Grafeas v1 API - Namespace Grafeas.V1 (3.6.0)

Classes

AliasContext.Types

Container for nested types declared in the AliasContext message type.

Note kind that represents a logical attestation "role" or "authority". For example, an organization might have one Authority for "QA" and one for "build". This note is intended to act strictly as a grouping mechanism for the attached occurrences (Attestations). This grouping mechanism also provides a security boundary, since IAM ACLs gate the ability for a principle to attach an occurrence to a given note. It also provides a single point of lookup to find all attached attestation occurrences, even if they don't all live in the same project.

AttestationNote.Types

Container for nested types declared in the AttestationNote message type.

AttestationNote.Types.Hint

This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from "readable" names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.

AttestationOccurrence

Occurrence that represents a single "attestation". The authenticity of an attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the authority to which this attestation is attached is primarily useful for lookup (how to find this attestation if you already know the authority and artifact to be verified) and intent (for which authority this attestation was intended to sign.

BatchCreateNotesRequest

Request to create notes in batch.

BatchCreateNotesResponse

Response for creating notes in batch.

BatchCreateOccurrencesRequest

Request to create occurrences in batch.

BatchCreateOccurrencesResponse

Response for creating occurrences in batch.

BuildNote

Note holding the version of the provider's builder and the signature of the provenance message in the build details occurrence.

BuildOccurrence

Details of a build occurrence.

BuildProvenance

Provenance of a build. Contains all information needed to verify the full details about the build from source to completion.

BuilderConfig

CVSS

Common Vulnerability Scoring System. For details, see https://www.first.org/cvss/specification-document This is a message we will try to use for storing various versions of CVSS rather than making a separate proto for storing a specific version.

CVSS.Types

Container for nested types declared in the CVSS message type.

CVSSv3

Common Vulnerability Scoring System version 3. For details, see https://www.first.org/cvss/specification-document

CVSSv3.Types

Container for nested types declared in the CVSSv3 message type.

CloudRepoSourceContext

A CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.

Command

Command describes a step performed as part of the build pipeline.

Completeness

Indicates that the builder claims certain fields in this message to be complete.

ComplianceNote

ComplianceNote.Types

Container for nested types declared in the ComplianceNote message type.

ComplianceNote.Types.CisBenchmark

A compliance check that is a CIS benchmark.

ComplianceOccurrence

An indication that the compliance checks in the associated ComplianceNote were not satisfied for particular resources or a specified reason.

ComplianceVersion

Describes the CIS benchmark version that is applicable to a given OS and os version.

CreateNoteRequest

Request to create a new note.

CreateOccurrenceRequest

Request to create a new occurrence.

DSSEAttestationNote

DSSEAttestationNote.Types

Container for nested types declared in the DSSEAttestationNote message type.

DSSEAttestationNote.Types.DSSEHint

DSSEAttestationOccurrence

Deprecated. Prefer to use a regular Occurrence, and populate the Envelope at the top level of the Occurrence.

DeleteNoteRequest

Request to delete a note.

DeleteOccurrenceRequest

Request to delete an occurrence.

DeploymentNote

An artifact that can be deployed in some runtime.

DeploymentOccurrence

The period during which some deployable was active in a runtime.

DeploymentOccurrence.Types

Container for nested types declared in the DeploymentOccurrence message type.

Digest

Digest information.

DiscoveryNote

A note that indicates a type of analysis a provider would perform. This note exists in a provider's project. A Discovery occurrence is created in a consumer's project at the start of analysis.

DiscoveryOccurrence

Provides information about the analysis status of a discovered resource.

DiscoveryOccurrence.Types

Container for nested types declared in the DiscoveryOccurrence message type.

DiscoveryOccurrence.Types.AnalysisCompleted

Indicates which analysis completed successfully. Multiple types of analysis can be performed on a single resource.

DiscoveryOccurrence.Types.SBOMStatus

The status of an SBOM generation.

DiscoveryOccurrence.Types.SBOMStatus.Types

Container for nested types declared in the SBOMStatus message type.

Distribution

This represents a particular channel of distribution for a given package. E.g., Debian's jessie-backports dpkg mirror.

Envelope

MUST match https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An authenticated message of arbitrary type.

EnvelopeSignature

FileHashes

Container message for hashes of byte content of files, used in source messages to verify integrity of source input to the build.

FileLocation

Indicates the location at which a package was found.

Fingerprint

A set of properties that uniquely identify a given Docker image.

GerritSourceContext

A SourceContext referring to a Gerrit project.

GetNoteRequest

Request to get a note.

GetOccurrenceNoteRequest

Request to get the note to which the specified occurrence is attached.

GetOccurrenceRequest

Request to get an occurrence.

GitSourceContext

A GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).

Grafeas

Grafeas API.

Retrieves analysis results of Cloud components such as Docker container images.

Analysis results are stored as a series of occurrences. An Occurrence contains information about a specific analysis instance on a resource. An occurrence refers to a Note. A note contains details describing the analysis and is generally stored in a separate project, called a Provider. Multiple occurrences can refer to the same note.

For example, an SSL vulnerability could affect multiple images. In this case, there would be one note for the vulnerability and an occurrence for each image with the vulnerability referring to that note.

Grafeas.GrafeasBase

Base class for server-side implementations of Grafeas

Grafeas.GrafeasClient

Client for Grafeas

GrafeasClient

Grafeas client wrapper, for convenient use.

GrafeasClientBuilder

Builder class for GrafeasClient to provide simple configuration of credentials, endpoint etc.

GrafeasClientImpl

Grafeas client wrapper implementation, for convenient use.

GrafeasSettings

Settings for GrafeasClient instances.

Hash

Container message for hash values.

ImageNote

Basis describes the base image portion (Note) of the DockerImage relationship. Linked occurrences are derived from this or an equivalent image via: FROM <Basis.resource_url> Or an equivalent reference, e.g., a tag of the resource_url.

ImageOccurrence

Details of the derived image portion of the DockerImage relationship. This image would be produced from a Dockerfile with FROM <DockerImage.Basis in attached Note>.

InTotoProvenance

InTotoSlsaProvenanceV1

InTotoSlsaProvenanceV1.Types

Container for nested types declared in the InTotoSlsaProvenanceV1 message type.

InTotoSlsaProvenanceV1.Types.BuildDefinition

InTotoSlsaProvenanceV1.Types.BuildMetadata

InTotoSlsaProvenanceV1.Types.ProvenanceBuilder

InTotoSlsaProvenanceV1.Types.ResourceDescriptor

InTotoSlsaProvenanceV1.Types.RunDetails

InTotoSlsaProvenanceV1.Types.SlsaProvenanceV1

Keep in sync with schema at https://github.com/slsa-framework/slsa/blob/main/docs/provenance/schema/v1/provenance.proto Builder renamed to ProvenanceBuilder because of Java conflicts.

InTotoStatement

Spec defined at https://github.com/in-toto/attestation/tree/main/spec#statement The serialized InTotoStatement will be stored as Envelope.payload. Envelope.payloadType is always "application/vnd.in-toto+json".

Jwt

Layer

Layer holds metadata specific to a layer of a Docker image.

License

License information.

ListNoteOccurrencesRequest

Request to list occurrences for a note.

ListNoteOccurrencesResponse

Response for listing occurrences for a note.

ListNotesRequest

Request to list notes.

ListNotesResponse

Response for listing notes.

ListOccurrencesRequest

Request to list occurrences.

ListOccurrencesResponse

Response for listing occurrences.

Location

An occurrence of a particular package installation found within a system's filesystem. E.g., glibc was found in /var/lib/dpkg/status.

Metadata

Other properties of the build.

NonCompliantFile

Details about files that caused a compliance check to fail.

Note

A type of analysis that can be done for a resource.

NoteName

Resource name for the Note resource.

Occurrence

An instance of an analysis type that has been found on a resource.

OccurrenceName

Resource name for the Occurrence resource.

PackageNote

PackageNote represents a particular package version.

PackageOccurrence

Details on how a particular software package was installed on a system.

ProjectName

Resource name for the Project resource.

ProjectRepoId

Selects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.

Recipe

Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.

RelatedUrl

Metadata for any related URL information.

RepoId

A unique identifier for a Cloud Repo.

SBOMReferenceNote

The note representing an SBOM reference.

SBOMReferenceOccurrence

The occurrence representing an SBOM reference as applied to a specific resource. The occurrence follows the DSSE specification. See https://github.com/secure-systems-lab/dsse/blob/master/envelope.md for more details.

SbomReferenceIntotoPayload

The actual payload that contains the SBOM Reference data. The payload follows the intoto statement specification. See https://github.com/in-toto/attestation/blob/main/spec/v1.0/statement.md for more details.

SbomReferenceIntotoPredicate

A predicate which describes the SBOM being referenced.

Signature

Verifiers (e.g. Kritis implementations) MUST verify signatures with respect to the trust anchors defined in policy (e.g. a Kritis policy). Typically this means that the verifier has been configured with a map from public_key_id to public key material (and any required parameters, e.g. signing algorithm).

In particular, verification implementations MUST NOT treat the signature public_key_id as anything more than a key lookup hint. The public_key_id DOES NOT validate or authenticate a public key; it only provides a mechanism for quickly selecting a public key ALREADY CONFIGURED on the verifier through a trusted channel. Verification implementations MUST reject signatures in any of the following circumstances:

The public_key_id is not recognized by the verifier.
The public key that public_key_id refers to does not verify the signature with respect to the payload.

The signature contents SHOULD NOT be "attached" (where the payload is included with the serialized signature bytes). Verifiers MUST ignore any "attached" payload and only verify signatures with respect to explicitly provided payload (e.g. a payload field on the proto message that holds this Signature, or the canonical serialization of the proto message that holds this signature).

SlsaProvenance

SlsaProvenance.Types

Container for nested types declared in the SlsaProvenance message type.

SlsaProvenance.Types.Material

SlsaProvenance.Types.SlsaBuilder

SlsaProvenance.Types.SlsaCompleteness

Indicates that the builder claims certain fields in this message to be complete.

SlsaProvenance.Types.SlsaMetadata

Other properties of the build.

SlsaProvenance.Types.SlsaRecipe

Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.

SlsaProvenanceZeroTwo

See full explanation of fields at slsa.dev/provenance/v0.2.

SlsaProvenanceZeroTwo.Types

Container for nested types declared in the SlsaProvenanceZeroTwo message type.

SlsaProvenanceZeroTwo.Types.SlsaBuilder

Identifies the entity that executed the recipe, which is trusted to have correctly performed the operation and populated this provenance.

SlsaProvenanceZeroTwo.Types.SlsaCompleteness

Indicates that the builder claims certain fields in this message to be complete.

SlsaProvenanceZeroTwo.Types.SlsaConfigSource

Describes where the config file that kicked off the build came from. This is effectively a pointer to the source where buildConfig came from.

SlsaProvenanceZeroTwo.Types.SlsaInvocation

Identifies the event that kicked off the build.

SlsaProvenanceZeroTwo.Types.SlsaMaterial

The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on.

SlsaProvenanceZeroTwo.Types.SlsaMetadata

Other properties of the build.

Source

Source describes the location of the source used for the build.

SourceContext

A SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.

Subject

UpdateNoteRequest

Request to update a note.

UpdateOccurrenceRequest

Request to update an occurrence.

UpgradeDistribution

The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities.

UpgradeNote

An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be an Upgrade Note. For Windows, windows_update field represents the information related to the update.

UpgradeOccurrence

An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). For Windows, both distribution and windows_update contain information for the Windows update.