package grafeas.v1
Get desktop application:
View/edit binary Protocol Buffers messages
service Grafeas
grafeas.proto:64[Grafeas](https://grafeas.io) API. Retrieves analysis results of Cloud components such as Docker container images. Analysis results are stored as a series of occurrences. An `Occurrence` contains information about a specific analysis instance on a resource. An occurrence refers to a `Note`. A note contains details describing the analysis and is generally stored in a separate project, called a `Provider`. Multiple occurrences can refer to the same note. For example, an SSL vulnerability could affect multiple images. In this case, there would be one note for the vulnerability and an occurrence for each image with the vulnerability referring to that note.
rpc GetOccurrence (, )
grafeas.proto:68Gets the specified occurrence.
message
grafeas.proto:378Request to get an occurrence.
string name = 1
The name of the occurrence in the form of `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
rpc ListOccurrences (, )
grafeas.proto:79Lists occurrences for the specified project.
message
grafeas.proto:388Request to list occurrences.
string parent = 1
The name of the project to list occurrences for in the form of `projects/[PROJECT_ID]`.
string filter = 2
The filter expression.
int32 page_size = 3
Number of occurrences to return in the list. Must be positive. Max allowed page size is 1000. If not specified, page size defaults to 20.
string page_token = 4
Token to provide to skip to a particular spot in the list.
message
grafeas.proto:408Response for listing occurrences.
repeated occurrences = 1
The occurrences requested.
string next_page_token = 2
The next pagination token in the list response. It should be used as `page_token` for the following request. An empty value means no more results.
rpc DeleteOccurrence (, )
grafeas.proto:93Deletes the specified occurrence. For example, use this method to delete an occurrence when the occurrence is no longer applicable for the given resource.
message
grafeas.proto:418Request to delete an occurrence.
string name = 1
The name of the occurrence in the form of `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
rpc CreateOccurrence (, )
grafeas.proto:105Creates a new occurrence.
message
grafeas.proto:428Request to create a new occurrence.
string parent = 1
The name of the project in the form of `projects/[PROJECT_ID]`, under which the occurrence is to be created.
optional occurrence = 2
The occurrence to create.
Creates new occurrences in batch.
message
grafeas.proto:585Request to create occurrences in batch.
string parent = 1
The name of the project in the form of `projects/[PROJECT_ID]`, under which the occurrences are to be created.
repeated occurrences = 2
The occurrences to create. Max allowed length is 1000.
message
grafeas.proto:598Response for creating occurrences in batch.
repeated occurrences = 1
The occurrences that were created.
rpc UpdateOccurrence (, )
grafeas.proto:132Updates the specified occurrence.
message
grafeas.proto:440Request to update an occurrence.
string name = 1
The name of the occurrence in the form of `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
optional occurrence = 2
The updated occurrence.
optional update_mask = 3
The fields to update.
rpc GetOccurrenceNote (, )
grafeas.proto:146Gets the note attached to the specified occurrence. Consumer projects can use this method to get a note that belongs to a provider project.
message
grafeas.proto:464Request to get the note to which the specified occurrence is attached.
string name = 1
The name of the occurrence in the form of `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
rpc GetNote (, )
grafeas.proto:157Gets the specified note.
message
grafeas.proto:454Request to get a note.
string name = 1
The name of the note in the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
rpc ListNotes (, )
grafeas.proto:166Lists notes for the specified project.
message
grafeas.proto:474Request to list notes.
string parent = 1
The name of the project to list notes for in the form of `projects/[PROJECT_ID]`.
string filter = 2
The filter expression.
int32 page_size = 3
Number of notes to return in the list. Must be positive. Max allowed page size is 1000. If not specified, page size defaults to 20.
string page_token = 4
Token to provide to skip to a particular spot in the list.
message
grafeas.proto:494Response for listing notes.
repeated notes = 1
The notes requested.
string next_page_token = 2
The next pagination token in the list response. It should be used as `page_token` for the following request. An empty value means no more results.
rpc DeleteNote (, )
grafeas.proto:175Deletes the specified note.
message
grafeas.proto:504Request to delete a note.
string name = 1
The name of the note in the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
rpc CreateNote (, )
grafeas.proto:186Creates a new note.
message
grafeas.proto:514Request to create a new note.
string parent = 1
The name of the project in the form of `projects/[PROJECT_ID]`, under which the note is to be created.
string note_id = 2
The ID to use for this note.
optional note = 3
The note to create.
rpc BatchCreateNotes (, )
grafeas.proto:199Creates new notes in batch.
message
grafeas.proto:566Request to create notes in batch.
string parent = 1
The name of the project in the form of `projects/[PROJECT_ID]`, under which the notes are to be created.
map<string, > notes = 2
The notes to create. Max allowed length is 1000.
message
grafeas.proto:579Response for creating notes in batch.
repeated notes = 1
The notes that were created.
rpc UpdateNote (, )
grafeas.proto:213Updates the specified note.
message
grafeas.proto:528Request to update a note.
string name = 1
The name of the note in the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
optional note = 2
The updated note.
optional update_mask = 3
The fields to update.
rpc ListNoteOccurrences (, )
grafeas.proto:228Lists occurrences referencing the specified note. Provider projects can use this method to get all occurrences across consumer projects referencing the specified note.
message
grafeas.proto:542Request to list occurrences for a note.
string name = 1
The name of the note to list occurrences for in the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
string filter = 2
The filter expression.
int32 page_size = 3
Number of occurrences to return in the list.
string page_token = 4
Token to provide to skip to a particular spot in the list.
message
grafeas.proto:558Response for listing occurrences for a note.
repeated occurrences = 1
The occurrences attached to the specified note.
string next_page_token = 2
Token to provide to skip to a particular spot in the list.
message
provenance.proto:175An alias to a repo revision.
Used in: ,
AliasContext.Kind kind = 1
The alias kind.
string name = 2
The alias name.
The type of an alias.
Used in:
KIND_UNSPECIFIED = 0
Unknown.
FIXED = 1
Git tag.
MOVABLE = 2
Git branch.
OTHER = 4
Used to specify non-standard aliases. For example, if a Git repo has a ref named "refs/foo/bar".
Instruction set architectures supported by various package managers.
Used in: , ,
ARCHITECTURE_UNSPECIFIED = 0
Unknown architecture.
X86 = 1
X86 architecture.
X64 = 2
X64 architecture.
message
provenance.proto:138Artifact describes a build product.
Used in:
string checksum = 1
Hash or checksum value of a binary, or Docker Registry 2.0 digest of a container.
string id = 2
Artifact ID, if any; for container images, this will be a URL by digest like `gcr.io/projectID/imagename@sha256:123456`.
repeated string names = 3
Related artifact names. This may be the path to a binary or jar file, or in the case of a container build, the name used to push the container image to Google Container Registry, as presented to `docker push`. Note that a single Artifact ID can have multiple names, for example if two tags are applied to one image.
message
attestation.proto:38Note kind that represents a logical attestation "role" or "authority". For example, an organization might have one `Authority` for "QA" and one for "build". This note is intended to act strictly as a grouping mechanism for the attached occurrences (Attestations). This grouping mechanism also provides a security boundary, since IAM ACLs gate the ability for a principle to attach an occurrence to a given note. It also provides a single point of lookup to find all attached attestation occurrences, even if they don't all live in the same project.
Used in:
optional hint = 1
Hint hints at the purpose of the attestation authority.
message
attestation.proto:46This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from "readable" names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.
Used in:
string human_readable_name = 1
Required. The human readable name of this attestation authority, for example "qa".
message
attestation.proto:71Occurrence that represents a single "attestation". The authenticity of an attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the authority to which this attestation is attached is primarily useful for lookup (how to find this attestation if you already know the authority and artifact to be verified) and intent (for which authority this attestation was intended to sign.
Used in: ,
bytes serialized_payload = 1
Required. The serialized payload that is verified by one or more `signatures`.
repeated signatures = 2
One or more signatures over `serialized_payload`. Verifier implementations should consider this attestation message verified if at least one `signature` verifies `serialized_payload`. See `Signature` in common.proto for more details on signature structure and verification.
repeated jwts = 3
One or more JWTs encoding a self-contained attestation. Each JWT encodes the payload that it verifies within the JWT itself. Verifier implementation SHOULD ignore the `serialized_payload` field when verifying these JWTs. If only JWTs are present on this AttestationOccurrence, then the `serialized_payload` SHOULD be left empty. Each JWT SHOULD encode a claim specific to the `resource_uri` of this Occurrence, but this is not validated by Grafeas metadata API implementations. The JWT itself is opaque to Grafeas.
message
common.proto:140BaseImage describes a base image of a container image.
Used in:
string name = 1
The name of the base image.
string repository = 2
The repository name in which the base image is from.
int32 layer_count = 3
The number of layers that the base image is composed of.
message
build.proto:30Note holding the version of the provider's builder and the signature of the provenance message in the build details occurrence.
Used in:
string builder_version = 1
Required. Immutable. Version of the builder which produced this build.
message
build.proto:36Details of a build occurrence.
Used in:
optional provenance = 1
The actual provenance for the build.
string provenance_bytes = 2
Serialized JSON representation of the provenance, used in generating the build signature in the corresponding build note. After verifying the signature, `provenance_bytes` can be unmarshalled and compared to the provenance to confirm that it is unchanged. A base64-encoded string representation of the provenance bytes is used for the signature in order to interoperate with openssl which expects this format for signature verification. The serialized form is captured both to avoid ambiguity in how the provenance is marshalled to json as well to prevent incompatibilities with future changes.
optional intoto_provenance = 3
Deprecated. See InTotoStatement for the replacement. In-toto Provenance representation as defined in spec.
optional intoto_statement = 4
In-toto Statement representation as defined in spec. The intoto_statement can contain any type of provenance. The serialized payload of the statement can be stored and signed in the Occurrence's envelope.
optional in_toto_slsa_provenance_v1 = 5
In-Toto Slsa Provenance V1 represents a slsa provenance meeting the slsa spec, wrapped in an in-toto statement. This allows for direct jsonification of a to-spec in-toto slsa statement with a to-spec slsa provenance.
message
provenance.proto:28Provenance of a build. Contains all information needed to verify the full details about the build from source to completion.
Used in:
string id = 1
Required. Unique identifier of the build.
string project_id = 2
ID of the project.
repeated commands = 3
Commands requested by the build.
repeated built_artifacts = 4
Output of the build.
optional create_time = 5
Time at which the build was created.
optional start_time = 6
Time at which execution of the build was started.
optional end_time = 7
Time at which execution of the build was finished.
string creator = 8
E-mail address of the user who initiated this build. Note that this was the user's e-mail address at the time the build was initiated; this address may not represent the same end-user for all time.
string logs_uri = 9
URI where any logs for this provenance were written.
optional source_provenance = 10
Details of the Source input to the build.
string trigger_id = 11
Trigger identifier if the build was triggered automatically; empty if not.
map<string, string> build_options = 12
Special options applied to this build. This is a catch-all field where build providers can enter any desired additional details.
string builder_version = 13
Version string of the builder at the time this build was executed.
message
intoto_provenance.proto:96Used in:
string id = 1
message
cvss.proto:92Common Vulnerability Scoring System. For details, see https://www.first.org/cvss/specification-document This is a message we will try to use for storing various versions of CVSS rather than making a separate proto for storing a specific version.
Used in: ,
float base_score = 1
The base score is a function of the base metric scores.
float exploitability_score = 2
float impact_score = 3
CVSS.AttackVector attack_vector = 4
Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments.
CVSS.AttackComplexity attack_complexity = 5
CVSS.Authentication authentication = 6
CVSS.PrivilegesRequired privileges_required = 7
CVSS.UserInteraction user_interaction = 8
CVSS.Scope scope = 9
CVSS.Impact confidentiality_impact = 10
CVSS.Impact integrity_impact = 11
CVSS.Impact availability_impact = 12
Used in:
ATTACK_COMPLEXITY_UNSPECIFIED = 0
ATTACK_COMPLEXITY_LOW = 1
ATTACK_COMPLEXITY_HIGH = 2
ATTACK_COMPLEXITY_MEDIUM = 3
Used in:
ATTACK_VECTOR_UNSPECIFIED = 0
ATTACK_VECTOR_NETWORK = 1
ATTACK_VECTOR_ADJACENT = 2
ATTACK_VECTOR_LOCAL = 3
ATTACK_VECTOR_PHYSICAL = 4
Used in:
AUTHENTICATION_UNSPECIFIED = 0
AUTHENTICATION_MULTIPLE = 1
AUTHENTICATION_SINGLE = 2
AUTHENTICATION_NONE = 3
Used in:
IMPACT_UNSPECIFIED = 0
IMPACT_HIGH = 1
IMPACT_LOW = 2
IMPACT_NONE = 3
IMPACT_PARTIAL = 4
IMPACT_COMPLETE = 5
Used in:
PRIVILEGES_REQUIRED_UNSPECIFIED = 0
PRIVILEGES_REQUIRED_NONE = 1
PRIVILEGES_REQUIRED_LOW = 2
PRIVILEGES_REQUIRED_HIGH = 3
Used in:
SCOPE_UNSPECIFIED = 0
SCOPE_UNCHANGED = 1
SCOPE_CHANGED = 2
Used in:
USER_INTERACTION_UNSPECIFIED = 0
USER_INTERACTION_NONE = 1
USER_INTERACTION_REQUIRED = 2
CVSS Version.
Used in: ,
CVSS_VERSION_UNSPECIFIED = 0
CVSS_VERSION_2 = 1
CVSS_VERSION_3 = 2
message
cvss.proto:27Common Vulnerability Scoring System version 3. For details, see https://www.first.org/cvss/specification-document
Used in:
float base_score = 1
The base score is a function of the base metric scores.
float exploitability_score = 2
float impact_score = 3
CVSSv3.AttackVector attack_vector = 5
Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments.
CVSSv3.AttackComplexity attack_complexity = 6
CVSSv3.PrivilegesRequired privileges_required = 7
CVSSv3.UserInteraction user_interaction = 8
CVSSv3.Scope scope = 9
CVSSv3.Impact confidentiality_impact = 10
CVSSv3.Impact integrity_impact = 11
CVSSv3.Impact availability_impact = 12
Used in:
ATTACK_COMPLEXITY_UNSPECIFIED = 0
ATTACK_COMPLEXITY_LOW = 1
ATTACK_COMPLEXITY_HIGH = 2
Used in:
ATTACK_VECTOR_UNSPECIFIED = 0
ATTACK_VECTOR_NETWORK = 1
ATTACK_VECTOR_ADJACENT = 2
ATTACK_VECTOR_LOCAL = 3
ATTACK_VECTOR_PHYSICAL = 4
Used in:
IMPACT_UNSPECIFIED = 0
IMPACT_HIGH = 1
IMPACT_LOW = 2
IMPACT_NONE = 3
Used in:
PRIVILEGES_REQUIRED_UNSPECIFIED = 0
PRIVILEGES_REQUIRED_NONE = 1
PRIVILEGES_REQUIRED_LOW = 2
PRIVILEGES_REQUIRED_HIGH = 3
Used in:
SCOPE_UNSPECIFIED = 0
SCOPE_UNCHANGED = 1
SCOPE_CHANGED = 2
Used in:
USER_INTERACTION_UNSPECIFIED = 0
USER_INTERACTION_NONE = 1
USER_INTERACTION_REQUIRED = 2
message
provenance.proto:198A CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.
Used in:
optional repo_id = 1
The ID of the repo.
oneof revision
A revision in a Cloud Repo can be identified by either its revision ID or its alias.
string revision_id = 2
A revision ID.
alias_context = 3
An alias, which may be a branch or tag.
message
provenance.proto:114Command describes a step performed as part of the build pipeline.
Used in:
string name = 1
Required. Name of the command, as presented on the command line, or if the command is packaged as a Docker container, as presented to `docker pull`.
repeated string env = 2
Environment variables set before running this command.
repeated string args = 3
Command-line arguments used when executing this command.
string dir = 4
Working directory (relative to project source root) used when running this command.
string id = 5
Optional unique identifier for this command, used in wait_for to reference this command as a dependency.
repeated string wait_for = 6
The ID(s) of the command(s) that this command depends on.
message
intoto_provenance.proto:66Indicates that the builder claims certain fields in this message to be complete.
Used in:
bool arguments = 1
If true, the builder claims that recipe.arguments is complete, meaning that all external inputs are properly captured in the recipe.
bool environment = 2
If true, the builder claims that recipe.environment is claimed to be complete.
bool materials = 3
If true, the builder claims that materials are complete, usually through some controls to prevent network access. Sometimes called "hermetic".
message
compliance.proto:26Used in:
string title = 1
The title that identifies this compliance check.
string description = 2
A description about this compliance check.
repeated version = 3
The OS and config versions the benchmark applies to.
string rationale = 4
A rationale for the existence of this compliance check.
string remediation = 5
A description of remediation steps if the compliance check fails.
oneof compliance_type
cis_benchmark = 6
bytes scan_instructions = 7
Serialized scan instructions with a predefined format.
oneof potential_impact
Potential impact of the suggested remediation
string impact = 8
message
compliance.proto:38A compliance check that is a CIS benchmark.
Used in:
int32 profile_level = 1
Severity severity = 2
message
compliance.proto:69An indication that the compliance checks in the associated ComplianceNote were not satisfied for particular resources or a specified reason.
Used in:
repeated non_compliant_files = 2
string non_compliance_reason = 3
optional version = 4
The OS and config version the benchmark was run on.
message
compliance.proto:55Describes the CIS benchmark version that is applicable to a given OS and os version.
Used in: ,
string cpe_uri = 1
The CPE URI (https://cpe.mitre.org/specification/) this benchmark is applicable to.
string benchmark_document = 3
The name of the document that defines this benchmark, e.g. "CIS Container-Optimized OS".
string version = 2
The version of the benchmark. This is set to the version of the OS-specific CIS document the benchmark is defined in.
message
dsse_attestation.proto:26Used in:
optional hint = 1
DSSEHint hints at the purpose of the attestation authority.
message
dsse_attestation.proto:34This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from "readable" names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.
Used in:
string human_readable_name = 1
Required. The human readable name of this attestation authority, for example "cloudbuild-prod".
message
dsse_attestation.proto:45Deprecated. Prefer to use a regular Occurrence, and populate the Envelope at the top level of the Occurrence.
Used in:
optional envelope = 1
If doing something security critical, make sure to verify the signatures in this metadata.
oneof decoded_payload
statement = 2
message
deployment.proto:27An artifact that can be deployed in some runtime.
Used in:
repeated string resource_uri = 1
Required. Resource URI for the artifact being deployed.
message
deployment.proto:33The period during which some deployable was active in a runtime.
Used in:
string user_email = 1
Identity of the user that triggered this deployment.
optional deploy_time = 2
Required. Beginning of the lifetime of this deployment.
optional undeploy_time = 3
End of the lifetime of this deployment.
string config = 4
Configuration used to create this deployment.
string address = 5
Address of the runtime element hosting this deployment.
repeated string resource_uri = 6
Output only. Resource URI for the artifact being deployed taken from the deployable field with the same name.
DeploymentOccurrence.Platform platform = 7
Platform hosting this deployment.
Types of platforms.
Used in:
PLATFORM_UNSPECIFIED = 0
Unknown.
GKE = 1
Google Container Engine.
FLEX = 2
Google App Engine: Flexible Environment.
CUSTOM = 3
Custom user-defined platform.
message
common.proto:179Digest information.
Used in:
string algo = 1
`SHA1`, `SHA512` etc.
bytes digest_bytes = 2
Value of the digest.
message
discovery.proto:32A note that indicates a type of analysis a provider would perform. This note exists in a provider's project. A `Discovery` occurrence is created in a consumer's project at the start of analysis.
Used in:
NoteKind analysis_kind = 1
Required. Immutable. The kind of analysis that is handled by this discovery.
message
discovery.proto:39Provides information about the analysis status of a discovered resource.
Used in:
DiscoveryOccurrence.ContinuousAnalysis continuous_analysis = 1
Whether the resource is continuously analyzed.
DiscoveryOccurrence.AnalysisStatus analysis_status = 2
The status of discovery for the resource.
optional analysis_completed = 7
repeated analysis_error = 8
Indicates any errors encountered during analysis of a resource. There could be 0 or more of these errors.
optional analysis_status_error = 3
When an error is encountered this will contain a LocalizedMessage under details to show to the user. The LocalizedMessage is output only and populated by the API.
string cpe = 4
The CPE of the resource being scanned.
optional last_scan_time = 5
The last time this resource was scanned.
optional archive_time = 6
The time occurrences related to this discovery occurrence were archived.
optional sbom_status = 9
The status of an SBOM generation.
optional vulnerability_attestation = 10
The status of an vulnerability attestation generation.
message
discovery.proto:80Indicates which analysis completed successfully. Multiple types of analysis can be performed on a single resource.
Used in:
repeated string analysis_type = 1
Analysis status for a resource. Currently for initial analysis only (not updated in continuous analysis).
Used in:
ANALYSIS_STATUS_UNSPECIFIED = 0
Unknown.
PENDING = 1
Resource is known but no action has been taken yet.
SCANNING = 2
Resource is being analyzed.
FINISHED_SUCCESS = 3
Analysis has finished successfully.
COMPLETE = 3
Analysis has completed.
FINISHED_FAILED = 4
Analysis has finished unsuccessfully, the analysis itself is in a bad state.
FINISHED_UNSUPPORTED = 5
The resource is known not to be supported.
Whether the resource is continuously analyzed.
Used in:
CONTINUOUS_ANALYSIS_UNSPECIFIED = 0
Unknown.
ACTIVE = 1
The resource is continuously analyzed.
INACTIVE = 2
The resource is ignored for continuous analysis.
message
discovery.proto:106The status of an SBOM generation.
Used in:
SBOMStatus.SBOMState sbom_state = 1
The progress of the SBOM generation.
string error = 2
If there was an error generating an SBOM, this will indicate what that error was.
An enum indicating the progress of the SBOM generation.
Used in:
SBOM_STATE_UNSPECIFIED = 0
Default unknown state.
PENDING = 1
SBOM scanning is pending.
COMPLETE = 2
SBOM scanning has completed.
message
discovery.proto:128The status of an vulnerability attestation generation.
Used in:
optional last_attempt_time = 1
The last time we attempted to generate an attestation.
VulnerabilityAttestation.VulnerabilityAttestationState state = 2
The success/failure state of the latest attestation attempt.
string error = 3
If failure, the error reason for why the attestation generation failed.
An enum indicating the state of the attestation generation.
Used in:
VULNERABILITY_ATTESTATION_STATE_UNSPECIFIED = 0
Default unknown state.
SUCCESS = 1
Attestation was successfully generated and stored.
FAILURE = 2
Attestation was unsuccessfully generated and stored.
message
package.proto:39This represents a particular channel of distribution for a given package. E.g., Debian's jessie-backports dpkg mirror.
Used in:
string cpe_uri = 1
The cpe_uri in [CPE format](https://cpe.mitre.org/specification/) denoting the package manager version distributing a package.
Architecture architecture = 2
The CPU architecture for which packages in this distribution channel were built.
optional latest_version = 3
The latest available version of this package in this distribution channel.
string maintainer = 4
A freeform string denoting the maintainer of this package.
string url = 5
The distribution channel-specific homepage for this package.
string description = 6
The distribution channel-specific description of this package.
message
common.proto:118MUST match https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An authenticated message of arbitrary type.
Used in: ,
bytes payload = 1
string payload_type = 2
repeated signatures = 3
message
common.proto:124Used in: ,
bytes sig = 1
string keyid = 2
message
provenance.proto:100Container message for hashes of byte content of files, used in source messages to verify integrity of source input to the build.
Used in:
repeated file_hash = 1
Required. Collection of file hashes.
message
common.proto:130Indicates the location at which a package was found.
Used in: ,
string file_path = 1
For jars that are contained inside .war files, this filepath can indicate the path to war file combined with the path to jar file.
optional layer_details = 2
Each package found in a file should have its own layer metadata (that is, information from the origin layer of the package).
message
image.proto:35A set of properties that uniquely identify a given Docker image.
Used in: ,
string v1_name = 1
Required. The layer ID of the final layer in the Docker image's v1 representation.
repeated string v2_blob = 2
Required. The ordered list of v2 blobs that represent a given image.
string v2_name = 3
Output only. The name of the image's v2 blobs computed via: [bottom] := v2_blob[bottom] [N] := sha256(v2_blob[N] + " " + v2_name[N+1]) Only the name of the final blob is kept.
message
provenance.proto:214A SourceContext referring to a Gerrit project.
Used in:
string host_uri = 1
The URI of a running Gerrit instance.
string gerrit_project = 2
The full project name within the host. Projects may be nested, so "project/subproject" is a valid project name. The "repo name" is the hostURI/project.
oneof revision
A revision in a Gerrit project can be identified by either its revision ID or its alias.
string revision_id = 3
A revision (commit) ID.
alias_context = 4
An alias, which may be a branch or tag.
message
provenance.proto:236A GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).
Used in:
string url = 1
Git repository URL.
string revision_id = 2
Git commit hash.
message
provenance.proto:106Container message for hash values.
Used in:
string type = 1
Required. The type of hash that was performed, e.g. "SHA-256".
bytes value = 2
Required. The hash value.
message
image.proto:55Basis describes the base image portion (Note) of the DockerImage relationship. Linked occurrences are derived from this or an equivalent image via: FROM <Basis.resource_url> Or an equivalent reference, e.g., a tag of the resource_url.
Used in:
string resource_url = 1
Required. Immutable. The resource_url for the resource representing the basis of associated occurrence images.
optional fingerprint = 2
Required. Immutable. The fingerprint of the base image.
message
image.proto:67Details of the derived image portion of the DockerImage relationship. This image would be produced from a Dockerfile with FROM <DockerImage.Basis in attached Note>.
Used in:
optional fingerprint = 1
Required. The fingerprint of the derived image.
int32 distance = 2
Output only. The number of layers by which this image differs from the associated image basis.
repeated layer_info = 3
This contains layer-specific metadata, if populated it has length "distance" and is ordered with [distance] being the layer immediately following the base image and [1] being the final layer.
string base_resource_url = 4
Output only. This contains the base image URL for the derived image occurrence.
message
intoto_provenance.proto:100Used in: ,
optional builder_config = 1
required
optional recipe = 2
Identifies the configuration used for the build. When combined with materials, this SHOULD fully describe the build, such that re-running this recipe results in bit-for-bit identical output (if the build is reproducible).
required
optional metadata = 3
repeated string materials = 4
The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on. This is considered to be incomplete unless metadata.completeness.materials is true. Unset or null is equivalent to empty.
message
intoto_statement.proto:56Used in:
string type = 1
InToto spec defined at https://github.com/in-toto/attestation/tree/main/spec#statement
repeated subject = 2
string predicate_type = 3
optional predicate = 4
message
intoto_statement.proto:72Used in:
string build_type = 1
optional external_parameters = 2
optional internal_parameters = 3
repeated resolved_dependencies = 4
message
intoto_statement.proto:101Used in:
string invocation_id = 1
optional started_on = 2
optional finished_on = 3
message
intoto_statement.proto:95Used in:
string id = 1
map<string, string> version = 2
repeated builder_dependencies = 3
message
intoto_statement.proto:79Used in: , ,
string name = 1
string uri = 2
map<string, string> digest = 3
bytes content = 4
string download_location = 5
string media_type = 6
map<string, > annotations = 7
message
intoto_statement.proto:89Used in:
optional builder = 1
optional metadata = 2
repeated byproducts = 3
message
intoto_statement.proto:67Keep in sync with schema at https://github.com/slsa-framework/slsa/blob/main/docs/provenance/schema/v1/provenance.proto Builder renamed to ProvenanceBuilder because of Java conflicts.
Used in:
optional build_definition = 1
optional run_details = 2
message
intoto_statement.proto:35Spec defined at https://github.com/in-toto/attestation/tree/main/spec#statement The serialized InTotoStatement will be stored as Envelope.payload. Envelope.payloadType is always "application/vnd.in-toto+json".
Used in: ,
string type = 1
Always `https://in-toto.io/Statement/v0.1`.
repeated subject = 2
string predicate_type = 3
`https://slsa.dev/provenance/v0.1` for SlsaProvenance.
oneof predicate
provenance = 4
slsa_provenance = 5
slsa_provenance_zero_two = 6
message
attestation.proto:56Used in:
string compact_jwt = 1
The compact encoding of a JWS, which is always three base64 encoded strings joined by periods. For details, see: https://tools.ietf.org/html/rfc7515.html#section-3.1
message
image.proto:25Layer holds metadata specific to a layer of a Docker image.
Used in:
string directive = 1
Required. The recovered Dockerfile directive used to construct this layer. See https://docs.docker.com/engine/reference/builder/ for more information.
string arguments = 2
The recovered arguments to the Dockerfile directive.
message
common.proto:150Details about the layer a package was found in.
Used in:
int32 index = 1
The index of the layer in the container image.
string diff_id = 2
The diff ID (typically a sha256 hash) of the layer in the container image.
string chain_id = 5
The layer chain ID (sha256 hash) of the layer in the container image. https://github.com/opencontainers/image-spec/blob/main/config.md#layer-chainid
string command = 3
The layer build command that was used to build the layer. This may not be found in all layers depending on how the container image is built.
repeated base_images = 4
The base images the layer is found within.
message
common.proto:166License information.
Used in: ,
string expression = 1
Often a single license can be used to represent the licensing terms. Sometimes it is necessary to include a choice of one or more licenses or some combination of license identifiers. Examples: "LGPL-2.1-only OR MIT", "LGPL-2.1-only AND MIT", "GPL-2.0-or-later WITH Bison-exception-2.2".
string comments = 2
Comments
message
package.proto:63An occurrence of a particular package installation found within a system's filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
Used in:
string cpe_uri = 1
Deprecated. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
optional version = 2
Deprecated. The version installed at this location.
string path = 3
The path from which we gathered that this package/version is installed.
message
intoto_provenance.proto:79Other properties of the build.
Used in:
string build_invocation_id = 1
Identifies the particular build invocation, which can be useful for finding associated logs or other ad-hoc analysis. The value SHOULD be globally unique, per in-toto Provenance spec.
optional build_started_on = 2
The timestamp of when the build started.
optional build_finished_on = 3
The timestamp of when the build completed.
optional completeness = 4
Indicates that the builder claims certain fields in this message to be complete.
bool reproducible = 5
If true, the builder claims that running the recipe on materials will produce bit-for-bit identical output.
message
compliance.proto:77Details about files that caused a compliance check to fail.
display_command is a single command that can be used to display a list of non compliant files. When there is no such command, we can also iterate a list of non compliant file using 'path'.
Used in:
string path = 1
Empty if `display_command` is set.
string display_command = 2
Command to display the non-compliant files.
string reason = 3
Explains why a file is non compliant for a CIS check.
message
grafeas.proto:309A type of analysis that can be done for a resource.
Used as response type in: Grafeas.CreateNote, Grafeas.GetNote, Grafeas.GetOccurrenceNote, Grafeas.UpdateNote
Used as field type in: , , , ,
string name = 1
Output only. The name of the note in the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`.
string short_description = 2
A one sentence description of this note.
string long_description = 3
A detailed description of this note.
NoteKind kind = 4
Output only. The type of analysis. This field can be used as a filter in list requests.
repeated related_url = 5
URLs associated with this note.
optional expiration_time = 6
Time of expiration for this note. Empty if note does not expire.
optional create_time = 7
Output only. The time this note was created. This field can be used as a filter in list requests.
optional update_time = 8
Output only. The time this note was last updated. This field can be used as a filter in list requests.
repeated string related_note_names = 9
Other notes related to this note.
oneof type
Required. Immutable. The type of analysis this note represents.
vulnerability = 10
A note describing a package vulnerability.
build = 11
A note describing build provenance for a verifiable build.
image = 12
A note describing a base image.
package = 13
A note describing a package hosted by various package managers.
deployment = 14
A note describing something that can be deployed.
discovery = 15
A note describing the initial analysis of a resource.
attestation = 16
A note describing an attestation role.
upgrade = 17
A note describing available package upgrades.
compliance = 18
A note describing a compliance check.
dsse_attestation = 19
A note describing a dsse attestation note.
vulnerability_assessment = 20
A note describing a vulnerability assessment.
sbom_reference = 21
A note describing an SBOM reference.
secret = 22
A note describing a secret.
Kind represents the kinds of notes supported.
Used in: , ,
NOTE_KIND_UNSPECIFIED = 0
Default value. This value is unused.
VULNERABILITY = 1
The note and occurrence represent a package vulnerability.
BUILD = 2
The note and occurrence assert build provenance.
IMAGE = 3
This represents an image basis relationship.
PACKAGE = 4
This represents a package installed via a package manager.
DEPLOYMENT = 5
The note and occurrence track deployment events.
DISCOVERY = 6
The note and occurrence track the initial discovery status of a resource.
ATTESTATION = 7
This represents a logical "role" that can attest to artifacts.
UPGRADE = 8
This represents an available package upgrade.
COMPLIANCE = 9
This represents a Compliance Note
DSSE_ATTESTATION = 10
This represents a DSSE attestation Note
VULNERABILITY_ASSESSMENT = 11
This represents a Vulnerability Assessment.
SBOM_REFERENCE = 12
This represents an SBOM Reference.
SECRET = 13
This represents a secret.
message
grafeas.proto:241An instance of an analysis type that has been found on a resource.
Used as response type in: Grafeas.CreateOccurrence, Grafeas.GetOccurrence, Grafeas.UpdateOccurrence
Used as field type in: , , , , ,
string name = 1
Output only. The name of the occurrence in the form of `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`.
string resource_uri = 2
Required. Immutable. A URI that represents the resource for which the occurrence applies. For example, `https://gcr.io/project/image@sha256:123abc` for a Docker image.
string note_name = 3
Required. Immutable. The analysis note associated with this occurrence, in the form of `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. This field can be used as a filter in list requests.
NoteKind kind = 4
Output only. This explicitly denotes which of the occurrence details are specified. This field can be used as a filter in list requests.
string remediation = 5
A description of actions that can be taken to remedy the note.
optional create_time = 6
Output only. The time this occurrence was created.
optional update_time = 7
Output only. The time this occurrence was last updated.
oneof details
Required. Immutable. Describes the details of the note kind found on this resource.
vulnerability = 8
Describes a security vulnerability.
build = 9
Describes a verifiable build.
image = 10
Describes how this resource derives from the basis in the associated note.
package = 11
Describes the installation of a package on the linked resource.
deployment = 12
Describes the deployment of an artifact on a runtime.
discovery = 13
Describes when a resource was discovered.
attestation = 14
Describes an attestation of an artifact.
upgrade = 15
Describes an available package upgrade on the linked resource.
compliance = 16
Describes a compliance violation on a linked resource.
dsse_attestation = 17
Describes an attestation of an artifact using dsse.
sbom_reference = 19
Describes a specific SBOM reference occurrences.
secret = 20
Describes a secret.
optional envelope = 18
https://github.com/secure-systems-lab/dsse
message
package.proto:77PackageNote represents a particular package version.
Used in:
string name = 1
The name of the package.
repeated distribution = 10
Deprecated. The various channels by which a package is distributed.
string package_type = 11
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
string cpe_uri = 12
The cpe_uri in [CPE format](https://cpe.mitre.org/specification/) denoting the package manager version distributing a package. The cpe_uri will be blank for language packages.
Architecture architecture = 13
The CPU architecture for which packages in this distribution channel were built. Architecture will be blank for language packages.
optional version = 14
The version of the package.
string maintainer = 15
A freeform text denoting the maintainer of this package.
string url = 16
The homepage for this package.
string description = 17
The description of this package.
optional license = 18
Licenses that have been declared by the authors of the package.
repeated digest = 19
Hash value, typically a file digest, that allows unique identification a specific package.
message
package.proto:122Details on how a particular software package was installed on a system.
Used in:
string name = 1
The name of the installed package.
repeated location = 2
All of the places within the filesystem versions of this package have been found.
string package_type = 3
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
string cpe_uri = 4
The cpe_uri in [CPE format](https://cpe.mitre.org/specification/) denoting the package manager version distributing a package. The cpe_uri will be blank for language packages.
Architecture architecture = 5
The CPU architecture for which packages in this distribution channel were built. Architecture will be blank for language packages.
optional license = 6
Licenses that have been declared by the authors of the package.
optional version = 7
The version of the package.
message
provenance.proto:259Selects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.
Used in:
string project_id = 1
The ID of the project.
string repo_name = 2
The name of the repo. Leave empty for the default repo.
message
intoto_provenance.proto:34Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.
Used in:
string type = 1
URI indicating what type of recipe was performed. It determines the meaning of recipe.entryPoint, recipe.arguments, recipe.environment, and materials.
int64 defined_in_material = 2
Index in materials containing the recipe steps that are not implied by recipe.type. For example, if the recipe type were "make", then this would point to the source containing the Makefile, not the make program itself. Set to -1 if the recipe doesn't come from a material, as zero is default unset value for int64.
string entry_point = 3
String identifying the entry point into the build. This is often a path to a configuration file and/or a target label within that file. The syntax and meaning are defined by recipe.type. For example, if the recipe type were "make", then this would reference the directory in which to run make as well as which target to use.
repeated arguments = 4
Collection of all external inputs that influenced the build on top of recipe.definedInMaterial and recipe.entryPoint. For example, if the recipe type were "make", then this might be the flags passed to make aside from the target, which is captured in recipe.entryPoint. Since the arguments field can greatly vary in structure, depending on the builder and recipe type, this is of form "Any".
repeated environment = 5
Any other builder-controlled inputs necessary for correctly evaluating the recipe. Usually only needed for reproducing the build but not evaluated as part of policy. Since the environment field can greatly vary in structure, depending on the builder and recipe type, this is of form "Any".
message
common.proto:57Metadata for any related URL information.
Used in: , , , ,
string url = 1
Specific URL associated with the resource.
string label = 2
Label to describe usage of the URL.
message
provenance.proto:245A unique identifier for a Cloud Repo.
Used in:
oneof id
A cloud repo can be identified by either its project ID and repository name combination, or its globally unique identifier.
project_repo_id = 1
A combination of a project ID and a repo name.
string uid = 2
A server-assigned, globally unique identifier.
message
sbom.proto:28The note representing an SBOM reference.
Used in:
string format = 1
The format that SBOM takes. E.g. may be spdx, cyclonedx, etc...
string version = 2
The version of the format that the SBOM takes. E.g. if the format is spdx, the version may be 2.3.
message
sbom.proto:40The occurrence representing an SBOM reference as applied to a specific resource. The occurrence follows the DSSE specification. See https://github.com/secure-systems-lab/dsse/blob/master/envelope.md for more details.
Used in:
optional payload = 1
The actual payload that contains the SBOM reference data.
string payload_type = 2
The kind of payload that SbomReferenceIntotoPayload takes. Since it's in the intoto format, this value is expected to be 'application/vnd.in-toto+json'.
repeated signatures = 3
The signatures over the payload.
message
sbom.proto:55The actual payload that contains the SBOM Reference data. The payload follows the intoto statement specification. See https://github.com/in-toto/attestation/blob/main/spec/v1.0/statement.md for more details.
Used in:
string type = 1
Identifier for the schema of the Statement.
string predicate_type = 2
URI identifying the type of the Predicate.
repeated subject = 3
Set of software artifacts that the attestation applies to. Each element represents a single software artifact.
optional predicate = 4
Additional parameters of the Predicate. Includes the actual data about the SBOM.
message
sbom.proto:69A predicate which describes the SBOM being referenced.
Used in:
string referrer_id = 1
The person or system referring this predicate to the consumer.
string location = 2
The location of the SBOM.
string mime_type = 3
The mime type of the SBOM.
map<string, string> digest = 4
A map of algorithm to digest of the contents of the SBOM.
Kind of secret.
Used in:
SECRET_KIND_UNSPECIFIED = 0
Unspecified
SECRET_KIND_UNKNOWN = 1
The secret kind is unknown.
SECRET_KIND_GCP_SERVICE_ACCOUNT_KEY = 2
A GCP service account key per: https://cloud.google.com/iam/docs/creating-managing-service-account-keys
message
secret.proto:45The location of the secret.
Used in:
oneof location
The detailed location of the secret.
file_location = 1
The secret is found from a file.
message
secret.proto:29The note representing a secret.
Used in:
(message has no fields)
message
secret.proto:32The occurrence provides details of a secret.
Used in:
SecretKind kind = 1
Type of secret.
repeated locations = 2
Locations where the secret is detected.
repeated statuses = 3
Status of the secret.
message
secret.proto:54The status of the secret with a timestamp.
Used in:
SecretStatus.Status status = 1
The status of the secret.
optional update_time = 2
The time the secret status was last updated.
string message = 3
Optional message about the status code.
The status of the secret.
Used in:
STATUS_UNSPECIFIED = 0
Unspecified
UNKNOWN = 1
The status of the secret is unknown.
VALID = 2
The secret is valid.
INVALID = 3
The secret is invalid.
Note provider assigned severity/impact ranking.
Used in: , , , ,
SEVERITY_UNSPECIFIED = 0
Unknown.
MINIMAL = 1
Minimal severity.
LOW = 2
Low severity.
MEDIUM = 3
Medium severity.
HIGH = 4
High severity.
CRITICAL = 5
Critical severity.
message
common.proto:86Verifiers (e.g. Kritis implementations) MUST verify signatures with respect to the trust anchors defined in policy (e.g. a Kritis policy). Typically this means that the verifier has been configured with a map from `public_key_id` to public key material (and any required parameters, e.g. signing algorithm). In particular, verification implementations MUST NOT treat the signature `public_key_id` as anything more than a key lookup hint. The `public_key_id` DOES NOT validate or authenticate a public key; it only provides a mechanism for quickly selecting a public key ALREADY CONFIGURED on the verifier through a trusted channel. Verification implementations MUST reject signatures in any of the following circumstances: * The `public_key_id` is not recognized by the verifier. * The public key that `public_key_id` refers to does not verify the signature with respect to the payload. The `signature` contents SHOULD NOT be "attached" (where the payload is included with the serialized `signature` bytes). Verifiers MUST ignore any "attached" payload and only verify signatures with respect to explicitly provided payload (e.g. a `payload` field on the proto message that holds this Signature, or the canonical serialization of the proto message that holds this signature).
Used in:
bytes signature = 1
The content of the signature, an opaque bytestring. The payload that this signature verifies MUST be unambiguously provided with the Signature during verification. A wrapper message might provide the payload explicitly. Alternatively, a message might have a canonical serialization that can always be unambiguously computed to derive the payload.
string public_key_id = 2
The identifier for the public key that verifies this signature. * The `public_key_id` is required. * The `public_key_id` SHOULD be an RFC3986 conformant URI. * When possible, the `public_key_id` SHOULD be an immutable reference, such as a cryptographic digest. Examples of valid `public_key_id`s: OpenPGP V4 public key fingerprint: * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA" See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more details on this scheme. RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER serialization): * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU" * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
message
slsa_provenance.proto:28Used in:
optional builder = 1
required
optional recipe = 2
Identifies the configuration used for the build. When combined with materials, this SHOULD fully describe the build, such that re-running this recipe results in bit-for-bit identical output (if the build is reproducible).
required
optional metadata = 3
repeated materials = 4
The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on. This is considered to be incomplete unless metadata.completeness.materials is true. Unset or null is equivalent to empty.
message
slsa_provenance.proto:98Used in:
string uri = 1
map<string, string> digest = 2
message
slsa_provenance.proto:94Used in:
string id = 1
message
slsa_provenance.proto:64Indicates that the builder claims certain fields in this message to be complete.
Used in:
bool arguments = 1
If true, the builder claims that recipe.arguments is complete, meaning that all external inputs are properly captured in the recipe.
bool environment = 2
If true, the builder claims that recipe.environment is claimed to be complete.
bool materials = 3
If true, the builder claims that materials are complete, usually through some controls to prevent network access. Sometimes called "hermetic".
message
slsa_provenance.proto:77Other properties of the build.
Used in:
string build_invocation_id = 1
Identifies the particular build invocation, which can be useful for finding associated logs or other ad-hoc analysis. The value SHOULD be globally unique, per in-toto Provenance spec.
optional build_started_on = 2
The timestamp of when the build started.
optional build_finished_on = 3
The timestamp of when the build completed.
optional completeness = 4
Indicates that the builder claims certain fields in this message to be complete.
bool reproducible = 5
If true, the builder claims that running the recipe on materials will produce bit-for-bit identical output.
message
slsa_provenance.proto:32Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.
Used in:
string type = 1
URI indicating what type of recipe was performed. It determines the meaning of recipe.entryPoint, recipe.arguments, recipe.environment, and materials.
int64 defined_in_material = 2
Index in materials containing the recipe steps that are not implied by recipe.type. For example, if the recipe type were "make", then this would point to the source containing the Makefile, not the make program itself. Set to -1 if the recipe doesn't come from a material, as zero is default unset value for int64.
string entry_point = 3
String identifying the entry point into the build. This is often a path to a configuration file and/or a target label within that file. The syntax and meaning are defined by recipe.type. For example, if the recipe type were "make", then this would reference the directory in which to run make as well as which target to use.
optional arguments = 4
Collection of all external inputs that influenced the build on top of recipe.definedInMaterial and recipe.entryPoint. For example, if the recipe type were "make", then this might be the flags passed to make aside from the target, which is captured in recipe.entryPoint. Depending on the recipe Type, the structure may be different.
optional environment = 5
Any other builder-controlled inputs necessary for correctly evaluating the recipe. Usually only needed for reproducing the build but not evaluated as part of policy. Depending on the recipe Type, the structure may be different.
See full explanation of fields at slsa.dev/provenance/v0.2.
Used in:
optional builder = 1
string build_type = 2
optional invocation = 3
optional build_config = 4
optional metadata = 5
repeated materials = 6
Identifies the entity that executed the recipe, which is trusted to have correctly performed the operation and populated this provenance.
Used in:
string id = 1
Indicates that the builder claims certain fields in this message to be complete.
Used in:
bool parameters = 1
bool environment = 2
bool materials = 3
Describes where the config file that kicked off the build came from. This is effectively a pointer to the source where buildConfig came from.
Used in:
string uri = 1
map<string, string> digest = 2
string entry_point = 3
Identifies the event that kicked off the build.
Used in:
optional config_source = 1
optional parameters = 2
optional environment = 3
The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on.
Used in:
string uri = 1
map<string, string> digest = 2
Other properties of the build.
Used in:
string build_invocation_id = 1
optional build_started_on = 2
optional build_finished_on = 3
optional completeness = 4
bool reproducible = 5
message
provenance.proto:73Source describes the location of the source used for the build.
Used in:
string artifact_storage_source_uri = 1
If provided, the input binary artifacts for the build came from this location.
map<string, > file_hashes = 2
Hash(es) of the build source, which can be used to verify that the original source integrity was maintained in the build. The keys to this map are file paths used as build source and the values contain the hash values for those files. If the build source came in a single package such as a gzipped tarfile (.tar.gz), the FileHash will be for the single path to that file.
optional context = 3
If provided, the source code used for the build came from this location.
repeated additional_contexts = 4
If provided, some of the source code used for the build may be found in these locations, in the case where the source repository had multiple remotes or submodules. This list will not include the context specified in the context field.
message
provenance.proto:157A SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.
Used in:
oneof context
A SourceContext can refer any one of the following types of repositories.
cloud_repo = 1
A SourceContext referring to a revision in a Google Cloud Source Repo.
gerrit = 2
A SourceContext referring to a Gerrit project.
git = 3
A SourceContext referring to any third party Git repo (e.g., GitHub).
map<string, string> labels = 4
Labels with user defined metadata.
message
intoto_statement.proto:47Used in: , ,
string name = 1
map<string, string> digest = 2
`"<ALGORITHM>": "<HEX_VALUE>"` Algorithms can be e.g. sha256, sha512 See https://github.com/in-toto/attestation/blob/main/spec/field_types.md#DigestSet
message
upgrade.proto:46The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities.
Used in: ,
string cpe_uri = 1
Required - The specific operating system this metadata applies to. See https://cpe.mitre.org/specification/.
string classification = 2
The operating system classification of this Upgrade, as specified by the upstream operating system upgrade feed. For Windows the classification is one of the category_ids listed at https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ff357803(v=vs.85)
string severity = 3
The severity as specified by the upstream operating system.
repeated string cve = 4
The cve tied to this Upgrade.
message
upgrade.proto:31An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be an Upgrade Note. For Windows, windows_update field represents the information related to the update.
Used in:
string package = 1
Required for non-Windows OS. The package this Upgrade is for.
optional version = 2
Required for non-Windows OS. The version of the package in machine + human readable form.
repeated distributions = 3
Metadata about the upgrade for each specific operating system.
optional windows_update = 4
Required for Windows OS. Represents the metadata about the Windows update.
message
upgrade.proto:102An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). For Windows, both distribution and windows_update contain information for the Windows update.
Used in:
string package = 1
Required for non-Windows OS. The package this Upgrade is for.
optional parsed_version = 3
Required for non-Windows OS. The version of the package in a machine + human readable form.
optional distribution = 4
Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
optional windows_update = 5
Required for Windows OS. Represents the metadata about the Windows update.
message
package.proto:154Version contains structured information about the version of a package.
Used in: , , , , , , ,
int32 epoch = 1
Used to correct mistakes in the version numbering scheme.
string name = 2
Required only when version kind is NORMAL. The main part of the version name.
string revision = 3
The iteration of the package build from the above version.
bool inclusive = 6
Whether this version is specifying part of an inclusive range. Grafeas does not have the capability to specify version ranges; instead we have fields that specify start version and end versions. At times this is insufficient - we also need to specify whether the version is included in the range or is excluded from the range. This boolean is expected to be set to true when the version is included in a range.
Version.VersionKind kind = 4
Required. Distinguishes between sentinel MIN/MAX versions and normal versions.
string full_name = 5
Human readable version string. This string is of the form <epoch>:<name>-<revision> and is only set when kind is NORMAL.
Whether this is an ordinary package version or a sentinel MIN/MAX version.
Used in:
VERSION_KIND_UNSPECIFIED = 0
Unknown.
NORMAL = 1
A standard package version.
MINIMUM = 2
A special version representing negative infinity.
MAXIMUM = 3
A special version representing positive infinity.
message
vex.proto:28A single VulnerabilityAssessmentNote represents one particular product's vulnerability assessment for one CVE.
Used in:
string title = 1
The title of the note. E.g. `Vex-Debian-11.4`
string short_description = 2
A one sentence description of this Vex.
string long_description = 3
A detailed description of this Vex.
string language_code = 4
Identifies the language used by this document, corresponding to IETF BCP 47 / RFC 5646.
optional publisher = 5
Publisher details of this Note.
optional product = 6
The product affected by this vex.
optional assessment = 7
Represents a vulnerability assessment for the product.
message
vex.proto:91Assessment provides all information that is related to a single vulnerability for this product.
Used in:
string cve = 1
Holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability. Deprecated: Use vulnerability_id instead to denote CVEs.
string vulnerability_id = 9
The vulnerability identifier for this Assessment. Will hold one of common identifiers e.g. CVE, GHSA etc.
string short_description = 2
A one sentence description of this Vex.
string long_description = 3
A detailed description of this Vex.
repeated related_uris = 4
Holds a list of references associated with this vulnerability item and assessment. These uris have additional information about the vulnerability and the assessment itself. E.g. Link to a document which details how this assessment concluded the state of this vulnerability.
Assessment.State state = 5
Provides the state of this Vulnerability assessment.
repeated string impacts = 6
Contains information about the impact of this vulnerability, this will change with time.
optional justification = 7
Justification provides the justification when the state of the assessment if NOT_AFFECTED.
repeated remediations = 8
Specifies details on how to handle (and presumably, fix) a vulnerability.
message
vex.proto:137Justification provides the justification when the state of the assessment if NOT_AFFECTED.
Used in: ,
Justification.JustificationType justification_type = 1
The justification type for this vulnerability.
string details = 2
Additional details on why this justification was chosen.
Provides the type of justification.
Used in:
JUSTIFICATION_TYPE_UNSPECIFIED = 0
JUSTIFICATION_TYPE_UNSPECIFIED.
COMPONENT_NOT_PRESENT = 1
The vulnerable component is not present in the product.
VULNERABLE_CODE_NOT_PRESENT = 2
The vulnerable code is not present. Typically this case occurs when source code is configured or built in a way that excludes the vulnerable code.
VULNERABLE_CODE_NOT_IN_EXECUTE_PATH = 3
The vulnerable code can not be executed. Typically this case occurs when the product includes the vulnerable code but does not call or use the vulnerable code.
VULNERABLE_CODE_CANNOT_BE_CONTROLLED_BY_ADVERSARY = 4
The vulnerable code cannot be controlled by an attacker to exploit the vulnerability.
INLINE_MITIGATIONS_ALREADY_EXIST = 5
The product includes built-in protections or features that prevent exploitation of the vulnerability. These built-in protections cannot be subverted by the attacker and cannot be configured or disabled by the user. These mitigations completely prevent exploitation based on known attack vectors.
message
vex.proto:175Specifies details on how to handle (and presumably, fix) a vulnerability.
Used in: ,
Remediation.RemediationType remediation_type = 1
The type of remediation that can be applied.
string details = 2
Contains a comprehensive human-readable discussion of the remediation.
optional remediation_uri = 3
Contains the URL where to obtain the remediation.
The type of remediation that can be applied.
Used in:
REMEDIATION_TYPE_UNSPECIFIED = 0
No remediation type specified.
MITIGATION = 1
A MITIGATION is available.
NO_FIX_PLANNED = 2
No fix is planned.
NONE_AVAILABLE = 3
Not available.
VENDOR_FIX = 4
A vendor fix is available.
WORKAROUND = 5
A workaround is available.
Provides the state of this Vulnerability assessment.
Used in: ,
STATE_UNSPECIFIED = 0
No state is specified.
AFFECTED = 1
This product is known to be affected by this vulnerability.
NOT_AFFECTED = 2
This product is known to be not affected by this vulnerability.
FIXED = 3
This product contains a fix for this vulnerability.
UNDER_INVESTIGATION = 4
It is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation.
message
vex.proto:70Product contains information about a product and how to uniquely identify it. (-- api-linter: core::0123::resource-annotation=disabled aip.dev/not-precedent: Product is not a separate resource. --)
Used in:
string name = 1
Name of the product.
string id = 2
Token that identifies a product so that it can be referred to from other parts in the document. There is no predefined format as long as it uniquely identifies a group in the context of the current document.
oneof identifier
string generic_uri = 3
Contains a URI which is vendor-specific. Example: The artifact repository URL of an image.
message
vex.proto:46Publisher contains information about the publisher of this Note. (-- api-linter: core::0123::resource-annotation=disabled aip.dev/not-precedent: Publisher is not a separate resource. --)
Used in:
string name = 1
Name of the publisher. Examples: 'Google', 'Google Cloud Platform'.
string issuing_authority = 2
Provides information about the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
string publisher_namespace = 3
The context or namespace. Contains a URL which is under control of the issuing party and can be used as a globally unique identifier for that issuing party. Example: https://csaf.io
message
vulnerability.proto:33A security vulnerability that can be found in resources.
Used in:
float cvss_score = 1
The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.
Severity severity = 2
The note provider assigned severity of this vulnerability.
repeated details = 3
Details of all known distros and packages affected by this vulnerability.
optional cvss_v3 = 4
The full description of the CVSSv3 for this vulnerability.
repeated windows_details = 5
Windows details get their own format because the information format and model don't match a normal detail. Specifically Windows updates are done as patches, thus Windows vulnerabilities really are a missing package, rather than a package being at an incorrect version.
optional source_update_time = 6
The time this information was last changed at the source. This is an upstream timestamp from the underlying information source - e.g. Ubuntu security tracker.
CVSSVersion cvss_version = 7
CVSS version used to populate cvss_score and severity.
optional cvss_v2 = 8
The full description of the v2 CVSS for this vulnerability.
message
vulnerability.proto:46A detail for a distro and package affected by this vulnerability and its associated fix (if one is available).
Used in:
string severity_name = 1
The distro assigned severity of this vulnerability.
string description = 2
A vendor-specific description of this vulnerability.
string package_type = 3
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
string affected_cpe_uri = 4
Required. The [CPE URI](https://cpe.mitre.org/specification/) this vulnerability affects.
string affected_package = 5
Required. The package this vulnerability affects.
optional affected_version_start = 6
The version number at the start of an interval in which this vulnerability exists. A vulnerability can affect a package between version numbers that are disjoint sets of intervals (example: [1.0.0-1.1.0], [2.4.6-2.4.8] and [4.5.6-4.6.8]) each of which will be represented in its own Detail. If a specific affected version is provided by a vulnerability database, affected_version_start and affected_version_end will be the same in that Detail.
optional affected_version_end = 7
The version number at the end of an interval in which this vulnerability exists. A vulnerability can affect a package between version numbers that are disjoint sets of intervals (example: [1.0.0-1.1.0], [2.4.6-2.4.8] and [4.5.6-4.6.8]) each of which will be represented in its own Detail. If a specific affected version is provided by a vulnerability database, affected_version_start and affected_version_end will be the same in that Detail.
string fixed_cpe_uri = 8
The distro recommended [CPE URI](https://cpe.mitre.org/specification/) to update to that contains a fix for this vulnerability. It is possible for this to be different from the affected_cpe_uri.
string fixed_package = 9
The distro recommended package to update to that contains a fix for this vulnerability. It is possible for this to be different from the affected_package.
optional fixed_version = 10
The distro recommended version to update to that contains a fix for this vulnerability. Setting this to VersionKind.MAXIMUM means no such version is yet available.
bool is_obsolete = 11
Whether this detail is obsolete. Occurrences are expected not to point to obsolete details.
optional source_update_time = 12
The time this information was last changed at the source. This is an upstream timestamp from the underlying information source - e.g. Ubuntu security tracker.
string source = 13
The source from which the information in this Detail was obtained.
string vendor = 14
The name of the vendor of the product.
message
vulnerability.proto:122Used in:
string cpe_uri = 1
Required. The [CPE URI](https://cpe.mitre.org/specification/) this vulnerability affects.
string name = 2
Required. The name of this vulnerability.
string description = 3
The description of this vulnerability.
repeated fixing_kbs = 4
Required. The names of the KBs which have hotfixes to mitigate this vulnerability. Note that there may be multiple hotfixes (and thus multiple KBs) that mitigate a given vulnerability. Currently any listed KBs presence is considered a fix.
message
vulnerability.proto:139Used in:
string name = 1
The KB name (generally of the form KB[0-9]+ (e.g., KB123456)).
string url = 2
A link to the KB in the [Windows update catalog] (https://www.catalog.update.microsoft.com/).
message
vulnerability.proto:163An occurrence of a severity vulnerability on a resource.
Used in:
string type = 1
The type of package; whether native or non native (e.g., ruby gems, node.js packages, etc.).
Severity severity = 2
Output only. The note provider assigned severity of this vulnerability.
float cvss_score = 3
Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.
optional cvssv3 = 10
The cvss v3 score for the vulnerability.
repeated package_issue = 4
Required. The set of affected locations and their fixes (if available) within the associated resource.
string short_description = 5
Output only. A one sentence description of this vulnerability.
string long_description = 6
Output only. A detailed description of this vulnerability.
repeated related_urls = 7
Output only. URLs related to this vulnerability.
Severity effective_severity = 8
The distro assigned severity for this vulnerability when it is available, otherwise this is the note provider assigned severity. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
bool fix_available = 9
Output only. Whether at least one of the affected packages has a fix available.
CVSSVersion cvss_version = 11
Output only. CVSS version used to populate cvss_score and severity.
optional cvss_v2 = 12
The cvss v2 score for the vulnerability.
optional vex_assessment = 13
string extra_details = 14
Occurrence-specific extra details about the vulnerability.
message
vulnerability.proto:185A detail for a distro and package this vulnerability occurrence was found in and its associated fix (if one is available).
Used in:
string affected_cpe_uri = 1
Required. The [CPE URI](https://cpe.mitre.org/specification/) this vulnerability was found in.
string affected_package = 2
Required. The package this vulnerability was found in.
optional affected_version = 3
Required. The version of the package that is installed on the resource affected by this vulnerability.
string fixed_cpe_uri = 4
The [CPE URI](https://cpe.mitre.org/specification/) this vulnerability was fixed in. It is possible for this to be different from the affected_cpe_uri.
string fixed_package = 5
The package this vulnerability was fixed in. It is possible for this to be different from the affected_package.
optional fixed_version = 6
Required. The version of the package this vulnerability was fixed in. Setting this to VersionKind.MAXIMUM means no fix is yet available.
bool fix_available = 7
Output only. Whether a fix is available for this package.
string package_type = 8
The type of package (e.g. OS, MAVEN, GO).
Severity effective_severity = 9
The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
repeated file_location = 10
The location at which this package was found.
message
vulnerability.proto:259VexAssessment provides all publisher provided Vex information that is related to this vulnerability.
Used in:
string cve = 1
Holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability. Deprecated: Use vulnerability_id instead to denote CVEs.
string vulnerability_id = 8
The vulnerability identifier for this Assessment. Will hold one of common identifiers e.g. CVE, GHSA etc.
repeated related_uris = 2
Holds a list of references associated with this vulnerability item and assessment.
string note_name = 3
The VulnerabilityAssessment note from which this VexAssessment was generated. This will be of the form: `projects/[PROJECT_ID]/notes/[NOTE_ID]`. (-- api-linter: core::0122::name-suffix=disabled aip.dev/not-precedent: The suffix is kept for consistency. --)
VulnerabilityAssessmentNote.Assessment.State state = 4
Provides the state of this Vulnerability assessment.
repeated string impacts = 5
Contains information about the impact of this vulnerability, this will change with time.
repeated remediations = 6
Specifies details on how to handle (and presumably, fix) a vulnerability.
optional justification = 7
Justification provides the justification when the state of the assessment if NOT_AFFECTED.
message
upgrade.proto:65Windows Update represents the metadata about the update for the Windows operating system. The fields in this message come from the Windows Update API documented at https://docs.microsoft.com/en-us/windows/win32/api/wuapi/nn-wuapi-iupdate.
Used in: ,
optional identity = 1
Required - The unique identifier for the update.
string title = 2
The localized title of the update.
string description = 3
The localized description of the update.
repeated categories = 4
The list of categories to which the update belongs.
repeated string kb_article_ids = 5
The Microsoft Knowledge Base article IDs that are associated with the update.
string support_url = 6
The hyperlink to the support information for the update.
optional last_published_timestamp = 7
The last published timestamp of the update.
message
upgrade.proto:80The category to which the update belongs.
Used in:
string category_id = 1
The identifier of the category.
string name = 2
The localized name of the category.
message
upgrade.proto:67The unique identifier of the update.
Used in:
string update_id = 1
The revision independent identifier of the update.
int32 revision = 2
The revision number of the update.