeas.grafeas_v1.types.Metadata(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Other properties of the build.
- build_invocation_id¶
Identifies the particular build invocation, which can be useful for finding associated logs or other ad-hoc analysis. The value SHOULD be globally unique, per in-toto Provenance spec.
- Type
- build_started_on¶
The timestamp of when the build started.
- build_finished_on¶
The timestamp of when the build completed.
- completeness¶
Indicates that the builder claims certain fields in this message to be complete.
- class grafeas.grafeas_v1.types.NonCompliantFile(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Details about files that caused a compliance check to fail.
- class grafeas.grafeas_v1.types.Note(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
A type of analysis that can be done for a resource.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- name¶
Output only. The name of the note in the form of
projects/[PROVIDER_ID]/notes/[NOTE_ID]
.- Type
- kind¶
Output only. The type of analysis. This field can be used as a filter in list requests.
URLs associated with this note.
- Type
MutableSequence[grafeas.grafeas_v1.types.RelatedUrl]
- expiration_time¶
Time of expiration for this note. Empty if note does not expire.
- create_time¶
Output only. The time this note was created. This field can be used as a filter in list requests.
- update_time¶
Output only. The time this note was last updated. This field can be used as a filter in list requests.
Other notes related to this note.
- Type
MutableSequence[str]
- build¶
A note describing build provenance for a verifiable build.
This field is a member of oneof
type
.
- package¶
A note describing a package hosted by various package managers.
This field is a member of oneof
type
.
- discovery¶
A note describing the initial analysis of a resource.
This field is a member of oneof
type
.
- class grafeas.grafeas_v1.types.NoteKind(value)[source]¶
Bases:
proto.enums.Enum
Kind represents the kinds of notes supported.
- Values:
- NOTE_KIND_UNSPECIFIED (0):
Default value. This value is unused.
- VULNERABILITY (1):
The note and occurrence represent a package vulnerability.
- BUILD (2):
The note and occurrence assert build provenance.
- IMAGE (3):
This represents an image basis relationship.
- PACKAGE (4):
This represents a package installed via a package manager.
- DEPLOYMENT (5):
The note and occurrence track deployment events.
- DISCOVERY (6):
The note and occurrence track the initial discovery status of a resource.
- ATTESTATION (7):
This represents a logical “role” that can attest to artifacts.
- UPGRADE (8):
This represents an available package upgrade.
- COMPLIANCE (9):
This represents a Compliance Note
- DSSE_ATTESTATION (10):
This represents a DSSE attestation Note
- class grafeas.grafeas_v1.types.Occurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
An instance of an analysis type that has been found on a resource.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- name¶
Output only. The name of the occurrence in the form of
projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]
.- Type
- resource_uri¶
Required. Immutable. A URI that represents the resource for which the occurrence applies. For example,
https://gcr.io/project/image@sha256:123abc
for a Docker image.- Type
- note_name¶
Required. Immutable. The analysis note associated with this occurrence, in the form of
projects/[PROVIDER_ID]/notes/[NOTE_ID]
. This field can be used as a filter in list requests.- Type
- kind¶
Output only. This explicitly denotes which of the occurrence details are specified. This field can be used as a filter in list requests.
- create_time¶
Output only. The time this occurrence was created.
- update_time¶
Output only. The time this occurrence was last updated.
- image¶
Describes how this resource derives from the basis in the associated note.
This field is a member of oneof
details
.
- package¶
Describes the installation of a package on the linked resource.
This field is a member of oneof
details
.
- deployment¶
Describes the deployment of an artifact on a runtime.
This field is a member of oneof
details
.
- upgrade¶
Describes an available package upgrade on the linked resource.
This field is a member of oneof
details
.
- compliance¶
Describes a compliance violation on a linked resource.
This field is a member of oneof
details
.
- class grafeas.grafeas_v1.types.PackageNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
PackageNote represents a particular package version.
- distribution¶
Deprecated. The various channels by which a package is distributed.
- Type
MutableSequence[grafeas.grafeas_v1.types.Distribution]
- package_type¶
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
- Type
- cpe_uri¶
The cpe_uri in CPE format denoting the package manager version distributing a package. The cpe_uri will be blank for language packages.
- Type
- architecture¶
The CPU architecture for which packages in this distribution channel were built. Architecture will be blank for language packages.
- version¶
The version of the package.
- license_¶
Licenses that have been declared by the authors of the package.
- digest¶
Hash value, typically a file digest, that allows unique identification a specific package.
- Type
MutableSequence[grafeas.grafeas_v1.types.Digest]
- class grafeas.grafeas_v1.types.PackageOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Details on how a particular software package was installed on a system.
- location¶
All of the places within the filesystem versions of this package have been found.
- Type
MutableSequence[grafeas.grafeas_v1.types.Location]
- package_type¶
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
- Type
- cpe_uri¶
The cpe_uri in CPE format denoting the package manager version distributing a package. The cpe_uri will be blank for language packages.
- Type
- architecture¶
The CPU architecture for which packages in this distribution channel were built. Architecture will be blank for language packages.
- license_¶
Licenses that have been declared by the authors of the package.
- version¶
The version of the package.
- class grafeas.grafeas_v1.types.ProjectRepoId(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Selects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.
- class grafeas.grafeas_v1.types.Recipe(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.
- type_¶
URI indicating what type of recipe was performed. It determines the meaning of recipe.entryPoint, recipe.arguments, recipe.environment, and materials.
- Type
- defined_in_material¶
Index in materials containing the recipe steps that are not implied by recipe.type. For example, if the recipe type were “make”, then this would point to the source containing the Makefile, not the make program itself. Set to -1 if the recipe doesn’t come from a material, as zero is default unset value for int64.
- Type
- entry_point¶
String identifying the entry point into the build. This is often a path to a configuration file and/or a target label within that file. The syntax and meaning are defined by recipe.type. For example, if the recipe type were “make”, then this would reference the directory in which to run make as well as which target to use.
- Type
- arguments¶
Collection of all external inputs that influenced the build on top of recipe.definedInMaterial and recipe.entryPoint. For example, if the recipe type were “make”, then this might be the flags passed to make aside from the target, which is captured in recipe.entryPoint. Since the arguments field can greatly vary in structure, depending on the builder and recipe type, this is of form “Any”.
- Type
MutableSequence[google.protobuf.any_pb2.Any]
- environment¶
Any other builder-controlled inputs necessary for correctly evaluating the recipe. Usually only needed for reproducing the build but not evaluated as part of policy. Since the environment field can greatly vary in structure, depending on the builder and recipe type, this is of form “Any”.
- Type
MutableSequence[google.protobuf.any_pb2.Any]
- class grafeas.grafeas_v1.types.RelatedUrl(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Metadata for any related URL information.
- class grafeas.grafeas_v1.types.RepoId(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
A unique identifier for a Cloud Repo.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- class grafeas.grafeas_v1.types.Signature(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Verifiers (e.g. Kritis implementations) MUST verify signatures with respect to the trust anchors defined in policy (e.g. a Kritis policy). Typically this means that the verifier has been configured with a map from
public_key_id
to public key material (and any required parameters, e.g. signing algorithm).In particular, verification implementations MUST NOT treat the signature
public_key_id
as anything more than a key lookup hint. Thepublic_key_id
DOES NOT validate or authenticate a public key; it only provides a mechanism for quickly selecting a public key ALREADY CONFIGURED on the verifier through a trusted channel. Verification implementations MUST reject signatures in any of the following circumstances:The
public_key_id
is not recognized by the verifier.The public key that
public_key_id
refers to does not verify the signature with respect to the payload.
The
signature
contents SHOULD NOT be “attached” (where the payload is included with the serializedsignature
bytes). Verifiers MUST ignore any “attached” payload and only verify signatures with respect to explicitly provided payload (e.g. apayload
field on the proto message that holds this Signature, or the canonical serialization of the proto message that holds this signature).- signature¶
The content of the signature, an opaque bytestring. The payload that this signature verifies MUST be unambiguously provided with the Signature during verification. A wrapper message might provide the payload explicitly. Alternatively, a message might have a canonical serialization that can always be unambiguously computed to derive the payload.
- Type
- public_key_id¶
The identifier for the public key that verifies this signature.
The
public_key_id
is required.The
public_key_id
SHOULD be an RFC3986 conformant URI.When possible, the
public_key_id
SHOULD be an immutable reference, such as a cryptographic digest.
Examples of valid
public_key_id
s:OpenPGP V4 public key fingerprint:
“openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA” See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more details on this scheme.
RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER serialization):
“ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU”
“nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5”.
- Type
- class grafeas.grafeas_v1.types.SlsaProvenance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- builder¶
required
- recipe¶
Identifies the configuration used for the build. When combined with materials, this SHOULD fully describe the build, such that re-running this recipe results in bit-for-bit identical output (if the build is reproducible).
- metadata¶
- materials¶
The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on. This is considered to be incomplete unless metadata.completeness.materials is true. Unset or null is equivalent to empty.
- Type
MutableSequence[grafeas.grafeas_v1.types.SlsaProvenance.Material]
- class Material(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class SlsaBuilder(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- class SlsaCompleteness(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Indicates that the builder claims certain fields in this message to be complete.
- arguments¶
If true, the builder claims that recipe.arguments is complete, meaning that all external inputs are properly captured in the recipe.
- Type
- environment¶
If true, the builder claims that recipe.environment is claimed to be complete.
- Type
- class SlsaMetadata(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Other properties of the build.
- build_invocation_id¶
Identifies the particular build invocation, which can be useful for finding associated logs or other ad-hoc analysis. The value SHOULD be globally unique, per in-toto Provenance spec.
- Type
- build_started_on¶
The timestamp of when the build started.
- build_finished_on¶
The timestamp of when the build completed.
- completeness¶
Indicates that the builder claims certain fields in this message to be complete.
- class SlsaRecipe(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.
- type_¶
URI indicating what type of recipe was performed. It determines the meaning of recipe.entryPoint, recipe.arguments, recipe.environment, and materials.
- Type
- defined_in_material¶
Index in materials containing the recipe steps that are not implied by recipe.type. For example, if the recipe type were “make”, then this would point to the source containing the Makefile, not the make program itself. Set to -1 if the recipe doesn’t come from a material, as zero is default unset value for int64.
- Type
- entry_point¶
String identifying the entry point into the build. This is often a path to a configuration file and/or a target label within that file. The syntax and meaning are defined by recipe.type. For example, if the recipe type were “make”, then this would reference the directory in which to run make as well as which target to use.
- Type
- arguments¶
Collection of all external inputs that influenced the build on top of recipe.definedInMaterial and recipe.entryPoint. For example, if the recipe type were “make”, then this might be the flags passed to make aside from the target, which is captured in recipe.entryPoint. Depending on the recipe Type, the structure may be different.
- environment¶
Any other builder-controlled inputs necessary for correctly evaluating the recipe. Usually only needed for reproducing the build but not evaluated as part of policy. Depending on the recipe Type, the structure may be different.
- class grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
See full explanation of fields at slsa.dev/provenance/v0.2.
- invocation¶
- build_config¶
- materials¶
- Type
MutableSequence[grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo.SlsaMaterial]
- class SlsaBuilder(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Identifies the entity that executed the recipe, which is trusted to have correctly performed the operation and populated this provenance.
- class SlsaCompleteness(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Indicates that the builder claims certain fields in this message to be complete.
- class SlsaConfigSource(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Describes where the config file that kicked off the build came from. This is effectively a pointer to the source where buildConfig came from.
- class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class SlsaInvocation(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Identifies the event that kicked off the build.
- config_source¶
- parameters¶
- environment¶
- class SlsaMaterial(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on.
- class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.Source(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Source describes the location of the source used for the build.
- artifact_storage_source_uri¶
If provided, the input binary artifacts for the build came from this location.
- Type
- file_hashes¶
Hash(es) of the build source, which can be used to verify that the original source integrity was maintained in the build. The keys to this map are file paths used as build source and the values contain the hash values for those files.
If the build source came in a single package such as a gzipped tarfile (.tar.gz), the FileHash will be for the single path to that file.
- Type
MutableMapping[str, grafeas.grafeas_v1.types.FileHashes]
- context¶
If provided, the source code used for the build came from this location.
- additional_contexts¶
If provided, some of the source code used for the build may be found in these locations, in the case where the source repository had multiple remotes or submodules. This list will not include the context specified in the context field.
- Type
MutableSequence[grafeas.grafeas_v1.types.SourceContext]
- class FileHashesEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.SourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
A SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- cloud_repo¶
A SourceContext referring to a revision in a Google Cloud Source Repo.
This field is a member of oneof
context
.
- git¶
A SourceContext referring to any third party Git repo (e.g., GitHub).
This field is a member of oneof
context
.
- class LabelsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.Subject(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- digest¶
"<ALGORITHM>": "<HEX_VALUE>"
Algorithms can be e.g. sha256, sha512 See https://github.com/in-toto/attestation/blob/main/spec/field_types.md#DigestSet
- class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.UpdateNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to update a note.
- note¶
The updated note.
- update_mask¶
The fields to update.
- class grafeas.grafeas_v1.types.UpdateOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Request to update an occurrence.
- name¶
The name of the occurrence in the form of
projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]
.- Type
- occurrence¶
The updated occurrence.
- update_mask¶
The fields to update.
- class grafeas.grafeas_v1.types.UpgradeDistribution(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities.
- cpe_uri¶
Required - The specific operating system this metadata applies to. See https://cpe.mitre.org/specification/.
- Type
- classification¶
The operating system classification of this Upgrade, as specified by the upstream operating system upgrade feed. For Windows the classification is one of the category_ids listed at https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ff357803(v=vs.85)
- Type
- class grafeas.grafeas_v1.types.UpgradeNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be an Upgrade Note. For Windows, windows_update field represents the information related to the update.
- version¶
Required for non-Windows OS. The version of the package in machine + human readable form.
- distributions¶
Metadata about the upgrade for each specific operating system.
- Type
MutableSequence[grafeas.grafeas_v1.types.UpgradeDistribution]
- windows_update¶
Required for Windows OS. Represents the metadata about the Windows update.
- class grafeas.grafeas_v1.types.UpgradeOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). For Windows, both distribution and windows_update contain information for the Windows update.
- parsed_version¶
Required for non-Windows OS. The version of the package in a machine + human readable form.
- distribution¶
Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
- windows_update¶
Required for Windows OS. Represents the metadata about the Windows update.
- class grafeas.grafeas_v1.types.Version(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Version contains structured information about the version of a package.
- inclusive¶
Whether this version is specifying part of an inclusive range. Grafeas does not have the capability to specify version ranges; instead we have fields that specify start version and end versions. At times this is insufficient - we also need to specify whether the version is included in the range or is excluded from the range. This boolean is expected to be set to true when the version is included in a range.
- Type
- kind¶
Required. Distinguishes between sentinel MIN/MAX versions and normal versions.
- full_name¶
Human readable version string. This string is of the form <epoch>:<name>-<revision> and is only set when kind is NORMAL.
- Type
- class VersionKind(value)[source]¶
Bases:
proto.enums.Enum
Whether this is an ordinary package version or a sentinel MIN/MAX version.
- Values:
- VERSION_KIND_UNSPECIFIED (0):
Unknown.
- NORMAL (1):
A standard package version.
- MINIMUM (2):
A special version representing negative infinity.
- MAXIMUM (3):
A special version representing positive infinity.
- class grafeas.grafeas_v1.types.VulnerabilityNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
A security vulnerability that can be found in resources.
- cvss_score¶
The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.
- Type
- severity¶
The note provider assigned severity of this vulnerability.
- Type
grafeas.grafeas_v1.types.Severity
- details¶
Details of all known distros and packages affected by this vulnerability.
- Type
MutableSequence[grafeas.grafeas_v1.types.VulnerabilityNote.Detail]
- cvss_v3¶
The full description of the CVSSv3 for this vulnerability.
- windows_details¶
Windows details get their own format because the information format and model don’t match a normal detail. Specifically Windows updates are done as patches, thus Windows vulnerabilities really are a missing package, rather than a package being at an incorrect version.
- Type
MutableSequence[grafeas.grafeas_v1.types.VulnerabilityNote.WindowsDetail]
- source_update_time¶
The time this information was last changed at the source. This is an upstream timestamp from the underlying information source - e.g. Ubuntu security tracker.
- cvss_version¶
CVSS version used to populate cvss_score and severity.
- class Detail(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
A detail for a distro and package affected by this vulnerability and its associated fix (if one is available).
- package_type¶
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
- Type
- affected_version_start¶
The version number at the start of an interval in which this vulnerability exists. A vulnerability can affect a package between version numbers that are disjoint sets of intervals (example: [1.0.0-1.1.0], [2.4.6-2.4.8] and [4.5.6-4.6.8]) each of which will be represented in its own Detail. If a specific affected version is provided by a vulnerability database, affected_version_start and affected_version_end will be the same in that Detail.
- affected_version_end¶
The version number at the end of an interval in which this vulnerability exists. A vulnerability can affect a package between version numbers that are disjoint sets of intervals (example: [1.0.0-1.1.0], [2.4.6-2.4.8] and [4.5.6-4.6.8]) each of which will be represented in its own Detail. If a specific affected version is provided by a vulnerability database, affected_version_start and affected_version_end will be the same in that Detail.
- fixed_cpe_uri¶
The distro recommended CPE URI to update to that contains a fix for this vulnerability. It is possible for this to be different from the affected_cpe_uri.
- Type
- fixed_package¶
The distro recommended package to update to that contains a fix for this vulnerability. It is possible for this to be different from the affected_package.
- Type
- fixed_version¶
The distro recommended version to update to that contains a fix for this vulnerability. Setting this to VersionKind.MAXIMUM means no such version is yet available.
- is_obsolete¶
Whether this detail is obsolete. Occurrences are expected not to point to obsolete details.
- Type
- source_update_time¶
The time this information was last changed at the source. This is an upstream timestamp from the underlying information source - e.g. Ubuntu security tracker.
- class WindowsDetail(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- fixing_kbs¶
Required. The names of the KBs which have hotfixes to mitigate this vulnerability. Note that there may be multiple hotfixes (and thus multiple KBs) that mitigate a given vulnerability. Currently any listed KBs presence is considered a fix.
- Type
MutableSequence[grafeas.grafeas_v1.types.VulnerabilityNote.WindowsDetail.KnowledgeBase]
- class KnowledgeBase(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- url¶
A link to the KB in the [Windows update catalog] (https://www.catalog.update.microsoft.com/).
- Type
- class grafeas.grafeas_v1.types.VulnerabilityOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
An occurrence of a severity vulnerability on a resource.
- type_¶
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
- Type
- severity¶
Output only. The note provider assigned severity of this vulnerability.
- Type
grafeas.grafeas_v1.types.Severity
- cvss_score¶
Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.
- Type
- cvssv3¶
The cvss v3 score for the vulnerability.
- package_issue¶
Required. The set of affected locations and their fixes (if available) within the associated resource.
- Type
MutableSequence[grafeas.grafeas_v1.types.VulnerabilityOccurrence.PackageIssue]
Output only. URLs related to this vulnerability.
- Type
MutableSequence[grafeas.grafeas_v1.types.RelatedUrl]
- effective_severity¶
The distro assigned severity for this vulnerability when it is available, otherwise this is the note provider assigned severity. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
- Type
grafeas.grafeas_v1.types.Severity
- fix_available¶
Output only. Whether at least one of the affected packages has a fix available.
- Type
- cvss_version¶
Output only. CVSS version used to populate cvss_score and severity.
- class PackageIssue(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
A detail for a distro and package this vulnerability occurrence was found in and its associated fix (if one is available).
- affected_version¶
Required. The version of the package that is installed on the resource affected by this vulnerability.
- fixed_cpe_uri¶
The CPE URI this vulnerability was fixed in. It is possible for this to be different from the affected_cpe_uri.
- Type
- fixed_package¶
The package this vulnerability was fixed in. It is possible for this to be different from the affected_package.
- Type
- fixed_version¶
Required. The version of the package this vulnerability was fixed in. Setting this to VersionKind.MAXIMUM means no fix is yet available.
- effective_severity¶
The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
- Type
grafeas.grafeas_v1.types.Severity
- file_location¶
The location at which this package was found.
- Type
MutableSequence[grafeas.grafeas_v1.types.FileLocation]
- class grafeas.grafeas_v1.types.WindowsUpdate(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
Windows Update represents the metadata about the update for the Windows operating system. The fields in this message come from the Windows Update API documented at https://docs.microsoft.com/en-us/windows/win32/api/wuapi/nn-wuapi-iupdate.
- identity¶
Required - The unique identifier for the update.
- categories¶
The list of categories to which the update belongs.
- Type
MutableSequence[grafeas.grafeas_v1.types.WindowsUpdate.Category]
- kb_article_ids¶
The Microsoft Knowledge Base article IDs that are associated with the update.
- Type
MutableSequence[str]
- last_published_timestamp¶
The last published timestamp of the update.
- class Category(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
The category to which the update belongs.