As of January 1, 2020 this library no longer supports Python 2 on the latest released version. Library versions released prior to that date will continue to be available. For more information please visit Python 2 support on Google Cloud.

Types for Grafeas Grafeas v1 API

class grafeas.grafeas_v1.types.AliasContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

An alias to a repo revision.

kind

The alias kind.

Type

grafeas.grafeas_v1.types.AliasContext.Kind

name

The alias name.

Type

str

class Kind(value)[source]

Bases: proto.enums.Enum

The type of an alias.

Values:
KIND_UNSPECIFIED (0):

Unknown.

FIXED (1):

Git tag.

MOVABLE (2):

Git branch.

OTHER (4):

Used to specify non-standard aliases. For example, if a Git repo has a ref named “refs/foo/bar”.

class grafeas.grafeas_v1.types.Architecture(value)[source]

Bases: proto.enums.Enum

Instruction set architectures supported by various package managers.

Values:
ARCHITECTURE_UNSPECIFIED (0):

Unknown architecture.

X86 (1):

X86 architecture.

X64 (2):

X64 architecture.

class grafeas.grafeas_v1.types.Artifact(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Artifact describes a build product.

checksum

Hash or checksum value of a binary, or Docker Registry 2.0 digest of a container.

Type

str

id

Artifact ID, if any; for container images, this will be a URL by digest like gcr.io/projectID/imagename@sha256:123456.

Type

str

names

Related artifact names. This may be the path to a binary or jar file, or in the case of a container build, the name used to push the container image to Google Container Registry, as presented to docker push. Note that a single Artifact ID can have multiple names, for example if two tags are applied to one image.

Type

MutableSequence[str]

class grafeas.grafeas_v1.types.AttestationNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Note kind that represents a logical attestation “role” or “authority”. For example, an organization might have one Authority for “QA” and one for “build”. This note is intended to act strictly as a grouping mechanism for the attached occurrences (Attestations). This grouping mechanism also provides a security boundary, since IAM ACLs gate the ability for a principle to attach an occurrence to a given note. It also provides a single point of lookup to find all attached attestation occurrences, even if they don’t all live in the same project.

hint

Hint hints at the purpose of the attestation authority.

Type

grafeas.grafeas_v1.types.AttestationNote.Hint

class Hint(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from “readable” names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.

human_readable_name

Required. The human readable name of this attestation authority, for example “qa”.

Type

str

class grafeas.grafeas_v1.types.AttestationOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Occurrence that represents a single “attestation”. The authenticity of an attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the authority to which this attestation is attached is primarily useful for lookup (how to find this attestation if you already know the authority and artifact to be verified) and intent (for which authority this attestation was intended to sign.

serialized_payload

Required. The serialized payload that is verified by one or more signatures.

Type

bytes

signatures

One or more signatures over serialized_payload. Verifier implementations should consider this attestation message verified if at least one signature verifies serialized_payload. See Signature in common.proto for more details on signature structure and verification.

Type

MutableSequence[grafeas.grafeas_v1.types.Signature]

jwts

One or more JWTs encoding a self-contained attestation. Each JWT encodes the payload that it verifies within the JWT itself. Verifier implementation SHOULD ignore the serialized_payload field when verifying these JWTs. If only JWTs are present on this AttestationOccurrence, then the serialized_payload SHOULD be left empty. Each JWT SHOULD encode a claim specific to the resource_uri of this Occurrence, but this is not validated by Grafeas metadata API implementations. The JWT itself is opaque to Grafeas.

Type

MutableSequence[grafeas.grafeas_v1.types.Jwt]

class grafeas.grafeas_v1.types.BatchCreateNotesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to create notes in batch.

parent

The name of the project in the form of projects/[PROJECT_ID], under which the notes are to be created.

Type

str

notes

The notes to create. Max allowed length is 1000.

Type

MutableMapping[str, grafeas.grafeas_v1.types.Note]

class NotesEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

class grafeas.grafeas_v1.types.BatchCreateNotesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Response for creating notes in batch.

notes

The notes that were created.

Type

MutableSequence[grafeas.grafeas_v1.types.Note]

class grafeas.grafeas_v1.types.BatchCreateOccurrencesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to create occurrences in batch.

parent

The name of the project in the form of projects/[PROJECT_ID], under which the occurrences are to be created.

Type

str

occurrences

The occurrences to create. Max allowed length is 1000.

Type

MutableSequence[grafeas.grafeas_v1.types.Occurrence]

class grafeas.grafeas_v1.types.BatchCreateOccurrencesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Response for creating occurrences in batch.

occurrences

The occurrences that were created.

Type

MutableSequence[grafeas.grafeas_v1.types.Occurrence]

class grafeas.grafeas_v1.types.BuildNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Note holding the version of the provider’s builder and the signature of the provenance message in the build details occurrence.

builder_version

Required. Immutable. Version of the builder which produced this build.

Type

str

class grafeas.grafeas_v1.types.BuildOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Details of a build occurrence.

provenance

The actual provenance for the build.

Type

grafeas.grafeas_v1.types.BuildProvenance

provenance_bytes

Serialized JSON representation of the provenance, used in generating the build signature in the corresponding build note. After verifying the signature, provenance_bytes can be unmarshalled and compared to the provenance to confirm that it is unchanged. A base64-encoded string representation of the provenance bytes is used for the signature in order to interoperate with openssl which expects this format for signature verification.

The serialized form is captured both to avoid ambiguity in how the provenance is marshalled to json as well to prevent incompatibilities with future changes.

Type

str

intoto_provenance

Deprecated. See InTotoStatement for the replacement. In-toto Provenance representation as defined in spec.

Type

grafeas.grafeas_v1.types.InTotoProvenance

intoto_statement

In-toto Statement representation as defined in spec. The intoto_statement can contain any type of provenance. The serialized payload of the statement can be stored and signed in the Occurrence’s envelope.

Type

grafeas.grafeas_v1.types.InTotoStatement

class grafeas.grafeas_v1.types.BuildProvenance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Provenance of a build. Contains all information needed to verify the full details about the build from source to completion.

id

Required. Unique identifier of the build.

Type

str

project_id

ID of the project.

Type

str

commands

Commands requested by the build.

Type

MutableSequence[grafeas.grafeas_v1.types.Command]

built_artifacts

Output of the build.

Type

MutableSequence[grafeas.grafeas_v1.types.Artifact]

create_time

Time at which the build was created.

Type

google.protobuf.timestamp_pb2.Timestamp

start_time

Time at which execution of the build was started.

Type

google.protobuf.timestamp_pb2.Timestamp

end_time

Time at which execution of the build was finished.

Type

google.protobuf.timestamp_pb2.Timestamp

creator

E-mail address of the user who initiated this build. Note that this was the user’s e-mail address at the time the build was initiated; this address may not represent the same end-user for all time.

Type

str

logs_uri

URI where any logs for this provenance were written.

Type

str

source_provenance

Details of the Source input to the build.

Type

grafeas.grafeas_v1.types.Source

trigger_id

Trigger identifier if the build was triggered automatically; empty if not.

Type

str

build_options

Special options applied to this build. This is a catch-all field where build providers can enter any desired additional details.

Type

MutableMapping[str, str]

builder_version

Version string of the builder at the time this build was executed.

Type

str

class BuildOptionsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

class grafeas.grafeas_v1.types.BuilderConfig(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

id
Type

str

class grafeas.grafeas_v1.types.CVSS(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Common Vulnerability Scoring System. For details, see https://www.first.org/cvss/specification-document This is a message we will try to use for storing various versions of CVSS rather than making a separate proto for storing a specific version.

base_score

The base score is a function of the base metric scores.

Type

float

exploitability_score
Type

float

impact_score
Type

float

attack_vector

Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments.

Type

grafeas.grafeas_v1.types.CVSS.AttackVector

attack_complexity
Type

grafeas.grafeas_v1.types.CVSS.AttackComplexity

authentication
Type

grafeas.grafeas_v1.types.CVSS.Authentication

privileges_required
Type

grafeas.grafeas_v1.types.CVSS.PrivilegesRequired

user_interaction
Type

grafeas.grafeas_v1.types.CVSS.UserInteraction

scope
Type

grafeas.grafeas_v1.types.CVSS.Scope

confidentiality_impact
Type

grafeas.grafeas_v1.types.CVSS.Impact

integrity_impact
Type

grafeas.grafeas_v1.types.CVSS.Impact

availability_impact
Type

grafeas.grafeas_v1.types.CVSS.Impact

class AttackComplexity(value)[source]

Bases: proto.enums.Enum

Values:

ATTACK_COMPLEXITY_UNSPECIFIED (0):

ATTACK_COMPLEXITY_LOW (1):

ATTACK_COMPLEXITY_HIGH (2):

class AttackVector(value)[source]

Bases: proto.enums.Enum

Values:

ATTACK_VECTOR_UNSPECIFIED (0):

ATTACK_VECTOR_NETWORK (1):

ATTACK_VECTOR_ADJACENT (2):

ATTACK_VECTOR_LOCAL (3):

ATTACK_VECTOR_PHYSICAL (4):

class Authentication(value)[source]

Bases: proto.enums.Enum

Values:

AUTHENTICATION_UNSPECIFIED (0):

AUTHENTICATION_MULTIPLE (1):

AUTHENTICATION_SINGLE (2):

AUTHENTICATION_NONE (3):

class Impact(value)[source]

Bases: proto.enums.Enum

Values:

IMPACT_UNSPECIFIED (0):

IMPACT_HIGH (1):

IMPACT_LOW (2):

IMPACT_NONE (3):

class PrivilegesRequired(value)[source]

Bases: proto.enums.Enum

Values:

PRIVILEGES_REQUIRED_UNSPECIFIED (0):

PRIVILEGES_REQUIRED_NONE (1):

PRIVILEGES_REQUIRED_LOW (2):

PRIVILEGES_REQUIRED_HIGH (3):

class Scope(value)[source]

Bases: proto.enums.Enum

Values:

SCOPE_UNSPECIFIED (0):

SCOPE_UNCHANGED (1):

SCOPE_CHANGED (2):

class UserInteraction(value)[source]

Bases: proto.enums.Enum

Values:

USER_INTERACTION_UNSPECIFIED (0):

USER_INTERACTION_NONE (1):

USER_INTERACTION_REQUIRED (2):

class grafeas.grafeas_v1.types.CVSSVersion(value)[source]

Bases: proto.enums.Enum

CVSS Version.

Values:

CVSS_VERSION_UNSPECIFIED (0):

CVSS_VERSION_2 (1):

CVSS_VERSION_3 (2):

class grafeas.grafeas_v1.types.CVSSv3(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Common Vulnerability Scoring System version 3. For details, see https://www.first.org/cvss/specification-document

base_score

The base score is a function of the base metric scores.

Type

float

exploitability_score
Type

float

impact_score
Type

float

attack_vector

Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments.

Type

grafeas.grafeas_v1.types.CVSSv3.AttackVector

attack_complexity
Type

grafeas.grafeas_v1.types.CVSSv3.AttackComplexity

privileges_required
Type

grafeas.grafeas_v1.types.CVSSv3.PrivilegesRequired

user_interaction
Type

grafeas.grafeas_v1.types.CVSSv3.UserInteraction

scope
Type

grafeas.grafeas_v1.types.CVSSv3.Scope

confidentiality_impact
Type

grafeas.grafeas_v1.types.CVSSv3.Impact

integrity_impact
Type

grafeas.grafeas_v1.types.CVSSv3.Impact

availability_impact
Type

grafeas.grafeas_v1.types.CVSSv3.Impact

class AttackComplexity(value)[source]

Bases: proto.enums.Enum

Values:

ATTACK_COMPLEXITY_UNSPECIFIED (0):

ATTACK_COMPLEXITY_LOW (1):

ATTACK_COMPLEXITY_HIGH (2):

class AttackVector(value)[source]

Bases: proto.enums.Enum

Values:

ATTACK_VECTOR_UNSPECIFIED (0):

ATTACK_VECTOR_NETWORK (1):

ATTACK_VECTOR_ADJACENT (2):

ATTACK_VECTOR_LOCAL (3):

ATTACK_VECTOR_PHYSICAL (4):

class Impact(value)[source]

Bases: proto.enums.Enum

Values:

IMPACT_UNSPECIFIED (0):

IMPACT_HIGH (1):

IMPACT_LOW (2):

IMPACT_NONE (3):

class PrivilegesRequired(value)[source]

Bases: proto.enums.Enum

Values:

PRIVILEGES_REQUIRED_UNSPECIFIED (0):

PRIVILEGES_REQUIRED_NONE (1):

PRIVILEGES_REQUIRED_LOW (2):

PRIVILEGES_REQUIRED_HIGH (3):

class Scope(value)[source]

Bases: proto.enums.Enum

Values:

SCOPE_UNSPECIFIED (0):

SCOPE_UNCHANGED (1):

SCOPE_CHANGED (2):

class UserInteraction(value)[source]

Bases: proto.enums.Enum

Values:

USER_INTERACTION_UNSPECIFIED (0):

USER_INTERACTION_NONE (1):

USER_INTERACTION_REQUIRED (2):

class grafeas.grafeas_v1.types.CloudRepoSourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

repo_id

The ID of the repo.

Type

grafeas.grafeas_v1.types.RepoId

revision_id

A revision ID.

This field is a member of oneof revision.

Type

str

alias_context

An alias, which may be a branch or tag.

This field is a member of oneof revision.

Type

grafeas.grafeas_v1.types.AliasContext

class grafeas.grafeas_v1.types.Command(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Command describes a step performed as part of the build pipeline.

name

Required. Name of the command, as presented on the command line, or if the command is packaged as a Docker container, as presented to docker pull.

Type

str

env

Environment variables set before running this command.

Type

MutableSequence[str]

args

Command-line arguments used when executing this command.

Type

MutableSequence[str]

dir_

Working directory (relative to project source root) used when running this command.

Type

str

id

Optional unique identifier for this command, used in wait_for to reference this command as a dependency.

Type

str

wait_for

The ID(s) of the command(s) that this command depends on.

Type

MutableSequence[str]

class grafeas.grafeas_v1.types.Completeness(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Indicates that the builder claims certain fields in this message to be complete.

arguments

If true, the builder claims that recipe.arguments is complete, meaning that all external inputs are properly captured in the recipe.

Type

bool

environment

If true, the builder claims that recipe.environment is claimed to be complete.

Type

bool

materials

If true, the builder claims that materials are complete, usually through some controls to prevent network access. Sometimes called “hermetic”.

Type

bool

class grafeas.grafeas_v1.types.ComplianceNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

title

The title that identifies this compliance check.

Type

str

description

A description about this compliance check.

Type

str

version

The OS and config versions the benchmark applies to.

Type

MutableSequence[grafeas.grafeas_v1.types.ComplianceVersion]

rationale

A rationale for the existence of this compliance check.

Type

str

remediation

A description of remediation steps if the compliance check fails.

Type

str

cis_benchmark

This field is a member of oneof compliance_type.

Type

grafeas.grafeas_v1.types.ComplianceNote.CisBenchmark

scan_instructions

Serialized scan instructions with a predefined format.

Type

bytes

class CisBenchmark(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A compliance check that is a CIS benchmark.

profile_level
Type

int

severity
Type

grafeas.grafeas_v1.types.Severity

class grafeas.grafeas_v1.types.ComplianceOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

An indication that the compliance checks in the associated ComplianceNote were not satisfied for particular resources or a specified reason.

non_compliant_files
Type

MutableSequence[grafeas.grafeas_v1.types.NonCompliantFile]

non_compliance_reason
Type

str

class grafeas.grafeas_v1.types.ComplianceVersion(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Describes the CIS benchmark version that is applicable to a given OS and os version.

cpe_uri

The CPE URI (https://cpe.mitre.org/specification/) this benchmark is applicable to.

Type

str

benchmark_document

The name of the document that defines this benchmark, e.g. “CIS Container-Optimized OS”.

Type

str

version

The version of the benchmark. This is set to the version of the OS-specific CIS document the benchmark is defined in.

Type

str

class grafeas.grafeas_v1.types.CreateNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to create a new note.

parent

The name of the project in the form of projects/[PROJECT_ID], under which the note is to be created.

Type

str

note_id

The ID to use for this note.

Type

str

note

The note to create.

Type

grafeas.grafeas_v1.types.Note

class grafeas.grafeas_v1.types.CreateOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to create a new occurrence.

parent

The name of the project in the form of projects/[PROJECT_ID], under which the occurrence is to be created.

Type

str

occurrence

The occurrence to create.

Type

grafeas.grafeas_v1.types.Occurrence

class grafeas.grafeas_v1.types.DSSEAttestationNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

hint

DSSEHint hints at the purpose of the attestation authority.

Type

grafeas.grafeas_v1.types.DSSEAttestationNote.DSSEHint

class DSSEHint(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from “readable” names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.

human_readable_name

Required. The human readable name of this attestation authority, for example “cloudbuild-prod”.

Type

str

class grafeas.grafeas_v1.types.DSSEAttestationOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Deprecated. Prefer to use a regular Occurrence, and populate the Envelope at the top level of the Occurrence.

envelope

If doing something security critical, make sure to verify the signatures in this metadata.

Type

grafeas.grafeas_v1.types.Envelope

statement

This field is a member of oneof decoded_payload.

Type

grafeas.grafeas_v1.types.InTotoStatement

class grafeas.grafeas_v1.types.DeleteNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to delete a note.

name

The name of the note in the form of projects/[PROVIDER_ID]/notes/[NOTE_ID].

Type

str

class grafeas.grafeas_v1.types.DeleteOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to delete an occurrence.

name

The name of the occurrence in the form of projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID].

Type

str

class grafeas.grafeas_v1.types.DeploymentNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

An artifact that can be deployed in some runtime.

resource_uri

Required. Resource URI for the artifact being deployed.

Type

MutableSequence[str]

class grafeas.grafeas_v1.types.DeploymentOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

The period during which some deployable was active in a runtime.

user_email

Identity of the user that triggered this deployment.

Type

str

deploy_time

Required. Beginning of the lifetime of this deployment.

Type

google.protobuf.timestamp_pb2.Timestamp

undeploy_time

End of the lifetime of this deployment.

Type

google.protobuf.timestamp_pb2.Timestamp

config

Configuration used to create this deployment.

Type

str

address

Address of the runtime element hosting this deployment.

Type

str

resource_uri

Output only. Resource URI for the artifact being deployed taken from the deployable field with the same name.

Type

MutableSequence[str]

platform

Platform hosting this deployment.

Type

grafeas.grafeas_v1.types.DeploymentOccurrence.Platform

class Platform(value)[source]

Bases: proto.enums.Enum

Types of platforms.

Values:
PLATFORM_UNSPECIFIED (0):

Unknown.

GKE (1):

Google Container Engine.

FLEX (2):

Google App Engine: Flexible Environment.

CUSTOM (3):

Custom user-defined platform.

class grafeas.grafeas_v1.types.Digest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Digest information.

algo

SHA1, SHA512 etc.

Type

str

digest_bytes

Value of the digest.

Type

bytes

class grafeas.grafeas_v1.types.DiscoveryNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A note that indicates a type of analysis a provider would perform. This note exists in a provider’s project. A Discovery occurrence is created in a consumer’s project at the start of analysis.

analysis_kind

Required. Immutable. The kind of analysis that is handled by this discovery.

Type

grafeas.grafeas_v1.types.NoteKind

class grafeas.grafeas_v1.types.DiscoveryOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Provides information about the analysis status of a discovered resource.

continuous_analysis

Whether the resource is continuously analyzed.

Type

grafeas.grafeas_v1.types.DiscoveryOccurrence.ContinuousAnalysis

analysis_status

The status of discovery for the resource.

Type

grafeas.grafeas_v1.types.DiscoveryOccurrence.AnalysisStatus

analysis_completed
Type

grafeas.grafeas_v1.types.DiscoveryOccurrence.AnalysisCompleted

analysis_error

Indicates any errors encountered during analysis of a resource. There could be 0 or more of these errors.

Type

MutableSequence[google.rpc.status_pb2.Status]

analysis_status_error

When an error is encountered this will contain a LocalizedMessage under details to show to the user. The LocalizedMessage is output only and populated by the API.

Type

google.rpc.status_pb2.Status

cpe

The CPE of the resource being scanned.

Type

str

last_scan_time

The last time this resource was scanned.

Type

google.protobuf.timestamp_pb2.Timestamp

archive_time

The time occurrences related to this discovery occurrence were archived.

Type

google.protobuf.timestamp_pb2.Timestamp

class AnalysisCompleted(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Indicates which analysis completed successfully. Multiple types of analysis can be performed on a single resource.

analysis_type
Type

MutableSequence[str]

class AnalysisStatus(value)[source]

Bases: proto.enums.Enum

Analysis status for a resource. Currently for initial analysis only (not updated in continuous analysis).

Values:
ANALYSIS_STATUS_UNSPECIFIED (0):

Unknown.

PENDING (1):

Resource is known but no action has been taken yet.

SCANNING (2):

Resource is being analyzed.

FINISHED_SUCCESS (3):

Analysis has finished successfully.

COMPLETE (3):

Analysis has completed.

FINISHED_FAILED (4):

Analysis has finished unsuccessfully, the analysis itself is in a bad state.

FINISHED_UNSUPPORTED (5):

The resource is known not to be supported.

class ContinuousAnalysis(value)[source]

Bases: proto.enums.Enum

Whether the resource is continuously analyzed.

Values:
CONTINUOUS_ANALYSIS_UNSPECIFIED (0):

Unknown.

ACTIVE (1):

The resource is continuously analyzed.

INACTIVE (2):

The resource is ignored for continuous analysis.

class grafeas.grafeas_v1.types.Distribution(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

This represents a particular channel of distribution for a given package. E.g., Debian’s jessie-backports dpkg mirror.

cpe_uri

The cpe_uri in CPE format denoting the package manager version distributing a package.

Type

str

architecture

The CPU architecture for which packages in this distribution channel were built.

Type

grafeas.grafeas_v1.types.Architecture

latest_version

The latest available version of this package in this distribution channel.

Type

grafeas.grafeas_v1.types.Version

maintainer

A freeform string denoting the maintainer of this package.

Type

str

url

The distribution channel-specific homepage for this package.

Type

str

description

The distribution channel-specific description of this package.

Type

str

class grafeas.grafeas_v1.types.Envelope(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

MUST match https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An authenticated message of arbitrary type.

payload
Type

bytes

payload_type
Type

str

signatures
Type

MutableSequence[grafeas.grafeas_v1.types.EnvelopeSignature]

class grafeas.grafeas_v1.types.EnvelopeSignature(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

sig
Type

bytes

keyid
Type

str

class grafeas.grafeas_v1.types.FileHashes(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Container message for hashes of byte content of files, used in source messages to verify integrity of source input to the build.

file_hash

Required. Collection of file hashes.

Type

MutableSequence[grafeas.grafeas_v1.types.Hash]

class grafeas.grafeas_v1.types.FileLocation(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Indicates the location at which a package was found.

file_path

For jars that are contained inside .war files, this filepath can indicate the path to war file combined with the path to jar file.

Type

str

class grafeas.grafeas_v1.types.Fingerprint(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A set of properties that uniquely identify a given Docker image.

v1_name

Required. The layer ID of the final layer in the Docker image’s v1 representation.

Type

str

v2_blob

Required. The ordered list of v2 blobs that represent a given image.

Type

MutableSequence[str]

v2_name

Output only. The name of the image’s v2 blobs computed via: [bottom] := v2_blob[bottom] [N] := sha256(v2_blob[N] + ” ” + v2_name[N+1]) Only the name of the final blob is kept.

Type

str

class grafeas.grafeas_v1.types.GerritSourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A SourceContext referring to a Gerrit project.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

host_uri

The URI of a running Gerrit instance.

Type

str

gerrit_project

The full project name within the host. Projects may be nested, so “project/subproject” is a valid project name. The “repo name” is the hostURI/project.

Type

str

revision_id

A revision (commit) ID.

This field is a member of oneof revision.

Type

str

alias_context

An alias, which may be a branch or tag.

This field is a member of oneof revision.

Type

grafeas.grafeas_v1.types.AliasContext

class grafeas.grafeas_v1.types.GetNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to get a note.

name

The name of the note in the form of projects/[PROVIDER_ID]/notes/[NOTE_ID].

Type

str

class grafeas.grafeas_v1.types.GetOccurrenceNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to get the note to which the specified occurrence is attached.

name

The name of the occurrence in the form of projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID].

Type

str

class grafeas.grafeas_v1.types.GetOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to get an occurrence.

name

The name of the occurrence in the form of projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID].

Type

str

class grafeas.grafeas_v1.types.GitSourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).

url

Git repository URL.

Type

str

revision_id

Git commit hash.

Type

str

class grafeas.grafeas_v1.types.Hash(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Container message for hash values.

type_

Required. The type of hash that was performed, e.g. “SHA-256”.

Type

str

value

Required. The hash value.

Type

bytes

class grafeas.grafeas_v1.types.ImageNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Basis describes the base image portion (Note) of the DockerImage relationship. Linked occurrences are derived from this or an equivalent image via: FROM <Basis.resource_url> Or an equivalent reference, e.g., a tag of the resource_url.

resource_url

Required. Immutable. The resource_url for the resource representing the basis of associated occurrence images.

Type

str

fingerprint

Required. Immutable. The fingerprint of the base image.

Type

grafeas.grafeas_v1.types.Fingerprint

class grafeas.grafeas_v1.types.ImageOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Details of the derived image portion of the DockerImage relationship. This image would be produced from a Dockerfile with FROM <DockerImage.Basis in attached Note>.

fingerprint

Required. The fingerprint of the derived image.

Type

grafeas.grafeas_v1.types.Fingerprint

distance

Output only. The number of layers by which this image differs from the associated image basis.

Type

int

layer_info

This contains layer-specific metadata, if populated it has length “distance” and is ordered with [distance] being the layer immediately following the base image and [1] being the final layer.

Type

MutableSequence[grafeas.grafeas_v1.types.Layer]

base_resource_url

Output only. This contains the base image URL for the derived image occurrence.

Type

str

class grafeas.grafeas_v1.types.InTotoProvenance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

builder_config

required

Type

grafeas.grafeas_v1.types.BuilderConfig

recipe

Identifies the configuration used for the build. When combined with materials, this SHOULD fully describe the build, such that re-running this recipe results in bit-for-bit identical output (if the build is reproducible).

Type

grafeas.grafeas_v1.types.Recipe

metadata
Type

grafeas.grafeas_v1.types.Metadata

materials

The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on. This is considered to be incomplete unless metadata.completeness.materials is true. Unset or null is equivalent to empty.

Type

MutableSequence[str]

class grafeas.grafeas_v1.types.InTotoStatement(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Spec defined at https://github.com/in-toto/attestation/tree/main/spec#statement The serialized InTotoStatement will be stored as Envelope.payload. Envelope.payloadType is always “application/vnd.in-toto+json”.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

type_

Always https://in-toto.io/Statement/v0.1.

Type

str

subject
Type

MutableSequence[grafeas.grafeas_v1.types.Subject]

predicate_type

https://slsa.dev/provenance/v0.1 for SlsaProvenance.

Type

str

provenance

This field is a member of oneof predicate.

Type

grafeas.grafeas_v1.types.InTotoProvenance

slsa_provenance

This field is a member of oneof predicate.

Type

grafeas.grafeas_v1.types.SlsaProvenance

slsa_provenance_zero_two

This field is a member of oneof predicate.

Type

grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo

class grafeas.grafeas_v1.types.Jwt(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

compact_jwt

The compact encoding of a JWS, which is always three base64 encoded strings joined by periods. For details, see: https://tools.ietf.org/html/rfc7515.html#section-3.1

Type

str

class grafeas.grafeas_v1.types.Layer(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Layer holds metadata specific to a layer of a Docker image.

directive

Required. The recovered Dockerfile directive used to construct this layer. See https://docs.docker.com/engine/reference/builder/ for more information.

Type

str

arguments

The recovered arguments to the Dockerfile directive.

Type

str

class grafeas.grafeas_v1.types.License(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

License information.

expression

Often a single license can be used to represent the licensing terms. Sometimes it is necessary to include a choice of one or more licenses or some combination of license identifiers. Examples: “LGPL-2.1-only OR MIT”, “LGPL-2.1-only AND MIT”, “GPL-2.0-or-later WITH Bison-exception-2.2”.

Type

str

comments

Comments

Type

str

class grafeas.grafeas_v1.types.ListNoteOccurrencesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to list occurrences for a note.

name

The name of the note to list occurrences for in the form of projects/[PROVIDER_ID]/notes/[NOTE_ID].

Type

str

filter

The filter expression.

Type

str

page_size

Number of occurrences to return in the list.

Type

int

page_token

Token to provide to skip to a particular spot in the list.

Type

str

class grafeas.grafeas_v1.types.ListNoteOccurrencesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Response for listing occurrences for a note.

occurrences

The occurrences attached to the specified note.

Type

MutableSequence[grafeas.grafeas_v1.types.Occurrence]

next_page_token

Token to provide to skip to a particular spot in the list.

Type

str

class grafeas.grafeas_v1.types.ListNotesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to list notes.

parent

The name of the project to list notes for in the form of projects/[PROJECT_ID].

Type

str

filter

The filter expression.

Type

str

page_size

Number of notes to return in the list. Must be positive. Max allowed page size is 1000. If not specified, page size defaults to 20.

Type

int

page_token

Token to provide to skip to a particular spot in the list.

Type

str

class grafeas.grafeas_v1.types.ListNotesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Response for listing notes.

notes

The notes requested.

Type

MutableSequence[grafeas.grafeas_v1.types.Note]

next_page_token

The next pagination token in the list response. It should be used as page_token for the following request. An empty value means no more results.

Type

str

class grafeas.grafeas_v1.types.ListOccurrencesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to list occurrences.

parent

The name of the project to list occurrences for in the form of projects/[PROJECT_ID].

Type

str

filter

The filter expression.

Type

str

page_size

Number of occurrences to return in the list. Must be positive. Max allowed page size is 1000. If not specified, page size defaults to 20.

Type

int

page_token

Token to provide to skip to a particular spot in the list.

Type

str

class grafeas.grafeas_v1.types.ListOccurrencesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Response for listing occurrences.

occurrences

The occurrences requested.

Type

MutableSequence[grafeas.grafeas_v1.types.Occurrence]

next_page_token

The next pagination token in the list response. It should be used as page_token for the following request. An empty value means no more results.

Type

str

class grafeas.grafeas_v1.types.Location(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

An occurrence of a particular package installation found within a system’s filesystem. E.g., glibc was found in /var/lib/dpkg/status.

cpe_uri

Deprecated. The CPE URI in CPE format

Type

str

version

Deprecated. The version installed at this location.

Type

grafeas.grafeas_v1.types.Version

path

The path from which we gathered that this package/version is installed.

Type

str

class grafeas.grafeas_v1.types.Metadata(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Other properties of the build.

build_invocation_id

Identifies the particular build invocation, which can be useful for finding associated logs or other ad-hoc analysis. The value SHOULD be globally unique, per in-toto Provenance spec.

Type

str

build_started_on

The timestamp of when the build started.

Type

google.protobuf.timestamp_pb2.Timestamp

build_finished_on

The timestamp of when the build completed.

Type

google.protobuf.timestamp_pb2.Timestamp

completeness

Indicates that the builder claims certain fields in this message to be complete.

Type

grafeas.grafeas_v1.types.Completeness

reproducible

If true, the builder claims that running the recipe on materials will produce bit-for-bit identical output.

Type

bool

class grafeas.grafeas_v1.types.NonCompliantFile(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Details about files that caused a compliance check to fail.

path

Empty if display_command is set.

Type

str

display_command

Command to display the non-compliant files.

Type

str

reason

Explains why a file is non compliant for a CIS check.

Type

str

class grafeas.grafeas_v1.types.Note(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A type of analysis that can be done for a resource.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

name

Output only. The name of the note in the form of projects/[PROVIDER_ID]/notes/[NOTE_ID].

Type

str

short_description

A one sentence description of this note.

Type

str

long_description

A detailed description of this note.

Type

str

kind

Output only. The type of analysis. This field can be used as a filter in list requests.

Type

grafeas.grafeas_v1.types.NoteKind

related_url

URLs associated with this note.

Type

MutableSequence[grafeas.grafeas_v1.types.RelatedUrl]

expiration_time

Time of expiration for this note. Empty if note does not expire.

Type

google.protobuf.timestamp_pb2.Timestamp

create_time

Output only. The time this note was created. This field can be used as a filter in list requests.

Type

google.protobuf.timestamp_pb2.Timestamp

update_time

Output only. The time this note was last updated. This field can be used as a filter in list requests.

Type

google.protobuf.timestamp_pb2.Timestamp

related_note_names

Other notes related to this note.

Type

MutableSequence[str]

vulnerability

A note describing a package vulnerability.

This field is a member of oneof type.

Type

grafeas.grafeas_v1.types.VulnerabilityNote

build

A note describing build provenance for a verifiable build.

This field is a member of oneof type.

Type

grafeas.grafeas_v1.types.BuildNote

image

A note describing a base image.

This field is a member of oneof type.

Type

grafeas.grafeas_v1.types.ImageNote

package

A note describing a package hosted by various package managers.

This field is a member of oneof type.

Type

grafeas.grafeas_v1.types.PackageNote

deployment

A note describing something that can be deployed.

This field is a member of oneof type.

Type

grafeas.grafeas_v1.types.DeploymentNote

discovery

A note describing the initial analysis of a resource.

This field is a member of oneof type.

Type

grafeas.grafeas_v1.types.DiscoveryNote

attestation

A note describing an attestation role.

This field is a member of oneof type.

Type

grafeas.grafeas_v1.types.AttestationNote

upgrade

A note describing available package upgrades.

This field is a member of oneof type.

Type

grafeas.grafeas_v1.types.UpgradeNote

compliance

A note describing a compliance check.

This field is a member of oneof type.

Type

grafeas.grafeas_v1.types.ComplianceNote

dsse_attestation

A note describing a dsse attestation note.

This field is a member of oneof type.

Type

grafeas.grafeas_v1.types.DSSEAttestationNote

class grafeas.grafeas_v1.types.NoteKind(value)[source]

Bases: proto.enums.Enum

Kind represents the kinds of notes supported.

Values:
NOTE_KIND_UNSPECIFIED (0):

Default value. This value is unused.

VULNERABILITY (1):

The note and occurrence represent a package vulnerability.

BUILD (2):

The note and occurrence assert build provenance.

IMAGE (3):

This represents an image basis relationship.

PACKAGE (4):

This represents a package installed via a package manager.

DEPLOYMENT (5):

The note and occurrence track deployment events.

DISCOVERY (6):

The note and occurrence track the initial discovery status of a resource.

ATTESTATION (7):

This represents a logical “role” that can attest to artifacts.

UPGRADE (8):

This represents an available package upgrade.

COMPLIANCE (9):

This represents a Compliance Note

DSSE_ATTESTATION (10):

This represents a DSSE attestation Note

class grafeas.grafeas_v1.types.Occurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

An instance of an analysis type that has been found on a resource.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

name

Output only. The name of the occurrence in the form of projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID].

Type

str

resource_uri

Required. Immutable. A URI that represents the resource for which the occurrence applies. For example, https://gcr.io/project/image@sha256:123abc for a Docker image.

Type

str

note_name

Required. Immutable. The analysis note associated with this occurrence, in the form of projects/[PROVIDER_ID]/notes/[NOTE_ID]. This field can be used as a filter in list requests.

Type

str

kind

Output only. This explicitly denotes which of the occurrence details are specified. This field can be used as a filter in list requests.

Type

grafeas.grafeas_v1.types.NoteKind

remediation

A description of actions that can be taken to remedy the note.

Type

str

create_time

Output only. The time this occurrence was created.

Type

google.protobuf.timestamp_pb2.Timestamp

update_time

Output only. The time this occurrence was last updated.

Type

google.protobuf.timestamp_pb2.Timestamp

vulnerability

Describes a security vulnerability.

This field is a member of oneof details.

Type

grafeas.grafeas_v1.types.VulnerabilityOccurrence

build

Describes a verifiable build.

This field is a member of oneof details.

Type

grafeas.grafeas_v1.types.BuildOccurrence

image

Describes how this resource derives from the basis in the associated note.

This field is a member of oneof details.

Type

grafeas.grafeas_v1.types.ImageOccurrence

package

Describes the installation of a package on the linked resource.

This field is a member of oneof details.

Type

grafeas.grafeas_v1.types.PackageOccurrence

deployment

Describes the deployment of an artifact on a runtime.

This field is a member of oneof details.

Type

grafeas.grafeas_v1.types.DeploymentOccurrence

discovery

Describes when a resource was discovered.

This field is a member of oneof details.

Type

grafeas.grafeas_v1.types.DiscoveryOccurrence

attestation

Describes an attestation of an artifact.

This field is a member of oneof details.

Type

grafeas.grafeas_v1.types.AttestationOccurrence

upgrade

Describes an available package upgrade on the linked resource.

This field is a member of oneof details.

Type

grafeas.grafeas_v1.types.UpgradeOccurrence

compliance

Describes a compliance violation on a linked resource.

This field is a member of oneof details.

Type

grafeas.grafeas_v1.types.ComplianceOccurrence

dsse_attestation

Describes an attestation of an artifact using dsse.

This field is a member of oneof details.

Type

grafeas.grafeas_v1.types.DSSEAttestationOccurrence

envelope

https://github.com/secure-systems-lab/dsse

Type

grafeas.grafeas_v1.types.Envelope

class grafeas.grafeas_v1.types.PackageNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

PackageNote represents a particular package version.

name

The name of the package.

Type

str

distribution

Deprecated. The various channels by which a package is distributed.

Type

MutableSequence[grafeas.grafeas_v1.types.Distribution]

package_type

The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).

Type

str

cpe_uri

The cpe_uri in CPE format denoting the package manager version distributing a package. The cpe_uri will be blank for language packages.

Type

str

architecture

The CPU architecture for which packages in this distribution channel were built. Architecture will be blank for language packages.

Type

grafeas.grafeas_v1.types.Architecture

version

The version of the package.

Type

grafeas.grafeas_v1.types.Version

maintainer

A freeform text denoting the maintainer of this package.

Type

str

url

The homepage for this package.

Type

str

description

The description of this package.

Type

str

license_

Licenses that have been declared by the authors of the package.

Type

grafeas.grafeas_v1.types.License

digest

Hash value, typically a file digest, that allows unique identification a specific package.

Type

MutableSequence[grafeas.grafeas_v1.types.Digest]

class grafeas.grafeas_v1.types.PackageOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Details on how a particular software package was installed on a system.

name

The name of the installed package.

Type

str

location

All of the places within the filesystem versions of this package have been found.

Type

MutableSequence[grafeas.grafeas_v1.types.Location]

package_type

The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).

Type

str

cpe_uri

The cpe_uri in CPE format denoting the package manager version distributing a package. The cpe_uri will be blank for language packages.

Type

str

architecture

The CPU architecture for which packages in this distribution channel were built. Architecture will be blank for language packages.

Type

grafeas.grafeas_v1.types.Architecture

license_

Licenses that have been declared by the authors of the package.

Type

grafeas.grafeas_v1.types.License

version

The version of the package.

Type

grafeas.grafeas_v1.types.Version

class grafeas.grafeas_v1.types.ProjectRepoId(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Selects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.

project_id

The ID of the project.

Type

str

repo_name

The name of the repo. Leave empty for the default repo.

Type

str

class grafeas.grafeas_v1.types.Recipe(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.

type_

URI indicating what type of recipe was performed. It determines the meaning of recipe.entryPoint, recipe.arguments, recipe.environment, and materials.

Type

str

defined_in_material

Index in materials containing the recipe steps that are not implied by recipe.type. For example, if the recipe type were “make”, then this would point to the source containing the Makefile, not the make program itself. Set to -1 if the recipe doesn’t come from a material, as zero is default unset value for int64.

Type

int

entry_point

String identifying the entry point into the build. This is often a path to a configuration file and/or a target label within that file. The syntax and meaning are defined by recipe.type. For example, if the recipe type were “make”, then this would reference the directory in which to run make as well as which target to use.

Type

str

arguments

Collection of all external inputs that influenced the build on top of recipe.definedInMaterial and recipe.entryPoint. For example, if the recipe type were “make”, then this might be the flags passed to make aside from the target, which is captured in recipe.entryPoint. Since the arguments field can greatly vary in structure, depending on the builder and recipe type, this is of form “Any”.

Type

MutableSequence[google.protobuf.any_pb2.Any]

environment

Any other builder-controlled inputs necessary for correctly evaluating the recipe. Usually only needed for reproducing the build but not evaluated as part of policy. Since the environment field can greatly vary in structure, depending on the builder and recipe type, this is of form “Any”.

Type

MutableSequence[google.protobuf.any_pb2.Any]

class grafeas.grafeas_v1.types.RelatedUrl(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Metadata for any related URL information.

url

Specific URL associated with the resource.

Type

str

label

Label to describe usage of the URL.

Type

str

class grafeas.grafeas_v1.types.RepoId(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A unique identifier for a Cloud Repo.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

project_repo_id

A combination of a project ID and a repo name.

This field is a member of oneof id.

Type

grafeas.grafeas_v1.types.ProjectRepoId

uid

A server-assigned, globally unique identifier.

This field is a member of oneof id.

Type

str

class grafeas.grafeas_v1.types.Signature(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Verifiers (e.g. Kritis implementations) MUST verify signatures with respect to the trust anchors defined in policy (e.g. a Kritis policy). Typically this means that the verifier has been configured with a map from public_key_id to public key material (and any required parameters, e.g. signing algorithm).

In particular, verification implementations MUST NOT treat the signature public_key_id as anything more than a key lookup hint. The public_key_id DOES NOT validate or authenticate a public key; it only provides a mechanism for quickly selecting a public key ALREADY CONFIGURED on the verifier through a trusted channel. Verification implementations MUST reject signatures in any of the following circumstances:

  • The public_key_id is not recognized by the verifier.

  • The public key that public_key_id refers to does not verify the signature with respect to the payload.

The signature contents SHOULD NOT be “attached” (where the payload is included with the serialized signature bytes). Verifiers MUST ignore any “attached” payload and only verify signatures with respect to explicitly provided payload (e.g. a payload field on the proto message that holds this Signature, or the canonical serialization of the proto message that holds this signature).

signature

The content of the signature, an opaque bytestring. The payload that this signature verifies MUST be unambiguously provided with the Signature during verification. A wrapper message might provide the payload explicitly. Alternatively, a message might have a canonical serialization that can always be unambiguously computed to derive the payload.

Type

bytes

public_key_id

The identifier for the public key that verifies this signature.

  • The public_key_id is required.

  • The public_key_id SHOULD be an RFC3986 conformant URI.

  • When possible, the public_key_id SHOULD be an immutable reference, such as a cryptographic digest.

Examples of valid public_key_ids:

OpenPGP V4 public key fingerprint:

  • “openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA” See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more details on this scheme.

RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER serialization):

  • “ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU”

  • “nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5”.

Type

str

class grafeas.grafeas_v1.types.SlsaProvenance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

builder

required

Type

grafeas.grafeas_v1.types.SlsaProvenance.SlsaBuilder

recipe

Identifies the configuration used for the build. When combined with materials, this SHOULD fully describe the build, such that re-running this recipe results in bit-for-bit identical output (if the build is reproducible).

Type

grafeas.grafeas_v1.types.SlsaProvenance.SlsaRecipe

metadata
Type

grafeas.grafeas_v1.types.SlsaProvenance.SlsaMetadata

materials

The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on. This is considered to be incomplete unless metadata.completeness.materials is true. Unset or null is equivalent to empty.

Type

MutableSequence[grafeas.grafeas_v1.types.SlsaProvenance.Material]

class Material(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

uri
Type

str

digest
Type

MutableMapping[str, str]

class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

class SlsaBuilder(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

id
Type

str

class SlsaCompleteness(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Indicates that the builder claims certain fields in this message to be complete.

arguments

If true, the builder claims that recipe.arguments is complete, meaning that all external inputs are properly captured in the recipe.

Type

bool

environment

If true, the builder claims that recipe.environment is claimed to be complete.

Type

bool

materials

If true, the builder claims that materials are complete, usually through some controls to prevent network access. Sometimes called “hermetic”.

Type

bool

class SlsaMetadata(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Other properties of the build.

build_invocation_id

Identifies the particular build invocation, which can be useful for finding associated logs or other ad-hoc analysis. The value SHOULD be globally unique, per in-toto Provenance spec.

Type

str

build_started_on

The timestamp of when the build started.

Type

google.protobuf.timestamp_pb2.Timestamp

build_finished_on

The timestamp of when the build completed.

Type

google.protobuf.timestamp_pb2.Timestamp

completeness

Indicates that the builder claims certain fields in this message to be complete.

Type

grafeas.grafeas_v1.types.SlsaProvenance.SlsaCompleteness

reproducible

If true, the builder claims that running the recipe on materials will produce bit-for-bit identical output.

Type

bool

class SlsaRecipe(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.

type_

URI indicating what type of recipe was performed. It determines the meaning of recipe.entryPoint, recipe.arguments, recipe.environment, and materials.

Type

str

defined_in_material

Index in materials containing the recipe steps that are not implied by recipe.type. For example, if the recipe type were “make”, then this would point to the source containing the Makefile, not the make program itself. Set to -1 if the recipe doesn’t come from a material, as zero is default unset value for int64.

Type

int

entry_point

String identifying the entry point into the build. This is often a path to a configuration file and/or a target label within that file. The syntax and meaning are defined by recipe.type. For example, if the recipe type were “make”, then this would reference the directory in which to run make as well as which target to use.

Type

str

arguments

Collection of all external inputs that influenced the build on top of recipe.definedInMaterial and recipe.entryPoint. For example, if the recipe type were “make”, then this might be the flags passed to make aside from the target, which is captured in recipe.entryPoint. Depending on the recipe Type, the structure may be different.

Type

google.protobuf.any_pb2.Any

environment

Any other builder-controlled inputs necessary for correctly evaluating the recipe. Usually only needed for reproducing the build but not evaluated as part of policy. Depending on the recipe Type, the structure may be different.

Type

google.protobuf.any_pb2.Any

class grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

See full explanation of fields at slsa.dev/provenance/v0.2.

builder
Type

grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo.SlsaBuilder

build_type
Type

str

invocation
Type

grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo.SlsaInvocation

build_config
Type

google.protobuf.struct_pb2.Struct

metadata
Type

grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo.SlsaMetadata

materials
Type

MutableSequence[grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo.SlsaMaterial]

class SlsaBuilder(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Identifies the entity that executed the recipe, which is trusted to have correctly performed the operation and populated this provenance.

id
Type

str

class SlsaCompleteness(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Indicates that the builder claims certain fields in this message to be complete.

parameters
Type

bool

environment
Type

bool

materials
Type

bool

class SlsaConfigSource(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Describes where the config file that kicked off the build came from. This is effectively a pointer to the source where buildConfig came from.

uri
Type

str

digest
Type

MutableMapping[str, str]

entry_point
Type

str

class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

class SlsaInvocation(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Identifies the event that kicked off the build.

config_source
Type

grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo.SlsaConfigSource

parameters
Type

google.protobuf.struct_pb2.Struct

environment
Type

google.protobuf.struct_pb2.Struct

class SlsaMaterial(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on.

uri
Type

str

digest
Type

MutableMapping[str, str]

class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

class SlsaMetadata(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Other properties of the build.

build_invocation_id
Type

str

build_started_on
Type

google.protobuf.timestamp_pb2.Timestamp

build_finished_on
Type

google.protobuf.timestamp_pb2.Timestamp

completeness
Type

grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo.SlsaCompleteness

reproducible
Type

bool

class grafeas.grafeas_v1.types.Source(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Source describes the location of the source used for the build.

artifact_storage_source_uri

If provided, the input binary artifacts for the build came from this location.

Type

str

file_hashes

Hash(es) of the build source, which can be used to verify that the original source integrity was maintained in the build. The keys to this map are file paths used as build source and the values contain the hash values for those files.

If the build source came in a single package such as a gzipped tarfile (.tar.gz), the FileHash will be for the single path to that file.

Type

MutableMapping[str, grafeas.grafeas_v1.types.FileHashes]

context

If provided, the source code used for the build came from this location.

Type

grafeas.grafeas_v1.types.SourceContext

additional_contexts

If provided, some of the source code used for the build may be found in these locations, in the case where the source repository had multiple remotes or submodules. This list will not include the context specified in the context field.

Type

MutableSequence[grafeas.grafeas_v1.types.SourceContext]

class FileHashesEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

class grafeas.grafeas_v1.types.SourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

cloud_repo

A SourceContext referring to a revision in a Google Cloud Source Repo.

This field is a member of oneof context.

Type

grafeas.grafeas_v1.types.CloudRepoSourceContext

gerrit

A SourceContext referring to a Gerrit project.

This field is a member of oneof context.

Type

grafeas.grafeas_v1.types.GerritSourceContext

git

A SourceContext referring to any third party Git repo (e.g., GitHub).

This field is a member of oneof context.

Type

grafeas.grafeas_v1.types.GitSourceContext

labels

Labels with user defined metadata.

Type

MutableMapping[str, str]

class LabelsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

class grafeas.grafeas_v1.types.Subject(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

name
Type

str

digest

"<ALGORITHM>": "<HEX_VALUE>" Algorithms can be e.g. sha256, sha512 See https://github.com/in-toto/attestation/blob/main/spec/field_types.md#DigestSet

Type

MutableMapping[str, str]

class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

class grafeas.grafeas_v1.types.UpdateNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to update a note.

name

The name of the note in the form of projects/[PROVIDER_ID]/notes/[NOTE_ID].

Type

str

note

The updated note.

Type

grafeas.grafeas_v1.types.Note

update_mask

The fields to update.

Type

google.protobuf.field_mask_pb2.FieldMask

class grafeas.grafeas_v1.types.UpdateOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request to update an occurrence.

name

The name of the occurrence in the form of projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID].

Type

str

occurrence

The updated occurrence.

Type

grafeas.grafeas_v1.types.Occurrence

update_mask

The fields to update.

Type

google.protobuf.field_mask_pb2.FieldMask

class grafeas.grafeas_v1.types.UpgradeDistribution(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities.

cpe_uri

Required - The specific operating system this metadata applies to. See https://cpe.mitre.org/specification/.

Type

str

classification

The operating system classification of this Upgrade, as specified by the upstream operating system upgrade feed. For Windows the classification is one of the category_ids listed at https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ff357803(v=vs.85)

Type

str

severity

The severity as specified by the upstream operating system.

Type

str

cve

The cve tied to this Upgrade.

Type

MutableSequence[str]

class grafeas.grafeas_v1.types.UpgradeNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be an Upgrade Note. For Windows, windows_update field represents the information related to the update.

package

Required for non-Windows OS. The package this Upgrade is for.

Type

str

version

Required for non-Windows OS. The version of the package in machine + human readable form.

Type

grafeas.grafeas_v1.types.Version

distributions

Metadata about the upgrade for each specific operating system.

Type

MutableSequence[grafeas.grafeas_v1.types.UpgradeDistribution]

windows_update

Required for Windows OS. Represents the metadata about the Windows update.

Type

grafeas.grafeas_v1.types.WindowsUpdate

class grafeas.grafeas_v1.types.UpgradeOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). For Windows, both distribution and windows_update contain information for the Windows update.

package

Required for non-Windows OS. The package this Upgrade is for.

Type

str

parsed_version

Required for non-Windows OS. The version of the package in a machine + human readable form.

Type

grafeas.grafeas_v1.types.Version

distribution

Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.

Type

grafeas.grafeas_v1.types.UpgradeDistribution

windows_update

Required for Windows OS. Represents the metadata about the Windows update.

Type

grafeas.grafeas_v1.types.WindowsUpdate

class grafeas.grafeas_v1.types.Version(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Version contains structured information about the version of a package.

epoch

Used to correct mistakes in the version numbering scheme.

Type

int

name

Required only when version kind is NORMAL. The main part of the version name.

Type

str

revision

The iteration of the package build from the above version.

Type

str

inclusive

Whether this version is specifying part of an inclusive range. Grafeas does not have the capability to specify version ranges; instead we have fields that specify start version and end versions. At times this is insufficient - we also need to specify whether the version is included in the range or is excluded from the range. This boolean is expected to be set to true when the version is included in a range.

Type

bool

kind

Required. Distinguishes between sentinel MIN/MAX versions and normal versions.

Type

grafeas.grafeas_v1.types.Version.VersionKind

full_name

Human readable version string. This string is of the form <epoch>:<name>-<revision> and is only set when kind is NORMAL.

Type

str

class VersionKind(value)[source]

Bases: proto.enums.Enum

Whether this is an ordinary package version or a sentinel MIN/MAX version.

Values:
VERSION_KIND_UNSPECIFIED (0):

Unknown.

NORMAL (1):

A standard package version.

MINIMUM (2):

A special version representing negative infinity.

MAXIMUM (3):

A special version representing positive infinity.

class grafeas.grafeas_v1.types.VulnerabilityNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A security vulnerability that can be found in resources.

cvss_score

The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.

Type

float

severity

The note provider assigned severity of this vulnerability.

Type

grafeas.grafeas_v1.types.Severity

details

Details of all known distros and packages affected by this vulnerability.

Type

MutableSequence[grafeas.grafeas_v1.types.VulnerabilityNote.Detail]

cvss_v3

The full description of the CVSSv3 for this vulnerability.

Type

grafeas.grafeas_v1.types.CVSSv3

windows_details

Windows details get their own format because the information format and model don’t match a normal detail. Specifically Windows updates are done as patches, thus Windows vulnerabilities really are a missing package, rather than a package being at an incorrect version.

Type

MutableSequence[grafeas.grafeas_v1.types.VulnerabilityNote.WindowsDetail]

source_update_time

The time this information was last changed at the source. This is an upstream timestamp from the underlying information source - e.g. Ubuntu security tracker.

Type

google.protobuf.timestamp_pb2.Timestamp

cvss_version

CVSS version used to populate cvss_score and severity.

Type

grafeas.grafeas_v1.types.CVSSVersion

class Detail(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A detail for a distro and package affected by this vulnerability and its associated fix (if one is available).

severity_name

The distro assigned severity of this vulnerability.

Type

str

description

A vendor-specific description of this vulnerability.

Type

str

package_type

The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).

Type

str

affected_cpe_uri

Required. The CPE URI this vulnerability affects.

Type

str

affected_package

Required. The package this vulnerability affects.

Type

str

affected_version_start

The version number at the start of an interval in which this vulnerability exists. A vulnerability can affect a package between version numbers that are disjoint sets of intervals (example: [1.0.0-1.1.0], [2.4.6-2.4.8] and [4.5.6-4.6.8]) each of which will be represented in its own Detail. If a specific affected version is provided by a vulnerability database, affected_version_start and affected_version_end will be the same in that Detail.

Type

grafeas.grafeas_v1.types.Version

affected_version_end

The version number at the end of an interval in which this vulnerability exists. A vulnerability can affect a package between version numbers that are disjoint sets of intervals (example: [1.0.0-1.1.0], [2.4.6-2.4.8] and [4.5.6-4.6.8]) each of which will be represented in its own Detail. If a specific affected version is provided by a vulnerability database, affected_version_start and affected_version_end will be the same in that Detail.

Type

grafeas.grafeas_v1.types.Version

fixed_cpe_uri

The distro recommended CPE URI to update to that contains a fix for this vulnerability. It is possible for this to be different from the affected_cpe_uri.

Type

str

fixed_package

The distro recommended package to update to that contains a fix for this vulnerability. It is possible for this to be different from the affected_package.

Type

str

fixed_version

The distro recommended version to update to that contains a fix for this vulnerability. Setting this to VersionKind.MAXIMUM means no such version is yet available.

Type

grafeas.grafeas_v1.types.Version

is_obsolete

Whether this detail is obsolete. Occurrences are expected not to point to obsolete details.

Type

bool

source_update_time

The time this information was last changed at the source. This is an upstream timestamp from the underlying information source - e.g. Ubuntu security tracker.

Type

google.protobuf.timestamp_pb2.Timestamp

source

The source from which the information in this Detail was obtained.

Type

str

vendor

The name of the vendor of the product.

Type

str

class WindowsDetail(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

cpe_uri

Required. The CPE URI this vulnerability affects.

Type

str

name

Required. The name of this vulnerability.

Type

str

description

The description of this vulnerability.

Type

str

fixing_kbs

Required. The names of the KBs which have hotfixes to mitigate this vulnerability. Note that there may be multiple hotfixes (and thus multiple KBs) that mitigate a given vulnerability. Currently any listed KBs presence is considered a fix.

Type

MutableSequence[grafeas.grafeas_v1.types.VulnerabilityNote.WindowsDetail.KnowledgeBase]

class KnowledgeBase(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

name

The KB name (generally of the form KB[0-9]+ (e.g., KB123456)).

Type

str

url

A link to the KB in the [Windows update catalog] (https://www.catalog.update.microsoft.com/).

Type

str

class grafeas.grafeas_v1.types.VulnerabilityOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

An occurrence of a severity vulnerability on a resource.

type_

The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).

Type

str

severity

Output only. The note provider assigned severity of this vulnerability.

Type

grafeas.grafeas_v1.types.Severity

cvss_score

Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.

Type

float

cvssv3

The cvss v3 score for the vulnerability.

Type

grafeas.grafeas_v1.types.CVSS

package_issue

Required. The set of affected locations and their fixes (if available) within the associated resource.

Type

MutableSequence[grafeas.grafeas_v1.types.VulnerabilityOccurrence.PackageIssue]

short_description

Output only. A one sentence description of this vulnerability.

Type

str

long_description

Output only. A detailed description of this vulnerability.

Type

str

related_urls

Output only. URLs related to this vulnerability.

Type

MutableSequence[grafeas.grafeas_v1.types.RelatedUrl]

effective_severity

The distro assigned severity for this vulnerability when it is available, otherwise this is the note provider assigned severity. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.

Type

grafeas.grafeas_v1.types.Severity

fix_available

Output only. Whether at least one of the affected packages has a fix available.

Type

bool

cvss_version

Output only. CVSS version used to populate cvss_score and severity.

Type

grafeas.grafeas_v1.types.CVSSVersion

class PackageIssue(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

A detail for a distro and package this vulnerability occurrence was found in and its associated fix (if one is available).

affected_cpe_uri

Required. The CPE URI this vulnerability was found in.

Type

str

affected_package

Required. The package this vulnerability was found in.

Type

str

affected_version

Required. The version of the package that is installed on the resource affected by this vulnerability.

Type

grafeas.grafeas_v1.types.Version

fixed_cpe_uri

The CPE URI this vulnerability was fixed in. It is possible for this to be different from the affected_cpe_uri.

Type

str

fixed_package

The package this vulnerability was fixed in. It is possible for this to be different from the affected_package.

Type

str

fixed_version

Required. The version of the package this vulnerability was fixed in. Setting this to VersionKind.MAXIMUM means no fix is yet available.

Type

grafeas.grafeas_v1.types.Version

fix_available

Output only. Whether a fix is available for this package.

Type

bool

package_type

The type of package (e.g. OS, MAVEN, GO).

Type

str

effective_severity

The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.

Type

grafeas.grafeas_v1.types.Severity

file_location

The location at which this package was found.

Type

MutableSequence[grafeas.grafeas_v1.types.FileLocation]

class grafeas.grafeas_v1.types.WindowsUpdate(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Windows Update represents the metadata about the update for the Windows operating system. The fields in this message come from the Windows Update API documented at https://docs.microsoft.com/en-us/windows/win32/api/wuapi/nn-wuapi-iupdate.

identity

Required - The unique identifier for the update.

Type

grafeas.grafeas_v1.types.WindowsUpdate.Identity

title

The localized title of the update.

Type

str

description

The localized description of the update.

Type

str

categories

The list of categories to which the update belongs.

Type

MutableSequence[grafeas.grafeas_v1.types.WindowsUpdate.Category]

kb_article_ids

The Microsoft Knowledge Base article IDs that are associated with the update.

Type

MutableSequence[str]

support_url

The hyperlink to the support information for the update.

Type

str

last_published_timestamp

The last published timestamp of the update.

Type

google.protobuf.timestamp_pb2.Timestamp

class Category(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

The category to which the update belongs.

category_id

The identifier of the category.

Type

str

name

The localized name of the category.

Type

str

class Identity(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

The unique identifier of the update.

update_id

The revision independent identifier of the update.

Type

str

revision

The revision number of the update.

Type

int