Types for Grafeas Grafeas v1 API¶
- class grafeas.grafeas_v1.types.AliasContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageAn alias to a repo revision.
- kind¶
The alias kind.
- class Kind(value)[source]¶
Bases:
proto.enums.EnumThe type of an alias.
- Values:
- KIND_UNSPECIFIED (0):
Unknown.
- FIXED (1):
Git tag.
- MOVABLE (2):
Git branch.
- OTHER (4):
Used to specify non-standard aliases. For example, if a Git repo has a ref named “refs/foo/bar”.
- class grafeas.grafeas_v1.types.Architecture(value)[source]¶
Bases:
proto.enums.EnumInstruction set architectures supported by various package managers.
- Values:
- ARCHITECTURE_UNSPECIFIED (0):
Unknown architecture.
- X86 (1):
X86 architecture.
- X64 (2):
X64 architecture.
- class grafeas.grafeas_v1.types.Artifact(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageArtifact describes a build product.
- checksum¶
Hash or checksum value of a binary, or Docker Registry 2.0 digest of a container.
- Type
- id¶
Artifact ID, if any; for container images, this will be a URL by digest like
gcr.io/projectID/imagename@sha256:123456.- Type
- names¶
Related artifact names. This may be the path to a binary or jar file, or in the case of a container build, the name used to push the container image to Google Container Registry, as presented to
docker push. Note that a single Artifact ID can have multiple names, for example if two tags are applied to one image.- Type
MutableSequence[str]
- class grafeas.grafeas_v1.types.AttestationNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageNote kind that represents a logical attestation “role” or “authority”. For example, an organization might have one
Authorityfor “QA” and one for “build”. This note is intended to act strictly as a grouping mechanism for the attached occurrences (Attestations). This grouping mechanism also provides a security boundary, since IAM ACLs gate the ability for a principle to attach an occurrence to a given note. It also provides a single point of lookup to find all attached attestation occurrences, even if they don’t all live in the same project.- hint¶
Hint hints at the purpose of the attestation authority.
- class Hint(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThis submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from “readable” names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.
- class grafeas.grafeas_v1.types.AttestationOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageOccurrence that represents a single “attestation”. The authenticity of an attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the authority to which this attestation is attached is primarily useful for lookup (how to find this attestation if you already know the authority and artifact to be verified) and intent (for which authority this attestation was intended to sign.
- serialized_payload¶
Required. The serialized payload that is verified by one or more
signatures.- Type
- signatures¶
One or more signatures over
serialized_payload. Verifier implementations should consider this attestation message verified if at least onesignatureverifiesserialized_payload. SeeSignaturein common.proto for more details on signature structure and verification.- Type
MutableSequence[grafeas.grafeas_v1.types.Signature]
- jwts¶
One or more JWTs encoding a self-contained attestation. Each JWT encodes the payload that it verifies within the JWT itself. Verifier implementation SHOULD ignore the
serialized_payloadfield when verifying these JWTs. If only JWTs are present on this AttestationOccurrence, then theserialized_payloadSHOULD be left empty. Each JWT SHOULD encode a claim specific to theresource_uriof this Occurrence, but this is not validated by Grafeas metadata API implementations. The JWT itself is opaque to Grafeas.- Type
MutableSequence[grafeas.grafeas_v1.types.Jwt]
- class grafeas.grafeas_v1.types.BaseImage(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageBaseImage describes a base image of a container image.
- class grafeas.grafeas_v1.types.BatchCreateNotesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to create notes in batch.
- parent¶
The name of the project in the form of
projects/[PROJECT_ID], under which the notes are to be created.- Type
- notes¶
The notes to create. Max allowed length is 1000.
- Type
MutableMapping[str, grafeas.grafeas_v1.types.Note]
- class NotesEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.BatchCreateNotesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageResponse for creating notes in batch.
- notes¶
The notes that were created.
- Type
MutableSequence[grafeas.grafeas_v1.types.Note]
- class grafeas.grafeas_v1.types.BatchCreateOccurrencesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to create occurrences in batch.
- parent¶
The name of the project in the form of
projects/[PROJECT_ID], under which the occurrences are to be created.- Type
- occurrences¶
The occurrences to create. Max allowed length is 1000.
- Type
MutableSequence[grafeas.grafeas_v1.types.Occurrence]
- class grafeas.grafeas_v1.types.BatchCreateOccurrencesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageResponse for creating occurrences in batch.
- occurrences¶
The occurrences that were created.
- Type
MutableSequence[grafeas.grafeas_v1.types.Occurrence]
- class grafeas.grafeas_v1.types.BuildNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageNote holding the version of the provider’s builder and the signature of the provenance message in the build details occurrence.
- class grafeas.grafeas_v1.types.BuildOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageDetails of a build occurrence.
- provenance¶
The actual provenance for the build.
- provenance_bytes¶
Serialized JSON representation of the provenance, used in generating the build signature in the corresponding build note. After verifying the signature,
provenance_bytescan be unmarshalled and compared to the provenance to confirm that it is unchanged. A base64-encoded string representation of the provenance bytes is used for the signature in order to interoperate with openssl which expects this format for signature verification.The serialized form is captured both to avoid ambiguity in how the provenance is marshalled to json as well to prevent incompatibilities with future changes.
- Type
- intoto_provenance¶
Deprecated. See InTotoStatement for the replacement. In-toto Provenance representation as defined in spec.
- intoto_statement¶
In-toto Statement representation as defined in spec. The intoto_statement can contain any type of provenance. The serialized payload of the statement can be stored and signed in the Occurrence’s envelope.
- in_toto_slsa_provenance_v1¶
In-Toto Slsa Provenance V1 represents a slsa provenance meeting the slsa spec, wrapped in an in-toto statement. This allows for direct jsonification of a to-spec in-toto slsa statement with a to-spec slsa provenance.
- class grafeas.grafeas_v1.types.BuildProvenance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageProvenance of a build. Contains all information needed to verify the full details about the build from source to completion.
- commands¶
Commands requested by the build.
- Type
MutableSequence[grafeas.grafeas_v1.types.Command]
- built_artifacts¶
Output of the build.
- Type
MutableSequence[grafeas.grafeas_v1.types.Artifact]
- create_time¶
Time at which the build was created.
- start_time¶
Time at which execution of the build was started.
- end_time¶
Time at which execution of the build was finished.
- creator¶
E-mail address of the user who initiated this build. Note that this was the user’s e-mail address at the time the build was initiated; this address may not represent the same end-user for all time.
- Type
- source_provenance¶
Details of the Source input to the build.
- build_options¶
Special options applied to this build. This is a catch-all field where build providers can enter any desired additional details.
- class BuildOptionsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.BuilderConfig(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.CVSS(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageCommon Vulnerability Scoring System. For details, see https://www.first.org/cvss/specification-document This is a message we will try to use for storing various versions of CVSS rather than making a separate proto for storing a specific version.
- attack_vector¶
Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments.
- attack_complexity¶
- authentication¶
- privileges_required¶
- user_interaction¶
- scope¶
- confidentiality_impact¶
- integrity_impact¶
- availability_impact¶
- class AttackComplexity(value)[source]¶
Bases:
proto.enums.Enum- Values:
- ATTACK_COMPLEXITY_UNSPECIFIED (0):
No description available.
- ATTACK_COMPLEXITY_LOW (1):
No description available.
- ATTACK_COMPLEXITY_HIGH (2):
No description available.
- ATTACK_COMPLEXITY_MEDIUM (3):
No description available.
- class AttackVector(value)[source]¶
Bases:
proto.enums.Enum- Values:
- ATTACK_VECTOR_UNSPECIFIED (0):
No description available.
- ATTACK_VECTOR_NETWORK (1):
No description available.
- ATTACK_VECTOR_ADJACENT (2):
No description available.
- ATTACK_VECTOR_LOCAL (3):
No description available.
- ATTACK_VECTOR_PHYSICAL (4):
No description available.
- class Authentication(value)[source]¶
Bases:
proto.enums.Enum- Values:
- AUTHENTICATION_UNSPECIFIED (0):
No description available.
- AUTHENTICATION_MULTIPLE (1):
No description available.
- AUTHENTICATION_SINGLE (2):
No description available.
- AUTHENTICATION_NONE (3):
No description available.
- class Impact(value)[source]¶
Bases:
proto.enums.Enum- Values:
- IMPACT_UNSPECIFIED (0):
No description available.
- IMPACT_HIGH (1):
No description available.
- IMPACT_LOW (2):
No description available.
- IMPACT_NONE (3):
No description available.
- IMPACT_PARTIAL (4):
No description available.
- IMPACT_COMPLETE (5):
No description available.
- class PrivilegesRequired(value)[source]¶
Bases:
proto.enums.Enum- Values:
- PRIVILEGES_REQUIRED_UNSPECIFIED (0):
No description available.
- PRIVILEGES_REQUIRED_NONE (1):
No description available.
- PRIVILEGES_REQUIRED_LOW (2):
No description available.
- PRIVILEGES_REQUIRED_HIGH (3):
No description available.
- class Scope(value)[source]¶
Bases:
proto.enums.Enum- Values:
- SCOPE_UNSPECIFIED (0):
No description available.
- SCOPE_UNCHANGED (1):
No description available.
- SCOPE_CHANGED (2):
No description available.
- class UserInteraction(value)[source]¶
Bases:
proto.enums.Enum- Values:
- USER_INTERACTION_UNSPECIFIED (0):
No description available.
- USER_INTERACTION_NONE (1):
No description available.
- USER_INTERACTION_REQUIRED (2):
No description available.
- class grafeas.grafeas_v1.types.CVSSVersion(value)[source]¶
Bases:
proto.enums.EnumCVSS Version.
- Values:
- CVSS_VERSION_UNSPECIFIED (0):
No description available.
- CVSS_VERSION_2 (1):
No description available.
- CVSS_VERSION_3 (2):
No description available.
- class grafeas.grafeas_v1.types.CVSSv3(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageCommon Vulnerability Scoring System version 3. For details, see https://www.first.org/cvss/specification-document
- attack_vector¶
Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments.
- attack_complexity¶
- privileges_required¶
- user_interaction¶
- scope¶
- confidentiality_impact¶
- integrity_impact¶
- availability_impact¶
- class AttackComplexity(value)[source]¶
Bases:
proto.enums.Enum- Values:
- ATTACK_COMPLEXITY_UNSPECIFIED (0):
No description available.
- ATTACK_COMPLEXITY_LOW (1):
No description available.
- ATTACK_COMPLEXITY_HIGH (2):
No description available.
- class AttackVector(value)[source]¶
Bases:
proto.enums.Enum- Values:
- ATTACK_VECTOR_UNSPECIFIED (0):
No description available.
- ATTACK_VECTOR_NETWORK (1):
No description available.
- ATTACK_VECTOR_ADJACENT (2):
No description available.
- ATTACK_VECTOR_LOCAL (3):
No description available.
- ATTACK_VECTOR_PHYSICAL (4):
No description available.
- class Impact(value)[source]¶
Bases:
proto.enums.Enum- Values:
- IMPACT_UNSPECIFIED (0):
No description available.
- IMPACT_HIGH (1):
No description available.
- IMPACT_LOW (2):
No description available.
- IMPACT_NONE (3):
No description available.
- class PrivilegesRequired(value)[source]¶
Bases:
proto.enums.Enum- Values:
- PRIVILEGES_REQUIRED_UNSPECIFIED (0):
No description available.
- PRIVILEGES_REQUIRED_NONE (1):
No description available.
- PRIVILEGES_REQUIRED_LOW (2):
No description available.
- PRIVILEGES_REQUIRED_HIGH (3):
No description available.
- class Scope(value)[source]¶
Bases:
proto.enums.Enum- Values:
- SCOPE_UNSPECIFIED (0):
No description available.
- SCOPE_UNCHANGED (1):
No description available.
- SCOPE_CHANGED (2):
No description available.
- class UserInteraction(value)[source]¶
Bases:
proto.enums.Enum- Values:
- USER_INTERACTION_UNSPECIFIED (0):
No description available.
- USER_INTERACTION_NONE (1):
No description available.
- USER_INTERACTION_REQUIRED (2):
No description available.
- class grafeas.grafeas_v1.types.CloudRepoSourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- repo_id¶
The ID of the repo.
- class grafeas.grafeas_v1.types.Command(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageCommand describes a step performed as part of the build pipeline.
- name¶
Required. Name of the command, as presented on the command line, or if the command is packaged as a Docker container, as presented to
docker pull.- Type
- id¶
Optional unique identifier for this command, used in wait_for to reference this command as a dependency.
- Type
- class grafeas.grafeas_v1.types.Completeness(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageIndicates that the builder claims certain fields in this message to be complete.
- arguments¶
If true, the builder claims that recipe.arguments is complete, meaning that all external inputs are properly captured in the recipe.
- Type
- environment¶
If true, the builder claims that recipe.environment is claimed to be complete.
- Type
- class grafeas.grafeas_v1.types.ComplianceNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- version¶
The OS and config versions the benchmark applies to.
- Type
MutableSequence[grafeas.grafeas_v1.types.ComplianceVersion]
- class CisBenchmark(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA compliance check that is a CIS benchmark.
- severity¶
- class grafeas.grafeas_v1.types.ComplianceOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageAn indication that the compliance checks in the associated ComplianceNote were not satisfied for particular resources or a specified reason.
- non_compliant_files¶
- Type
MutableSequence[grafeas.grafeas_v1.types.NonCompliantFile]
- version¶
The OS and config version the benchmark was run on.
- class grafeas.grafeas_v1.types.ComplianceVersion(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageDescribes the CIS benchmark version that is applicable to a given OS and os version.
- cpe_uri¶
The CPE URI (https://cpe.mitre.org/specification/) this benchmark is applicable to.
- Type
- benchmark_document¶
The name of the document that defines this benchmark, e.g. “CIS Container-Optimized OS”.
- Type
- class grafeas.grafeas_v1.types.CreateNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to create a new note.
- parent¶
The name of the project in the form of
projects/[PROJECT_ID], under which the note is to be created.- Type
- note¶
The note to create.
- class grafeas.grafeas_v1.types.CreateOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to create a new occurrence.
- parent¶
The name of the project in the form of
projects/[PROJECT_ID], under which the occurrence is to be created.- Type
- occurrence¶
The occurrence to create.
- class grafeas.grafeas_v1.types.DSSEAttestationNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- hint¶
DSSEHint hints at the purpose of the attestation authority.
- class DSSEHint(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThis submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from “readable” names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.
- class grafeas.grafeas_v1.types.DSSEAttestationOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageDeprecated. Prefer to use a regular Occurrence, and populate the Envelope at the top level of the Occurrence.
- envelope¶
If doing something security critical, make sure to verify the signatures in this metadata.
- class grafeas.grafeas_v1.types.DeleteNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to delete a note.
- class grafeas.grafeas_v1.types.DeleteOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to delete an occurrence.
- class grafeas.grafeas_v1.types.DeploymentNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageAn artifact that can be deployed in some runtime.
- class grafeas.grafeas_v1.types.DeploymentOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe period during which some deployable was active in a runtime.
- deploy_time¶
Required. Beginning of the lifetime of this deployment.
- undeploy_time¶
End of the lifetime of this deployment.
- resource_uri¶
Output only. Resource URI for the artifact being deployed taken from the deployable field with the same name.
- Type
MutableSequence[str]
- platform¶
Platform hosting this deployment.
- class Platform(value)[source]¶
Bases:
proto.enums.EnumTypes of platforms.
- Values:
- PLATFORM_UNSPECIFIED (0):
Unknown.
- GKE (1):
Google Container Engine.
- FLEX (2):
Google App Engine: Flexible Environment.
- CUSTOM (3):
Custom user-defined platform.
- class grafeas.grafeas_v1.types.Digest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageDigest information.
- class grafeas.grafeas_v1.types.DiscoveryNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA note that indicates a type of analysis a provider would perform. This note exists in a provider’s project. A
Discoveryoccurrence is created in a consumer’s project at the start of analysis.- analysis_kind¶
Required. Immutable. The kind of analysis that is handled by this discovery.
- class grafeas.grafeas_v1.types.DiscoveryOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageProvides information about the analysis status of a discovered resource.
- continuous_analysis¶
Whether the resource is continuously analyzed.
- analysis_status¶
The status of discovery for the resource.
- analysis_completed¶
- analysis_error¶
Indicates any errors encountered during analysis of a resource. There could be 0 or more of these errors.
- Type
MutableSequence[google.rpc.status_pb2.Status]
- analysis_status_error¶
When an error is encountered this will contain a LocalizedMessage under details to show to the user. The LocalizedMessage is output only and populated by the API.
- Type
google.rpc.status_pb2.Status
- last_scan_time¶
The last time this resource was scanned.
- archive_time¶
The time occurrences related to this discovery occurrence were archived.
- sbom_status¶
The status of an SBOM generation.
- vulnerability_attestation¶
The status of an vulnerability attestation generation.
- class AnalysisCompleted(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageIndicates which analysis completed successfully. Multiple types of analysis can be performed on a single resource.
- class AnalysisStatus(value)[source]¶
Bases:
proto.enums.EnumAnalysis status for a resource. Currently for initial analysis only (not updated in continuous analysis).
- Values:
- ANALYSIS_STATUS_UNSPECIFIED (0):
Unknown.
- PENDING (1):
Resource is known but no action has been taken yet.
- SCANNING (2):
Resource is being analyzed.
- FINISHED_SUCCESS (3):
Analysis has finished successfully.
- COMPLETE (3):
Analysis has completed.
- FINISHED_FAILED (4):
Analysis has finished unsuccessfully, the analysis itself is in a bad state.
- FINISHED_UNSUPPORTED (5):
The resource is known not to be supported.
- class ContinuousAnalysis(value)[source]¶
Bases:
proto.enums.EnumWhether the resource is continuously analyzed.
- Values:
- CONTINUOUS_ANALYSIS_UNSPECIFIED (0):
Unknown.
- ACTIVE (1):
The resource is continuously analyzed.
- INACTIVE (2):
The resource is ignored for continuous analysis.
- class SBOMStatus(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe status of an SBOM generation.
- sbom_state¶
The progress of the SBOM generation.
- class SBOMState(value)[source]¶
Bases:
proto.enums.EnumAn enum indicating the progress of the SBOM generation.
- Values:
- SBOM_STATE_UNSPECIFIED (0):
Default unknown state.
- PENDING (1):
SBOM scanning is pending.
- COMPLETE (2):
SBOM scanning has completed.
- class VulnerabilityAttestation(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe status of an vulnerability attestation generation.
- last_attempt_time¶
The last time we attempted to generate an attestation.
- state¶
The success/failure state of the latest attestation attempt.
- class VulnerabilityAttestationState(value)[source]¶
Bases:
proto.enums.EnumAn enum indicating the state of the attestation generation.
- Values:
- VULNERABILITY_ATTESTATION_STATE_UNSPECIFIED (0):
Default unknown state.
- SUCCESS (1):
Attestation was successfully generated and stored.
- FAILURE (2):
Attestation was unsuccessfully generated and stored.
- class grafeas.grafeas_v1.types.Distribution(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThis represents a particular channel of distribution for a given package. E.g., Debian’s jessie-backports dpkg mirror.
- cpe_uri¶
The cpe_uri in CPE format denoting the package manager version distributing a package.
- Type
- architecture¶
The CPU architecture for which packages in this distribution channel were built.
- latest_version¶
The latest available version of this package in this distribution channel.
- class grafeas.grafeas_v1.types.Envelope(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageMUST match https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An authenticated message of arbitrary type.
- signatures¶
- Type
MutableSequence[grafeas.grafeas_v1.types.EnvelopeSignature]
- class grafeas.grafeas_v1.types.EnvelopeSignature(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.FileHashes(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageContainer message for hashes of byte content of files, used in source messages to verify integrity of source input to the build.
- file_hash¶
Required. Collection of file hashes.
- Type
MutableSequence[grafeas.grafeas_v1.types.Hash]
- class grafeas.grafeas_v1.types.FileLocation(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageIndicates the location at which a package was found.
- file_path¶
For jars that are contained inside .war files, this filepath can indicate the path to war file combined with the path to jar file.
- Type
- layer_details¶
Each package found in a file should have its own layer metadata (that is, information from the origin layer of the package).
- class grafeas.grafeas_v1.types.Fingerprint(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA set of properties that uniquely identify a given Docker image.
- v1_name¶
Required. The layer ID of the final layer in the Docker image’s v1 representation.
- Type
- class grafeas.grafeas_v1.types.GerritSourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA SourceContext referring to a Gerrit project.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- gerrit_project¶
The full project name within the host. Projects may be nested, so “project/subproject” is a valid project name. The “repo name” is the hostURI/project.
- Type
- class grafeas.grafeas_v1.types.GetNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to get a note.
- class grafeas.grafeas_v1.types.GetOccurrenceNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to get the note to which the specified occurrence is attached.
- class grafeas.grafeas_v1.types.GetOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to get an occurrence.
- class grafeas.grafeas_v1.types.GitSourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).
- class grafeas.grafeas_v1.types.Hash(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageContainer message for hash values.
- class grafeas.grafeas_v1.types.ImageNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageBasis describes the base image portion (Note) of the DockerImage relationship. Linked occurrences are derived from this or an equivalent image via: FROM <Basis.resource_url> Or an equivalent reference, e.g., a tag of the resource_url.
- resource_url¶
Required. Immutable. The resource_url for the resource representing the basis of associated occurrence images.
- Type
- fingerprint¶
Required. Immutable. The fingerprint of the base image.
- class grafeas.grafeas_v1.types.ImageOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageDetails of the derived image portion of the DockerImage relationship. This image would be produced from a Dockerfile with FROM <DockerImage.Basis in attached Note>.
- fingerprint¶
Required. The fingerprint of the derived image.
- distance¶
Output only. The number of layers by which this image differs from the associated image basis.
- Type
- layer_info¶
This contains layer-specific metadata, if populated it has length “distance” and is ordered with [distance] being the layer immediately following the base image and [1] being the final layer.
- Type
MutableSequence[grafeas.grafeas_v1.types.Layer]
- class grafeas.grafeas_v1.types.InTotoProvenance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- builder_config¶
required
- recipe¶
Identifies the configuration used for the build. When combined with materials, this SHOULD fully describe the build, such that re-running this recipe results in bit-for-bit identical output (if the build is reproducible).
- metadata¶
- class grafeas.grafeas_v1.types.InTotoSlsaProvenanceV1(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- type_¶
InToto spec defined at https://github.com/in-toto/attestation/tree/main/spec#statement
- Type
- subject¶
- Type
MutableSequence[grafeas.grafeas_v1.types.Subject]
- class BuildDefinition(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- external_parameters¶
- internal_parameters¶
- resolved_dependencies¶
- Type
MutableSequence[grafeas.grafeas_v1.types.InTotoSlsaProvenanceV1.ResourceDescriptor]
- class BuildMetadata(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- started_on¶
- finished_on¶
- class ProvenanceBuilder(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- builder_dependencies¶
- Type
MutableSequence[grafeas.grafeas_v1.types.InTotoSlsaProvenanceV1.ResourceDescriptor]
- class VersionEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class ResourceDescriptor(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- annotations¶
- Type
MutableMapping[str, google.protobuf.struct_pb2.Value]
- class AnnotationsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class RunDetails(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- byproducts¶
- Type
MutableSequence[grafeas.grafeas_v1.types.InTotoSlsaProvenanceV1.ResourceDescriptor]
- class SlsaProvenanceV1(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageKeep in sync with schema at https://github.com/slsa-framework/slsa/blob/main/docs/provenance/schema/v1/provenance.proto Builder renamed to ProvenanceBuilder because of Java conflicts.
- build_definition¶
- run_details¶
- class grafeas.grafeas_v1.types.InTotoStatement(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageSpec defined at https://github.com/in-toto/attestation/tree/main/spec#statement The serialized InTotoStatement will be stored as Envelope.payload. Envelope.payloadType is always “application/vnd.in-toto+json”.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- subject¶
- Type
MutableSequence[grafeas.grafeas_v1.types.Subject]
- class grafeas.grafeas_v1.types.Jwt(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- compact_jwt¶
The compact encoding of a JWS, which is always three base64 encoded strings joined by periods. For details, see:
https://tools.ietf.org/html/rfc7515.html#section-3.1
- Type
- class grafeas.grafeas_v1.types.Layer(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageLayer holds metadata specific to a layer of a Docker image.
- directive¶
Required. The recovered Dockerfile directive used to construct this layer. See https://docs.docker.com/engine/reference/builder/ for more information.
- Type
- class grafeas.grafeas_v1.types.LayerDetails(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageDetails about the layer a package was found in.
- chain_id¶
The layer chain ID (sha256 hash) of the layer in the container image. https://github.com/opencontainers/image-spec/blob/main/config.md#layer-chainid
- Type
- command¶
The layer build command that was used to build the layer. This may not be found in all layers depending on how the container image is built.
- Type
- base_images¶
The base images the layer is found within.
- Type
MutableSequence[grafeas.grafeas_v1.types.BaseImage]
- class grafeas.grafeas_v1.types.License(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageLicense information.
- expression¶
Often a single license can be used to represent the licensing terms. Sometimes it is necessary to include a choice of one or more licenses or some combination of license identifiers. Examples: “LGPL-2.1-only OR MIT”, “LGPL-2.1-only AND MIT”, “GPL-2.0-or-later WITH Bison-exception-2.2”.
- Type
- class grafeas.grafeas_v1.types.ListNoteOccurrencesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to list occurrences for a note.
- name¶
The name of the note to list occurrences for in the form of
projects/[PROVIDER_ID]/notes/[NOTE_ID].- Type
- class grafeas.grafeas_v1.types.ListNoteOccurrencesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageResponse for listing occurrences for a note.
- occurrences¶
The occurrences attached to the specified note.
- Type
MutableSequence[grafeas.grafeas_v1.types.Occurrence]
- class grafeas.grafeas_v1.types.ListNotesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to list notes.
- page_size¶
Number of notes to return in the list. Must be positive. Max allowed page size is 1000. If not specified, page size defaults to 20.
- Type
- class grafeas.grafeas_v1.types.ListNotesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageResponse for listing notes.
- notes¶
The notes requested.
- Type
MutableSequence[grafeas.grafeas_v1.types.Note]
- class grafeas.grafeas_v1.types.ListOccurrencesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to list occurrences.
- parent¶
The name of the project to list occurrences for in the form of
projects/[PROJECT_ID].- Type
- page_size¶
Number of occurrences to return in the list. Must be positive. Max allowed page size is 1000. If not specified, page size defaults to 20.
- Type
- class grafeas.grafeas_v1.types.ListOccurrencesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageResponse for listing occurrences.
- occurrences¶
The occurrences requested.
- Type
MutableSequence[grafeas.grafeas_v1.types.Occurrence]
- class grafeas.grafeas_v1.types.Location(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageAn occurrence of a particular package installation found within a system’s filesystem. E.g., glibc was found in
/var/lib/dpkg/status.- cpe_uri¶
Deprecated. The CPE URI in CPE format
- Type
- version¶
Deprecated. The version installed at this location.
- class grafeas.grafeas_v1.types.Metadata(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageOther properties of the build.
- build_invocation_id¶
Identifies the particular build invocation, which can be useful for finding associated logs or other ad-hoc analysis. The value SHOULD be globally unique, per in-toto Provenance spec.
- Type
- build_started_on¶
The timestamp of when the build started.
- build_finished_on¶
The timestamp of when the build completed.
- completeness¶
Indicates that the builder claims certain fields in this message to be complete.
- class grafeas.grafeas_v1.types.NonCompliantFile(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageDetails about files that caused a compliance check to fail.
- class grafeas.grafeas_v1.types.Note(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA type of analysis that can be done for a resource.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- name¶
Output only. The name of the note in the form of
projects/[PROVIDER_ID]/notes/[NOTE_ID].- Type
- kind¶
Output only. The type of analysis. This field can be used as a filter in list requests.
URLs associated with this note.
- Type
MutableSequence[grafeas.grafeas_v1.types.RelatedUrl]
- expiration_time¶
Time of expiration for this note. Empty if note does not expire.
- create_time¶
Output only. The time this note was created. This field can be used as a filter in list requests.
- update_time¶
Output only. The time this note was last updated. This field can be used as a filter in list requests.
Other notes related to this note.
- Type
MutableSequence[str]
- build¶
A note describing build provenance for a verifiable build.
This field is a member of oneof
type.
- package¶
A note describing a package hosted by various package managers.
This field is a member of oneof
type.
- discovery¶
A note describing the initial analysis of a resource.
This field is a member of oneof
type.
- vulnerability_assessment¶
A note describing a vulnerability assessment.
This field is a member of oneof
type.
- class grafeas.grafeas_v1.types.NoteKind(value)[source]¶
Bases:
proto.enums.EnumKind represents the kinds of notes supported.
- Values:
- NOTE_KIND_UNSPECIFIED (0):
Default value. This value is unused.
- VULNERABILITY (1):
The note and occurrence represent a package vulnerability.
- BUILD (2):
The note and occurrence assert build provenance.
- IMAGE (3):
This represents an image basis relationship.
- PACKAGE (4):
This represents a package installed via a package manager.
- DEPLOYMENT (5):
The note and occurrence track deployment events.
- DISCOVERY (6):
The note and occurrence track the initial discovery status of a resource.
- ATTESTATION (7):
This represents a logical “role” that can attest to artifacts.
- UPGRADE (8):
This represents an available package upgrade.
- COMPLIANCE (9):
This represents a Compliance Note
- DSSE_ATTESTATION (10):
This represents a DSSE attestation Note
- VULNERABILITY_ASSESSMENT (11):
This represents a Vulnerability Assessment.
- SBOM_REFERENCE (12):
This represents an SBOM Reference.
- SECRET (13):
This represents a secret.
- class grafeas.grafeas_v1.types.Occurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageAn instance of an analysis type that has been found on a resource.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- name¶
Output only. The name of the occurrence in the form of
projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID].- Type
- resource_uri¶
Required. Immutable. A URI that represents the resource for which the occurrence applies. For example,
https://gcr.io/project/image@sha256:123abcfor a Docker image.- Type
- note_name¶
Required. Immutable. The analysis note associated with this occurrence, in the form of
projects/[PROVIDER_ID]/notes/[NOTE_ID]. This field can be used as a filter in list requests.- Type
- kind¶
Output only. This explicitly denotes which of the occurrence details are specified. This field can be used as a filter in list requests.
- create_time¶
Output only. The time this occurrence was created.
- update_time¶
Output only. The time this occurrence was last updated.
- image¶
Describes how this resource derives from the basis in the associated note.
This field is a member of oneof
details.
- package¶
Describes the installation of a package on the linked resource.
This field is a member of oneof
details.
- deployment¶
Describes the deployment of an artifact on a runtime.
This field is a member of oneof
details.
- upgrade¶
Describes an available package upgrade on the linked resource.
This field is a member of oneof
details.
- compliance¶
Describes a compliance violation on a linked resource.
This field is a member of oneof
details.
- dsse_attestation¶
Describes an attestation of an artifact using dsse.
This field is a member of oneof
details.
- sbom_reference¶
Describes a specific SBOM reference occurrences.
This field is a member of oneof
details.
- class grafeas.grafeas_v1.types.PackageNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessagePackageNote represents a particular package version.
- distribution¶
Deprecated. The various channels by which a package is distributed.
- Type
MutableSequence[grafeas.grafeas_v1.types.Distribution]
- package_type¶
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
- Type
- cpe_uri¶
The cpe_uri in CPE format denoting the package manager version distributing a package. The cpe_uri will be blank for language packages.
- Type
- architecture¶
The CPU architecture for which packages in this distribution channel were built. Architecture will be blank for language packages.
- version¶
The version of the package.
- license_¶
Licenses that have been declared by the authors of the package.
- digest¶
Hash value, typically a file digest, that allows unique identification a specific package.
- Type
MutableSequence[grafeas.grafeas_v1.types.Digest]
- class grafeas.grafeas_v1.types.PackageOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageDetails on how a particular software package was installed on a system.
- location¶
All of the places within the filesystem versions of this package have been found.
- Type
MutableSequence[grafeas.grafeas_v1.types.Location]
- package_type¶
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
- Type
- cpe_uri¶
The cpe_uri in CPE format denoting the package manager version distributing a package. The cpe_uri will be blank for language packages.
- Type
- architecture¶
The CPU architecture for which packages in this distribution channel were built. Architecture will be blank for language packages.
- license_¶
Licenses that have been declared by the authors of the package.
- version¶
The version of the package.
- class grafeas.grafeas_v1.types.ProjectRepoId(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageSelects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.
- class grafeas.grafeas_v1.types.Recipe(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageSteps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.
- type_¶
URI indicating what type of recipe was performed. It determines the meaning of recipe.entryPoint, recipe.arguments, recipe.environment, and materials.
- Type
- defined_in_material¶
Index in materials containing the recipe steps that are not implied by recipe.type. For example, if the recipe type were “make”, then this would point to the source containing the Makefile, not the make program itself. Set to -1 if the recipe doesn’t come from a material, as zero is default unset value for int64.
- Type
- entry_point¶
String identifying the entry point into the build. This is often a path to a configuration file and/or a target label within that file. The syntax and meaning are defined by recipe.type. For example, if the recipe type were “make”, then this would reference the directory in which to run make as well as which target to use.
- Type
- arguments¶
Collection of all external inputs that influenced the build on top of recipe.definedInMaterial and recipe.entryPoint. For example, if the recipe type were “make”, then this might be the flags passed to make aside from the target, which is captured in recipe.entryPoint. Since the arguments field can greatly vary in structure, depending on the builder and recipe type, this is of form “Any”.
- Type
MutableSequence[google.protobuf.any_pb2.Any]
- environment¶
Any other builder-controlled inputs necessary for correctly evaluating the recipe. Usually only needed for reproducing the build but not evaluated as part of policy. Since the environment field can greatly vary in structure, depending on the builder and recipe type, this is of form “Any”.
- Type
MutableSequence[google.protobuf.any_pb2.Any]
- class grafeas.grafeas_v1.types.RelatedUrl(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageMetadata for any related URL information.
- class grafeas.grafeas_v1.types.RepoId(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA unique identifier for a Cloud Repo.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- class grafeas.grafeas_v1.types.SBOMReferenceNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe note representing an SBOM reference.
- class grafeas.grafeas_v1.types.SBOMReferenceOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe occurrence representing an SBOM reference as applied to a specific resource. The occurrence follows the DSSE specification. See https://github.com/secure-systems-lab/dsse/blob/master/envelope.md for more details.
- payload¶
The actual payload that contains the SBOM reference data.
- payload_type¶
The kind of payload that SbomReferenceIntotoPayload takes. Since it’s in the intoto format, this value is expected to be ‘application/vnd.in-toto+json’.
- Type
- signatures¶
The signatures over the payload.
- Type
MutableSequence[grafeas.grafeas_v1.types.EnvelopeSignature]
- class grafeas.grafeas_v1.types.SbomReferenceIntotoPayload(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe actual payload that contains the SBOM Reference data. The payload follows the intoto statement specification. See https://github.com/in-toto/attestation/blob/main/spec/v1.0/statement.md for more details.
- subject¶
Set of software artifacts that the attestation applies to. Each element represents a single software artifact.
- Type
MutableSequence[grafeas.grafeas_v1.types.Subject]
- predicate¶
Additional parameters of the Predicate. Includes the actual data about the SBOM.
- class grafeas.grafeas_v1.types.SbomReferenceIntotoPredicate(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA predicate which describes the SBOM being referenced.
- class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.SecretKind(value)[source]¶
Bases:
proto.enums.EnumKind of secret.
- Values:
- SECRET_KIND_UNSPECIFIED (0):
Unspecified
- SECRET_KIND_UNKNOWN (1):
The secret kind is unknown.
- SECRET_KIND_GCP_SERVICE_ACCOUNT_KEY (2):
A GCP service account key per:
https://cloud.google.com/iam/docs/creating-managing-service-account-keys
- class grafeas.grafeas_v1.types.SecretLocation(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe location of the secret.
- class grafeas.grafeas_v1.types.SecretNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe note representing a secret.
- class grafeas.grafeas_v1.types.SecretOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe occurrence provides details of a secret.
- kind¶
Type of secret.
- locations¶
Locations where the secret is detected.
- Type
MutableSequence[grafeas.grafeas_v1.types.SecretLocation]
- statuses¶
Status of the secret.
- Type
MutableSequence[grafeas.grafeas_v1.types.SecretStatus]
- class grafeas.grafeas_v1.types.SecretStatus(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe status of the secret with a timestamp.
- status¶
The status of the secret.
- update_time¶
The time the secret status was last updated.
- class Status(value)[source]¶
Bases:
proto.enums.EnumThe status of the secret.
- Values:
- STATUS_UNSPECIFIED (0):
Unspecified
- UNKNOWN (1):
The status of the secret is unknown.
- VALID (2):
The secret is valid.
- INVALID (3):
The secret is invalid.
- class grafeas.grafeas_v1.types.Severity(value)[source]¶
Bases:
proto.enums.EnumNote provider assigned severity/impact ranking.
- Values:
- SEVERITY_UNSPECIFIED (0):
Unknown.
- MINIMAL (1):
Minimal severity.
- LOW (2):
Low severity.
- MEDIUM (3):
Medium severity.
- HIGH (4):
High severity.
- CRITICAL (5):
Critical severity.
- class grafeas.grafeas_v1.types.Signature(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageVerifiers (e.g. Kritis implementations) MUST verify signatures with respect to the trust anchors defined in policy (e.g. a Kritis policy). Typically this means that the verifier has been configured with a map from
public_key_idto public key material (and any required parameters, e.g. signing algorithm).In particular, verification implementations MUST NOT treat the signature
public_key_idas anything more than a key lookup hint. Thepublic_key_idDOES NOT validate or authenticate a public key; it only provides a mechanism for quickly selecting a public key ALREADY CONFIGURED on the verifier through a trusted channel. Verification implementations MUST reject signatures in any of the following circumstances:The
public_key_idis not recognized by the verifier.The public key that
public_key_idrefers to does not verify the signature with respect to the payload.
The
signaturecontents SHOULD NOT be “attached” (where the payload is included with the serializedsignaturebytes). Verifiers MUST ignore any “attached” payload and only verify signatures with respect to explicitly provided payload (e.g. apayloadfield on the proto message that holds this Signature, or the canonical serialization of the proto message that holds this signature).- signature¶
The content of the signature, an opaque bytestring. The payload that this signature verifies MUST be unambiguously provided with the Signature during verification. A wrapper message might provide the payload explicitly. Alternatively, a message might have a canonical serialization that can always be unambiguously computed to derive the payload.
- Type
- public_key_id¶
The identifier for the public key that verifies this signature.
The
public_key_idis required.The
public_key_idSHOULD be an RFC3986 conformant URI.When possible, the
public_key_idSHOULD be an immutable reference, such as a cryptographic digest.
Examples of valid
public_key_ids:OpenPGP V4 public key fingerprint:
“openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA” See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more details on this scheme.
RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER serialization):
“ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU”
“nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5”.
- Type
- class grafeas.grafeas_v1.types.SlsaProvenance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- builder¶
required
- recipe¶
Identifies the configuration used for the build. When combined with materials, this SHOULD fully describe the build, such that re-running this recipe results in bit-for-bit identical output (if the build is reproducible).
- metadata¶
- materials¶
The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on. This is considered to be incomplete unless metadata.completeness.materials is true. Unset or null is equivalent to empty.
- Type
MutableSequence[grafeas.grafeas_v1.types.SlsaProvenance.Material]
- class Material(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class SlsaBuilder(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message
- class SlsaCompleteness(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageIndicates that the builder claims certain fields in this message to be complete.
- arguments¶
If true, the builder claims that recipe.arguments is complete, meaning that all external inputs are properly captured in the recipe.
- Type
- environment¶
If true, the builder claims that recipe.environment is claimed to be complete.
- Type
- class SlsaMetadata(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageOther properties of the build.
- build_invocation_id¶
Identifies the particular build invocation, which can be useful for finding associated logs or other ad-hoc analysis. The value SHOULD be globally unique, per in-toto Provenance spec.
- Type
- build_started_on¶
The timestamp of when the build started.
- build_finished_on¶
The timestamp of when the build completed.
- completeness¶
Indicates that the builder claims certain fields in this message to be complete.
- class SlsaRecipe(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageSteps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.
- type_¶
URI indicating what type of recipe was performed. It determines the meaning of recipe.entryPoint, recipe.arguments, recipe.environment, and materials.
- Type
- defined_in_material¶
Index in materials containing the recipe steps that are not implied by recipe.type. For example, if the recipe type were “make”, then this would point to the source containing the Makefile, not the make program itself. Set to -1 if the recipe doesn’t come from a material, as zero is default unset value for int64.
- Type
- entry_point¶
String identifying the entry point into the build. This is often a path to a configuration file and/or a target label within that file. The syntax and meaning are defined by recipe.type. For example, if the recipe type were “make”, then this would reference the directory in which to run make as well as which target to use.
- Type
- arguments¶
Collection of all external inputs that influenced the build on top of recipe.definedInMaterial and recipe.entryPoint. For example, if the recipe type were “make”, then this might be the flags passed to make aside from the target, which is captured in recipe.entryPoint. Depending on the recipe Type, the structure may be different.
- environment¶
Any other builder-controlled inputs necessary for correctly evaluating the recipe. Usually only needed for reproducing the build but not evaluated as part of policy. Depending on the recipe Type, the structure may be different.
- class grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageSee full explanation of fields at slsa.dev/provenance/v0.2.
- invocation¶
- build_config¶
- materials¶
- Type
MutableSequence[grafeas.grafeas_v1.types.SlsaProvenanceZeroTwo.SlsaMaterial]
- class SlsaBuilder(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageIdentifies the entity that executed the recipe, which is trusted to have correctly performed the operation and populated this provenance.
- class SlsaCompleteness(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageIndicates that the builder claims certain fields in this message to be complete.
- class SlsaConfigSource(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageDescribes where the config file that kicked off the build came from. This is effectively a pointer to the source where buildConfig came from.
- class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class SlsaInvocation(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageIdentifies the event that kicked off the build.
- config_source¶
- parameters¶
- environment¶
- class SlsaMaterial(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on.
- class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.Source(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageSource describes the location of the source used for the build.
- artifact_storage_source_uri¶
If provided, the input binary artifacts for the build came from this location.
- Type
- file_hashes¶
Hash(es) of the build source, which can be used to verify that the original source integrity was maintained in the build.
The keys to this map are file paths used as build source and the values contain the hash values for those files.
If the build source came in a single package such as a gzipped tarfile (.tar.gz), the FileHash will be for the single path to that file.
- Type
MutableMapping[str, grafeas.grafeas_v1.types.FileHashes]
- context¶
If provided, the source code used for the build came from this location.
- additional_contexts¶
If provided, some of the source code used for the build may be found in these locations, in the case where the source repository had multiple remotes or submodules. This list will not include the context specified in the context field.
- Type
MutableSequence[grafeas.grafeas_v1.types.SourceContext]
- class FileHashesEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.SourceContext(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.
This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.
- cloud_repo¶
A SourceContext referring to a revision in a Google Cloud Source Repo.
This field is a member of oneof
context.
- git¶
A SourceContext referring to any third party Git repo (e.g., GitHub).
This field is a member of oneof
context.
- class LabelsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.Subject(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- digest¶
"<ALGORITHM>": "<HEX_VALUE>"Algorithms can be e.g. sha256, sha512 See https://github.com/in-toto/attestation/blob/main/spec/field_types.md#DigestSet
- class DigestEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶
Bases:
proto.message.Message
- class grafeas.grafeas_v1.types.UpdateNoteRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to update a note.
- note¶
The updated note.
- update_mask¶
The fields to update.
- class grafeas.grafeas_v1.types.UpdateOccurrenceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageRequest to update an occurrence.
- name¶
The name of the occurrence in the form of
projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID].- Type
- occurrence¶
The updated occurrence.
- update_mask¶
The fields to update.
- class grafeas.grafeas_v1.types.UpgradeDistribution(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities.
- cpe_uri¶
Required - The specific operating system this metadata applies to. See https://cpe.mitre.org/specification/.
- Type
- classification¶
The operating system classification of this Upgrade, as specified by the upstream operating system upgrade feed. For Windows the classification is one of the category_ids listed at https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ff357803(v=vs.85)
- Type
- class grafeas.grafeas_v1.types.UpgradeNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageAn Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be an Upgrade Note. For Windows, windows_update field represents the information related to the update.
- version¶
Required for non-Windows OS. The version of the package in machine + human readable form.
- distributions¶
Metadata about the upgrade for each specific operating system.
- Type
MutableSequence[grafeas.grafeas_v1.types.UpgradeDistribution]
- windows_update¶
Required for Windows OS. Represents the metadata about the Windows update.
- class grafeas.grafeas_v1.types.UpgradeOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageAn Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). For Windows, both distribution and windows_update contain information for the Windows update.
- parsed_version¶
Required for non-Windows OS. The version of the package in a machine + human readable form.
- distribution¶
Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
- windows_update¶
Required for Windows OS. Represents the metadata about the Windows update.
- class grafeas.grafeas_v1.types.Version(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageVersion contains structured information about the version of a package.
- inclusive¶
Whether this version is specifying part of an inclusive range. Grafeas does not have the capability to specify version ranges; instead we have fields that specify start version and end versions. At times this is insufficient - we also need to specify whether the version is included in the range or is excluded from the range. This boolean is expected to be set to true when the version is included in a range.
- Type
- kind¶
Required. Distinguishes between sentinel MIN/MAX versions and normal versions.
- full_name¶
Human readable version string. This string is of the form <epoch>:<name>-<revision> and is only set when kind is NORMAL.
- Type
- class VersionKind(value)[source]¶
Bases:
proto.enums.EnumWhether this is an ordinary package version or a sentinel MIN/MAX version.
- Values:
- VERSION_KIND_UNSPECIFIED (0):
Unknown.
- NORMAL (1):
A standard package version.
- MINIMUM (2):
A special version representing negative infinity.
- MAXIMUM (3):
A special version representing positive infinity.
- class grafeas.grafeas_v1.types.VulnerabilityAssessmentNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA single VulnerabilityAssessmentNote represents one particular product’s vulnerability assessment for one CVE.
- language_code¶
Identifies the language used by this document, corresponding to IETF BCP 47 / RFC 5646.
- Type
- publisher¶
Publisher details of this Note.
- product¶
The product affected by this vex.
- assessment¶
Represents a vulnerability assessment for the product.
- class Assessment(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageAssessment provides all information that is related to a single vulnerability for this product.
- cve¶
Holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability. Deprecated: Use vulnerability_id instead to denote CVEs.
- Type
- vulnerability_id¶
The vulnerability identifier for this Assessment. Will hold one of common identifiers e.g. CVE, GHSA etc.
- Type
Holds a list of references associated with this vulnerability item and assessment. These uris have additional information about the vulnerability and the assessment itself. E.g. Link to a document which details how this assessment concluded the state of this vulnerability.
- Type
MutableSequence[grafeas.grafeas_v1.types.RelatedUrl]
- state¶
Provides the state of this Vulnerability assessment.
- impacts¶
Contains information about the impact of this vulnerability, this will change with time.
- Type
MutableSequence[str]
- justification¶
Justification provides the justification when the state of the assessment if NOT_AFFECTED.
- remediations¶
Specifies details on how to handle (and presumably, fix) a vulnerability.
- Type
MutableSequence[grafeas.grafeas_v1.types.VulnerabilityAssessmentNote.Assessment.Remediation]
- class Justification(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageJustification provides the justification when the state of the assessment if NOT_AFFECTED.
- justification_type¶
The justification type for this vulnerability.
- class JustificationType(value)[source]¶
Bases:
proto.enums.EnumProvides the type of justification.
- Values:
- JUSTIFICATION_TYPE_UNSPECIFIED (0):
JUSTIFICATION_TYPE_UNSPECIFIED.
- COMPONENT_NOT_PRESENT (1):
The vulnerable component is not present in the product.
- VULNERABLE_CODE_NOT_PRESENT (2):
The vulnerable code is not present. Typically this case occurs when source code is configured or built in a way that excludes the vulnerable code.
- VULNERABLE_CODE_NOT_IN_EXECUTE_PATH (3):
The vulnerable code can not be executed. Typically this case occurs when the product includes the vulnerable code but does not call or use the vulnerable code.
- VULNERABLE_CODE_CANNOT_BE_CONTROLLED_BY_ADVERSARY (4):
The vulnerable code cannot be controlled by an attacker to exploit the vulnerability.
- INLINE_MITIGATIONS_ALREADY_EXIST (5):
The product includes built-in protections or features that prevent exploitation of the vulnerability. These built-in protections cannot be subverted by the attacker and cannot be configured or disabled by the user. These mitigations completely prevent exploitation based on known attack vectors.
- class Remediation(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageSpecifies details on how to handle (and presumably, fix) a vulnerability.
- remediation_type¶
The type of remediation that can be applied.
- remediation_uri¶
Contains the URL where to obtain the remediation.
- class RemediationType(value)[source]¶
Bases:
proto.enums.EnumThe type of remediation that can be applied.
- Values:
- REMEDIATION_TYPE_UNSPECIFIED (0):
No remediation type specified.
- MITIGATION (1):
A MITIGATION is available.
- NO_FIX_PLANNED (2):
No fix is planned.
- NONE_AVAILABLE (3):
Not available.
- VENDOR_FIX (4):
A vendor fix is available.
- WORKAROUND (5):
A workaround is available.
- class State(value)[source]¶
Bases:
proto.enums.EnumProvides the state of this Vulnerability assessment.
- Values:
- STATE_UNSPECIFIED (0):
No state is specified.
- AFFECTED (1):
This product is known to be affected by this vulnerability.
- NOT_AFFECTED (2):
This product is known to be not affected by this vulnerability.
- FIXED (3):
This product contains a fix for this vulnerability.
- UNDER_INVESTIGATION (4):
It is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation.
- class Product(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageProduct contains information about a product and how to uniquely identify it. (– api-linter: core::0123::resource-annotation=disabled aip.dev/not-precedent: Product is not a separate resource. –)
- id¶
Token that identifies a product so that it can be referred to from other parts in the document. There is no predefined format as long as it uniquely identifies a group in the context of the current document.
- Type
- class Publisher(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessagePublisher contains information about the publisher of this Note. (– api-linter: core::0123::resource-annotation=disabled aip.dev/not-precedent: Publisher is not a separate resource. –)
- issuing_authority¶
Provides information about the authority of the issuing party to release the document, in particular, the party’s constituency and responsibilities or other obligations.
- Type
- publisher_namespace¶
The context or namespace. Contains a URL which is under control of the issuing party and can be used as a globally unique identifier for that issuing party. Example: https://csaf.io
- Type
- class grafeas.grafeas_v1.types.VulnerabilityNote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA security vulnerability that can be found in resources.
- cvss_score¶
The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.
- Type
- severity¶
The note provider assigned severity of this vulnerability.
- details¶
Details of all known distros and packages affected by this vulnerability.
- Type
MutableSequence[grafeas.grafeas_v1.types.VulnerabilityNote.Detail]
- cvss_v3¶
The full description of the CVSSv3 for this vulnerability.
- windows_details¶
Windows details get their own format because the information format and model don’t match a normal detail. Specifically Windows updates are done as patches, thus Windows vulnerabilities really are a missing package, rather than a package being at an incorrect version.
- Type
MutableSequence[grafeas.grafeas_v1.types.VulnerabilityNote.WindowsDetail]
- source_update_time¶
The time this information was last changed at the source. This is an upstream timestamp from the underlying information source - e.g. Ubuntu security tracker.
- cvss_version¶
CVSS version used to populate cvss_score and severity.
- cvss_v2¶
The full description of the v2 CVSS for this vulnerability.
- class Detail(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA detail for a distro and package affected by this vulnerability and its associated fix (if one is available).
- package_type¶
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
- Type
- affected_version_start¶
The version number at the start of an interval in which this vulnerability exists. A vulnerability can affect a package between version numbers that are disjoint sets of intervals (example: [1.0.0-1.1.0], [2.4.6-2.4.8] and [4.5.6-4.6.8]) each of which will be represented in its own Detail. If a specific affected version is provided by a vulnerability database, affected_version_start and affected_version_end will be the same in that Detail.
- affected_version_end¶
The version number at the end of an interval in which this vulnerability exists. A vulnerability can affect a package between version numbers that are disjoint sets of intervals (example: [1.0.0-1.1.0], [2.4.6-2.4.8] and [4.5.6-4.6.8]) each of which will be represented in its own Detail. If a specific affected version is provided by a vulnerability database, affected_version_start and affected_version_end will be the same in that Detail.
- fixed_cpe_uri¶
The distro recommended CPE URI to update to that contains a fix for this vulnerability. It is possible for this to be different from the affected_cpe_uri.
- Type
- fixed_package¶
The distro recommended package to update to that contains a fix for this vulnerability. It is possible for this to be different from the affected_package.
- Type
- fixed_version¶
The distro recommended version to update to that contains a fix for this vulnerability. Setting this to VersionKind.MAXIMUM means no such version is yet available.
- is_obsolete¶
Whether this detail is obsolete. Occurrences are expected not to point to obsolete details.
- Type
- source_update_time¶
The time this information was last changed at the source. This is an upstream timestamp from the underlying information source - e.g. Ubuntu security tracker.
- class WindowsDetail(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- fixing_kbs¶
Required. The names of the KBs which have hotfixes to mitigate this vulnerability. Note that there may be multiple hotfixes (and thus multiple KBs) that mitigate a given vulnerability. Currently any listed KBs presence is considered a fix.
- Type
MutableSequence[grafeas.grafeas_v1.types.VulnerabilityNote.WindowsDetail.KnowledgeBase]
- class KnowledgeBase(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.Message- url¶
A link to the KB in the [Windows update catalog] (https://www.catalog.update.microsoft.com/).
- Type
- class grafeas.grafeas_v1.types.VulnerabilityOccurrence(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageAn occurrence of a severity vulnerability on a resource.
- type_¶
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
- Type
- severity¶
Output only. The note provider assigned severity of this vulnerability.
- cvss_score¶
Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.
- Type
- cvssv3¶
The cvss v3 score for the vulnerability.
- package_issue¶
Required. The set of affected locations and their fixes (if available) within the associated resource.
- Type
MutableSequence[grafeas.grafeas_v1.types.VulnerabilityOccurrence.PackageIssue]
Output only. URLs related to this vulnerability.
- Type
MutableSequence[grafeas.grafeas_v1.types.RelatedUrl]
- effective_severity¶
The distro assigned severity for this vulnerability when it is available, otherwise this is the note provider assigned severity.
When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
- fix_available¶
Output only. Whether at least one of the affected packages has a fix available.
- Type
- cvss_version¶
Output only. CVSS version used to populate cvss_score and severity.
- cvss_v2¶
The cvss v2 score for the vulnerability.
- vex_assessment¶
- class PackageIssue(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageA detail for a distro and package this vulnerability occurrence was found in and its associated fix (if one is available).
- affected_version¶
Required. The version of the package that is installed on the resource affected by this vulnerability.
- fixed_cpe_uri¶
The CPE URI this vulnerability was fixed in. It is possible for this to be different from the affected_cpe_uri.
- Type
- fixed_package¶
The package this vulnerability was fixed in. It is possible for this to be different from the affected_package.
- Type
- fixed_version¶
Required. The version of the package this vulnerability was fixed in. Setting this to VersionKind.MAXIMUM means no fix is yet available.
- effective_severity¶
The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
- file_location¶
The location at which this package was found.
- Type
MutableSequence[grafeas.grafeas_v1.types.FileLocation]
- class VexAssessment(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageVexAssessment provides all publisher provided Vex information that is related to this vulnerability.
- cve¶
Holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability. Deprecated: Use vulnerability_id instead to denote CVEs.
- Type
- vulnerability_id¶
The vulnerability identifier for this Assessment. Will hold one of common identifiers e.g. CVE, GHSA etc.
- Type
Holds a list of references associated with this vulnerability item and assessment.
- Type
MutableSequence[grafeas.grafeas_v1.types.RelatedUrl]
- note_name¶
The VulnerabilityAssessment note from which this VexAssessment was generated. This will be of the form:
projects/[PROJECT_ID]/notes/[NOTE_ID]. (– api-linter: core::0122::name-suffix=disabled aip.dev/not-precedent: The suffix is kept for consistency. –)- Type
- state¶
Provides the state of this Vulnerability assessment.
- impacts¶
Contains information about the impact of this vulnerability, this will change with time.
- Type
MutableSequence[str]
- remediations¶
Specifies details on how to handle (and presumably, fix) a vulnerability.
- Type
MutableSequence[grafeas.grafeas_v1.types.VulnerabilityAssessmentNote.Assessment.Remediation]
- justification¶
Justification provides the justification when the state of the assessment if NOT_AFFECTED.
- class grafeas.grafeas_v1.types.WindowsUpdate(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageWindows Update represents the metadata about the update for the Windows operating system. The fields in this message come from the Windows Update API documented at https://docs.microsoft.com/en-us/windows/win32/api/wuapi/nn-wuapi-iupdate.
- identity¶
Required - The unique identifier for the update.
- categories¶
The list of categories to which the update belongs.
- Type
MutableSequence[grafeas.grafeas_v1.types.WindowsUpdate.Category]
- kb_article_ids¶
The Microsoft Knowledge Base article IDs that are associated with the update.
- Type
MutableSequence[str]
- last_published_timestamp¶
The last published timestamp of the update.
- class Category(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶
Bases:
proto.message.MessageThe category to which the update belongs.
