Package io.grafeas.v1 (2.4.3)

A client to Container Analysis API

The interfaces provided are listed below, along with usage samples.

GrafeasClient

Service Description: Grafeas API.

Retrieves analysis results of Cloud components such as Docker container images.

Analysis results are stored as a series of occurrences. An Occurrence contains information about a specific analysis instance on a resource. An occurrence refers to a Note. A note contains details describing the analysis and is generally stored in a separate project, called a Provider. Multiple occurrences can refer to the same note.

For example, an SSL vulnerability could affect multiple images. In this case, there would be one note for the vulnerability and an occurrence for each image with the vulnerability referring to that note.

Sample for GrafeasClient:


 // This snippet has been automatically generated for illustrative purposes only.
 // It may require modifications to work in your environment.
 try (GrafeasClient grafeasClient = GrafeasClient.create()) {
   OccurrenceName name = OccurrenceName.of("[PROJECT]", "[OCCURRENCE]");
   Occurrence response = grafeasClient.getOccurrence(name);
 }

Classes

AliasContext

An alias to a repo revision.

Protobuf type grafeas.v1.AliasContext

AliasContext.Builder

An alias to a repo revision.

Protobuf type grafeas.v1.AliasContext

Artifact

Artifact describes a build product.

Protobuf type grafeas.v1.Artifact

Artifact.Builder

Artifact describes a build product.

Protobuf type grafeas.v1.Artifact

Attestation

AttestationNote

Note kind that represents a logical attestation "role" or "authority". For example, an organization might have one Authority for "QA" and one for "build". This note is intended to act strictly as a grouping mechanism for the attached occurrences (Attestations). This grouping mechanism also provides a security boundary, since IAM ACLs gate the ability for a principle to attach an occurrence to a given note. It also provides a single point of lookup to find all attached attestation occurrences, even if they don't all live in the same project.

Protobuf type grafeas.v1.AttestationNote

AttestationNote.Builder

Protobuf type grafeas.v1.AttestationNote

AttestationNote.Hint

This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from "readable" names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.

Protobuf type grafeas.v1.AttestationNote.Hint

AttestationNote.Hint.Builder

Protobuf type grafeas.v1.AttestationNote.Hint

AttestationOccurrence

Occurrence that represents a single "attestation". The authenticity of an attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the authority to which this attestation is attached is primarily useful for lookup (how to find this attestation if you already know the authority and artifact to be verified) and intent (for which authority this attestation was intended to sign.

Protobuf type grafeas.v1.AttestationOccurrence

AttestationOccurrence.Builder

Protobuf type grafeas.v1.AttestationOccurrence

BatchCreateNotesRequest

Request to create notes in batch.

Protobuf type grafeas.v1.BatchCreateNotesRequest

BatchCreateNotesRequest.Builder

Request to create notes in batch.

Protobuf type grafeas.v1.BatchCreateNotesRequest

BatchCreateNotesResponse

Response for creating notes in batch.

Protobuf type grafeas.v1.BatchCreateNotesResponse

BatchCreateNotesResponse.Builder

Response for creating notes in batch.

Protobuf type grafeas.v1.BatchCreateNotesResponse

BatchCreateOccurrencesRequest

Request to create occurrences in batch.

Protobuf type grafeas.v1.BatchCreateOccurrencesRequest

BatchCreateOccurrencesRequest.Builder

Request to create occurrences in batch.

Protobuf type grafeas.v1.BatchCreateOccurrencesRequest

BatchCreateOccurrencesResponse

Response for creating occurrences in batch.

Protobuf type grafeas.v1.BatchCreateOccurrencesResponse

BatchCreateOccurrencesResponse.Builder

Response for creating occurrences in batch.

Protobuf type grafeas.v1.BatchCreateOccurrencesResponse

Build

BuildNote

Note holding the version of the provider's builder and the signature of the provenance message in the build details occurrence.

Protobuf type grafeas.v1.BuildNote

BuildNote.Builder

Note holding the version of the provider's builder and the signature of the provenance message in the build details occurrence.

Protobuf type grafeas.v1.BuildNote

BuildOccurrence

Details of a build occurrence.

Protobuf type grafeas.v1.BuildOccurrence

BuildOccurrence.Builder

Details of a build occurrence.

Protobuf type grafeas.v1.BuildOccurrence

BuildProvenance

Provenance of a build. Contains all information needed to verify the full details about the build from source to completion.

Protobuf type grafeas.v1.BuildProvenance

BuildProvenance.Builder

Provenance of a build. Contains all information needed to verify the full details about the build from source to completion.

Protobuf type grafeas.v1.BuildProvenance

BuilderConfig

Protobuf type grafeas.v1.BuilderConfig

BuilderConfig.Builder

Protobuf type grafeas.v1.BuilderConfig

CVSS

Common Vulnerability Scoring System. For details, see https://www.first.org/cvss/specification-document This is a message we will try to use for storing various versions of CVSS rather than making a separate proto for storing a specific version.

Protobuf type grafeas.v1.CVSS

CVSS.Builder

Protobuf type grafeas.v1.CVSS

CVSSProto

CVSSv3

Common Vulnerability Scoring System version 3. For details, see https://www.first.org/cvss/specification-document

Protobuf type grafeas.v1.CVSSv3

CVSSv3.Builder

Common Vulnerability Scoring System version 3. For details, see https://www.first.org/cvss/specification-document

Protobuf type grafeas.v1.CVSSv3

CloudRepoSourceContext

A CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.

Protobuf type grafeas.v1.CloudRepoSourceContext

CloudRepoSourceContext.Builder

A CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.

Protobuf type grafeas.v1.CloudRepoSourceContext

Command

Command describes a step performed as part of the build pipeline.

Protobuf type grafeas.v1.Command

Command.Builder

Command describes a step performed as part of the build pipeline.

Protobuf type grafeas.v1.Command

Common

Completeness

Indicates that the builder claims certain fields in this message to be complete.

Protobuf type grafeas.v1.Completeness

Completeness.Builder

Indicates that the builder claims certain fields in this message to be complete.

Protobuf type grafeas.v1.Completeness

Compliance

ComplianceNote

Protobuf type grafeas.v1.ComplianceNote

ComplianceNote.Builder

Protobuf type grafeas.v1.ComplianceNote

ComplianceNote.CisBenchmark

A compliance check that is a CIS benchmark.

Protobuf type grafeas.v1.ComplianceNote.CisBenchmark

ComplianceNote.CisBenchmark.Builder

A compliance check that is a CIS benchmark.

Protobuf type grafeas.v1.ComplianceNote.CisBenchmark

ComplianceOccurrence

An indication that the compliance checks in the associated ComplianceNote were not satisfied for particular resources or a specified reason.

Protobuf type grafeas.v1.ComplianceOccurrence

ComplianceOccurrence.Builder

An indication that the compliance checks in the associated ComplianceNote were not satisfied for particular resources or a specified reason.

Protobuf type grafeas.v1.ComplianceOccurrence

ComplianceVersion

Describes the CIS benchmark version that is applicable to a given OS and os version.

Protobuf type grafeas.v1.ComplianceVersion

ComplianceVersion.Builder

Describes the CIS benchmark version that is applicable to a given OS and os version.

Protobuf type grafeas.v1.ComplianceVersion

CreateNoteRequest

Request to create a new note.

Protobuf type grafeas.v1.CreateNoteRequest

CreateNoteRequest.Builder

Request to create a new note.

Protobuf type grafeas.v1.CreateNoteRequest

CreateOccurrenceRequest

Request to create a new occurrence.

Protobuf type grafeas.v1.CreateOccurrenceRequest

CreateOccurrenceRequest.Builder

Request to create a new occurrence.

Protobuf type grafeas.v1.CreateOccurrenceRequest

DSSEAttestationNote

Protobuf type grafeas.v1.DSSEAttestationNote

DSSEAttestationNote.Builder

Protobuf type grafeas.v1.DSSEAttestationNote

DSSEAttestationNote.DSSEHint

Protobuf type grafeas.v1.DSSEAttestationNote.DSSEHint

DSSEAttestationNote.DSSEHint.Builder

Protobuf type grafeas.v1.DSSEAttestationNote.DSSEHint

DSSEAttestationOccurrence

Deprecated. Prefer to use a regular Occurrence, and populate the Envelope at the top level of the Occurrence.

Protobuf type grafeas.v1.DSSEAttestationOccurrence

DSSEAttestationOccurrence.Builder

Deprecated. Prefer to use a regular Occurrence, and populate the Envelope at the top level of the Occurrence.

Protobuf type grafeas.v1.DSSEAttestationOccurrence

DeleteNoteRequest

Request to delete a note.

Protobuf type grafeas.v1.DeleteNoteRequest

DeleteNoteRequest.Builder

Request to delete a note.

Protobuf type grafeas.v1.DeleteNoteRequest

DeleteOccurrenceRequest

Request to delete an occurrence.

Protobuf type grafeas.v1.DeleteOccurrenceRequest

DeleteOccurrenceRequest.Builder

Request to delete an occurrence.

Protobuf type grafeas.v1.DeleteOccurrenceRequest

Deployment

DeploymentNote

An artifact that can be deployed in some runtime.

Protobuf type grafeas.v1.DeploymentNote

DeploymentNote.Builder

An artifact that can be deployed in some runtime.

Protobuf type grafeas.v1.DeploymentNote

DeploymentOccurrence

The period during which some deployable was active in a runtime.

Protobuf type grafeas.v1.DeploymentOccurrence

DeploymentOccurrence.Builder

The period during which some deployable was active in a runtime.

Protobuf type grafeas.v1.DeploymentOccurrence

Digest

Digest information.

Protobuf type grafeas.v1.Digest

Digest.Builder

Digest information.

Protobuf type grafeas.v1.Digest

Discovery

DiscoveryNote

A note that indicates a type of analysis a provider would perform. This note exists in a provider's project. A Discovery occurrence is created in a consumer's project at the start of analysis.

Protobuf type grafeas.v1.DiscoveryNote

DiscoveryNote.Builder

A note that indicates a type of analysis a provider would perform. This note exists in a provider's project. A Discovery occurrence is created in a consumer's project at the start of analysis.

Protobuf type grafeas.v1.DiscoveryNote

DiscoveryOccurrence

Provides information about the analysis status of a discovered resource.

Protobuf type grafeas.v1.DiscoveryOccurrence

DiscoveryOccurrence.Builder

Provides information about the analysis status of a discovered resource.

Protobuf type grafeas.v1.DiscoveryOccurrence

Distribution

This represents a particular channel of distribution for a given package. E.g., Debian's jessie-backports dpkg mirror.

Protobuf type grafeas.v1.Distribution

Distribution.Builder

This represents a particular channel of distribution for a given package. E.g., Debian's jessie-backports dpkg mirror.

Protobuf type grafeas.v1.Distribution

DsseAttestation

Envelope

MUST match https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An authenticated message of arbitrary type.

Protobuf type grafeas.v1.Envelope

Envelope.Builder

MUST match https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An authenticated message of arbitrary type.

Protobuf type grafeas.v1.Envelope

EnvelopeSignature

Protobuf type grafeas.v1.EnvelopeSignature

EnvelopeSignature.Builder

Protobuf type grafeas.v1.EnvelopeSignature

FileHashes

Container message for hashes of byte content of files, used in source messages to verify integrity of source input to the build.

Protobuf type grafeas.v1.FileHashes

FileHashes.Builder

Container message for hashes of byte content of files, used in source messages to verify integrity of source input to the build.

Protobuf type grafeas.v1.FileHashes

FileLocation

Indicates the location at which a package was found.

Protobuf type grafeas.v1.FileLocation

FileLocation.Builder

Indicates the location at which a package was found.

Protobuf type grafeas.v1.FileLocation

Fingerprint

A set of properties that uniquely identify a given Docker image.

Protobuf type grafeas.v1.Fingerprint

Fingerprint.Builder

A set of properties that uniquely identify a given Docker image.

Protobuf type grafeas.v1.Fingerprint

GerritSourceContext

A SourceContext referring to a Gerrit project.

Protobuf type grafeas.v1.GerritSourceContext

GerritSourceContext.Builder

A SourceContext referring to a Gerrit project.

Protobuf type grafeas.v1.GerritSourceContext

GetNoteRequest

Request to get a note.

Protobuf type grafeas.v1.GetNoteRequest

GetNoteRequest.Builder

Request to get a note.

Protobuf type grafeas.v1.GetNoteRequest

GetOccurrenceNoteRequest

Request to get the note to which the specified occurrence is attached.

Protobuf type grafeas.v1.GetOccurrenceNoteRequest

GetOccurrenceNoteRequest.Builder

Request to get the note to which the specified occurrence is attached.

Protobuf type grafeas.v1.GetOccurrenceNoteRequest

GetOccurrenceRequest

Request to get an occurrence.

Protobuf type grafeas.v1.GetOccurrenceRequest

GetOccurrenceRequest.Builder

Request to get an occurrence.

Protobuf type grafeas.v1.GetOccurrenceRequest

GitSourceContext

A GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).

Protobuf type grafeas.v1.GitSourceContext

GitSourceContext.Builder

A GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).

Protobuf type grafeas.v1.GitSourceContext

GrafeasClient

Service Description: Grafeas API.

Retrieves analysis results of Cloud components such as Docker container images.

This class provides the ability to make remote calls to the backing service through method calls that map to API methods. Sample code to get started:


 // This snippet has been automatically generated for illustrative purposes only.
 // It may require modifications to work in your environment.
 try (GrafeasClient grafeasClient = GrafeasClient.create()) {
   OccurrenceName name = OccurrenceName.of("[PROJECT]", "[OCCURRENCE]");
   Occurrence response = grafeasClient.getOccurrence(name);
 }

Note: close() needs to be called on the GrafeasClient object to clean up resources such as threads. In the example above, try-with-resources is used, which automatically calls close().

The surface of this class includes several types of Java methods for each of the API's methods:

A "flattened" method. With this type of method, the fields of the request type have been converted into function parameters. It may be the case that not all fields are available as parameters, and not every API method will have a flattened method entry point.
A "request object" method. This type of method only takes one parameter, a request object, which must be constructed before the call. Not every API method will have a request object method.
A "callable" method. This type of method takes no parameters and returns an immutable API callable object, which can be used to initiate calls to the service.

See the individual methods for example code.

Many parameters require resource names to be formatted in a particular way. To assist with these names, this class includes a format method for each type of name, and additionally a parse method to extract the individual identifiers contained within names that are returned.

This class can be customized by passing in a custom instance of GrafeasSettings to create(). For example:

To customize credentials:


 // This snippet has been automatically generated for illustrative purposes only.
 // It may require modifications to work in your environment.
 GrafeasSettings grafeasSettings =
     GrafeasSettings.newBuilder()
         .setCredentialsProvider(FixedCredentialsProvider.create(myCredentials))
         .build();
 GrafeasClient grafeasClient = GrafeasClient.create(grafeasSettings);

To customize the endpoint:


 // This snippet has been automatically generated for illustrative purposes only.
 // It may require modifications to work in your environment.
 GrafeasSettings grafeasSettings = GrafeasSettings.newBuilder().setEndpoint(myEndpoint).build();
 GrafeasClient grafeasClient = GrafeasClient.create(grafeasSettings);

Please refer to the GitHub repository's samples for more quickstart code snippets.

GrafeasClient.ListNoteOccurrencesFixedSizeCollection

GrafeasClient.ListNoteOccurrencesPage

GrafeasClient.ListNoteOccurrencesPagedResponse

GrafeasClient.ListNotesFixedSizeCollection

GrafeasClient.ListNotesPage

GrafeasClient.ListNotesPagedResponse

GrafeasClient.ListOccurrencesFixedSizeCollection

GrafeasClient.ListOccurrencesPage

GrafeasClient.ListOccurrencesPagedResponse

GrafeasGrpc

Grafeas API. Retrieves analysis results of Cloud components such as Docker container images. Analysis results are stored as a series of occurrences. An Occurrence contains information about a specific analysis instance on a resource. An occurrence refers to a Note. A note contains details describing the analysis and is generally stored in a separate project, called a Provider. Multiple occurrences can refer to the same note. For example, an SSL vulnerability could affect multiple images. In this case, there would be one note for the vulnerability and an occurrence for each image with the vulnerability referring to that note.

GrafeasGrpc.GrafeasBlockingStub

GrafeasGrpc.GrafeasFutureStub

GrafeasGrpc.GrafeasImplBase

GrafeasGrpc.GrafeasStub

GrafeasOuterClass

GrafeasSettings

Settings class to configure an instance of GrafeasClient.

The default instance has everything set to sensible defaults:

The default service address (containeranalysis.googleapis.com) and default port (443) are used.
Credentials are acquired automatically through Application Default Credentials.
Retries are configured for idempotent methods but not for non-idempotent methods.

The builder of this class is recursive, so contained classes are themselves builders. When build() is called, the tree of builders is called to create the complete settings object.

For example, to set the total timeout of getOccurrence to 30 seconds:


 // This snippet has been automatically generated for illustrative purposes only.
 // It may require modifications to work in your environment.
 GrafeasSettings.Builder grafeasSettingsBuilder = GrafeasSettings.newBuilder();
 grafeasSettingsBuilder
     .getOccurrenceSettings()
     .setRetrySettings(
         grafeasSettingsBuilder
             .getOccurrenceSettings()
             .getRetrySettings()
             .toBuilder()
             .setTotalTimeout(Duration.ofSeconds(30))
             .build());
 GrafeasSettings grafeasSettings = grafeasSettingsBuilder.build();

GrafeasSettings.Builder

Builder for GrafeasSettings.

Hash

Container message for hash values.

Protobuf type grafeas.v1.Hash

Hash.Builder

Container message for hash values.

Protobuf type grafeas.v1.Hash

Image

ImageNote

Basis describes the base image portion (Note) of the DockerImage relationship. Linked occurrences are derived from this or an equivalent image via: FROM <Basis.resource_url> Or an equivalent reference, e.g., a tag of the resource_url.

Protobuf type grafeas.v1.ImageNote

ImageNote.Builder

Protobuf type grafeas.v1.ImageNote

ImageOccurrence

Details of the derived image portion of the DockerImage relationship. This image would be produced from a Dockerfile with FROM <DockerImage.Basis in attached Note>.

Protobuf type grafeas.v1.ImageOccurrence

ImageOccurrence.Builder

Details of the derived image portion of the DockerImage relationship. This image would be produced from a Dockerfile with FROM <DockerImage.Basis in attached Note>.

Protobuf type grafeas.v1.ImageOccurrence

InTotoProvenance

Protobuf type grafeas.v1.InTotoProvenance

InTotoProvenance.Builder

Protobuf type grafeas.v1.InTotoProvenance

InTotoProvenanceProto

InTotoStatement

Spec defined at https://github.com/in-toto/attestation/tree/main/spec#statement The serialized InTotoStatement will be stored as Envelope.payload. Envelope.payloadType is always "application/vnd.in-toto+json".

Protobuf type grafeas.v1.InTotoStatement

InTotoStatement.Builder

Protobuf type grafeas.v1.InTotoStatement

InTotoStatementProto

Jwt

Protobuf type grafeas.v1.Jwt

Jwt.Builder

Protobuf type grafeas.v1.Jwt

Layer

Layer holds metadata specific to a layer of a Docker image.

Protobuf type grafeas.v1.Layer

Layer.Builder

Layer holds metadata specific to a layer of a Docker image.

Protobuf type grafeas.v1.Layer

License

License information.

Protobuf type grafeas.v1.License

License.Builder

License information.

Protobuf type grafeas.v1.License

ListNoteOccurrencesRequest

Request to list occurrences for a note.

Protobuf type grafeas.v1.ListNoteOccurrencesRequest

ListNoteOccurrencesRequest.Builder

Request to list occurrences for a note.

Protobuf type grafeas.v1.ListNoteOccurrencesRequest

ListNoteOccurrencesResponse

Response for listing occurrences for a note.

Protobuf type grafeas.v1.ListNoteOccurrencesResponse

ListNoteOccurrencesResponse.Builder

Response for listing occurrences for a note.

Protobuf type grafeas.v1.ListNoteOccurrencesResponse

ListNotesRequest

Request to list notes.

Protobuf type grafeas.v1.ListNotesRequest

ListNotesRequest.Builder

Request to list notes.

Protobuf type grafeas.v1.ListNotesRequest

ListNotesResponse

Response for listing notes.

Protobuf type grafeas.v1.ListNotesResponse

ListNotesResponse.Builder

Response for listing notes.

Protobuf type grafeas.v1.ListNotesResponse

ListOccurrencesRequest

Request to list occurrences.

Protobuf type grafeas.v1.ListOccurrencesRequest

ListOccurrencesRequest.Builder

Request to list occurrences.

Protobuf type grafeas.v1.ListOccurrencesRequest

ListOccurrencesResponse

Response for listing occurrences.

Protobuf type grafeas.v1.ListOccurrencesResponse

ListOccurrencesResponse.Builder

Response for listing occurrences.

Protobuf type grafeas.v1.ListOccurrencesResponse

Location

An occurrence of a particular package installation found within a system's filesystem. E.g., glibc was found in /var/lib/dpkg/status.

Protobuf type grafeas.v1.Location

Location.Builder

An occurrence of a particular package installation found within a system's filesystem. E.g., glibc was found in /var/lib/dpkg/status.

Protobuf type grafeas.v1.Location

Metadata

Other properties of the build.

Protobuf type grafeas.v1.Metadata

Metadata.Builder

Other properties of the build.

Protobuf type grafeas.v1.Metadata

NonCompliantFile

Details about files that caused a compliance check to fail.

Protobuf type grafeas.v1.NonCompliantFile

NonCompliantFile.Builder

Details about files that caused a compliance check to fail.

Protobuf type grafeas.v1.NonCompliantFile

Note

A type of analysis that can be done for a resource.

Protobuf type grafeas.v1.Note

Note.Builder

A type of analysis that can be done for a resource.

Protobuf type grafeas.v1.Note

NoteName

NoteName.Builder

Builder for projects/{project}/notes/{note}.

Occurrence

An instance of an analysis type that has been found on a resource.

Protobuf type grafeas.v1.Occurrence

Occurrence.Builder

An instance of an analysis type that has been found on a resource.

Protobuf type grafeas.v1.Occurrence

OccurrenceName

OccurrenceName.Builder

Builder for projects/{project}/occurrences/{occurrence}.

Package

PackageNote

PackageNote represents a particular package version.

Protobuf type grafeas.v1.PackageNote

PackageNote.Builder

PackageNote represents a particular package version.

Protobuf type grafeas.v1.PackageNote

PackageOccurrence

Details on how a particular software package was installed on a system.

Protobuf type grafeas.v1.PackageOccurrence

PackageOccurrence.Builder

Details on how a particular software package was installed on a system.

Protobuf type grafeas.v1.PackageOccurrence

ProjectName

ProjectName.Builder

Builder for projects/{project}.

ProjectRepoId

Selects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.

Protobuf type grafeas.v1.ProjectRepoId

ProjectRepoId.Builder

Selects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.

Protobuf type grafeas.v1.ProjectRepoId

Provenance

Recipe

Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.

Protobuf type grafeas.v1.Recipe

Recipe.Builder

Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.

Protobuf type grafeas.v1.Recipe

RelatedUrl

Metadata for any related URL information.

Protobuf type grafeas.v1.RelatedUrl

RelatedUrl.Builder

Metadata for any related URL information.

Protobuf type grafeas.v1.RelatedUrl

RepoId

A unique identifier for a Cloud Repo.

Protobuf type grafeas.v1.RepoId

RepoId.Builder

A unique identifier for a Cloud Repo.

Protobuf type grafeas.v1.RepoId

SeverityOuterClass

Signature

Verifiers (e.g. Kritis implementations) MUST verify signatures with respect to the trust anchors defined in policy (e.g. a Kritis policy). Typically this means that the verifier has been configured with a map from public_key_id to public key material (and any required parameters, e.g. signing algorithm). In particular, verification implementations MUST NOT treat the signature public_key_id as anything more than a key lookup hint. The public_key_id DOES NOT validate or authenticate a public key; it only provides a mechanism for quickly selecting a public key ALREADY CONFIGURED on the verifier through a trusted channel. Verification implementations MUST reject signatures in any of the following circumstances:

The public_key_id is not recognized by the verifier.
The public key that public_key_id refers to does not verify the signature with respect to the payload. The signature contents SHOULD NOT be "attached" (where the payload is included with the serialized signature bytes). Verifiers MUST ignore any "attached" payload and only verify signatures with respect to explicitly provided payload (e.g. a payload field on the proto message that holds this Signature, or the canonical serialization of the proto message that holds this signature).

Protobuf type grafeas.v1.Signature

Signature.Builder

The public_key_id is not recognized by the verifier.
The public key that public_key_id refers to does not verify the signature with respect to the payload. The signature contents SHOULD NOT be "attached" (where the payload is included with the serialized signature bytes). Verifiers MUST ignore any "attached" payload and only verify signatures with respect to explicitly provided payload (e.g. a payload field on the proto message that holds this Signature, or the canonical serialization of the proto message that holds this signature).

Protobuf type grafeas.v1.Signature

SlsaProvenance

Protobuf type grafeas.v1.SlsaProvenance

SlsaProvenance.Builder

Protobuf type grafeas.v1.SlsaProvenance

SlsaProvenance.Material

Protobuf type grafeas.v1.SlsaProvenance.Material

SlsaProvenance.Material.Builder

Protobuf type grafeas.v1.SlsaProvenance.Material

SlsaProvenance.SlsaBuilder

Protobuf type grafeas.v1.SlsaProvenance.SlsaBuilder

SlsaProvenance.SlsaBuilder.Builder

Protobuf type grafeas.v1.SlsaProvenance.SlsaBuilder

SlsaProvenance.SlsaCompleteness

Indicates that the builder claims certain fields in this message to be complete.

Protobuf type grafeas.v1.SlsaProvenance.SlsaCompleteness

SlsaProvenance.SlsaCompleteness.Builder

Indicates that the builder claims certain fields in this message to be complete.

Protobuf type grafeas.v1.SlsaProvenance.SlsaCompleteness

SlsaProvenance.SlsaMetadata

Other properties of the build.

Protobuf type grafeas.v1.SlsaProvenance.SlsaMetadata

SlsaProvenance.SlsaMetadata.Builder

Other properties of the build.

Protobuf type grafeas.v1.SlsaProvenance.SlsaMetadata

SlsaProvenance.SlsaRecipe

Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.

Protobuf type grafeas.v1.SlsaProvenance.SlsaRecipe

SlsaProvenance.SlsaRecipe.Builder

Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.

Protobuf type grafeas.v1.SlsaProvenance.SlsaRecipe

SlsaProvenanceProto

SlsaProvenanceZeroTwo

See full explanation of fields at slsa.dev/provenance/v0.2.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo

SlsaProvenanceZeroTwo.Builder

See full explanation of fields at slsa.dev/provenance/v0.2.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo

SlsaProvenanceZeroTwo.SlsaBuilder

Identifies the entity that executed the recipe, which is trusted to have correctly performed the operation and populated this provenance.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaBuilder

SlsaProvenanceZeroTwo.SlsaBuilder.Builder

Identifies the entity that executed the recipe, which is trusted to have correctly performed the operation and populated this provenance.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaBuilder

SlsaProvenanceZeroTwo.SlsaCompleteness

Indicates that the builder claims certain fields in this message to be complete.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaCompleteness

SlsaProvenanceZeroTwo.SlsaCompleteness.Builder

Indicates that the builder claims certain fields in this message to be complete.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaCompleteness

SlsaProvenanceZeroTwo.SlsaConfigSource

Describes where the config file that kicked off the build came from. This is effectively a pointer to the source where buildConfig came from.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaConfigSource

SlsaProvenanceZeroTwo.SlsaConfigSource.Builder

Describes where the config file that kicked off the build came from. This is effectively a pointer to the source where buildConfig came from.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaConfigSource

SlsaProvenanceZeroTwo.SlsaInvocation

Identifies the event that kicked off the build.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaInvocation

SlsaProvenanceZeroTwo.SlsaInvocation.Builder

Identifies the event that kicked off the build.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaInvocation

SlsaProvenanceZeroTwo.SlsaMaterial

The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaMaterial

SlsaProvenanceZeroTwo.SlsaMaterial.Builder

The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaMaterial

SlsaProvenanceZeroTwo.SlsaMetadata

Other properties of the build.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaMetadata

SlsaProvenanceZeroTwo.SlsaMetadata.Builder

Other properties of the build.

Protobuf type grafeas.v1.SlsaProvenanceZeroTwo.SlsaMetadata

SlsaProvenanceZeroTwoProto

Source

Source describes the location of the source used for the build.

Protobuf type grafeas.v1.Source

Source.Builder

Source describes the location of the source used for the build.

Protobuf type grafeas.v1.Source

SourceContext

A SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.

Protobuf type grafeas.v1.SourceContext

SourceContext.Builder

A SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.

Protobuf type grafeas.v1.SourceContext

Subject

Protobuf type grafeas.v1.Subject

Subject.Builder

Protobuf type grafeas.v1.Subject

UpdateNoteRequest

Request to update a note.

Protobuf type grafeas.v1.UpdateNoteRequest

UpdateNoteRequest.Builder

Request to update a note.

Protobuf type grafeas.v1.UpdateNoteRequest

UpdateOccurrenceRequest

Request to update an occurrence.

Protobuf type grafeas.v1.UpdateOccurrenceRequest

UpdateOccurrenceRequest.Builder

Request to update an occurrence.

Protobuf type grafeas.v1.UpdateOccurrenceRequest

Upgrade

UpgradeDistribution

The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities.

Protobuf type grafeas.v1.UpgradeDistribution

UpgradeDistribution.Builder

Protobuf type grafeas.v1.UpgradeDistribution

UpgradeNote

An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be an Upgrade Note. For Windows, windows_update field represents the information related to the update.

Protobuf type grafeas.v1.UpgradeNote

UpgradeNote.Builder

Protobuf type grafeas.v1.UpgradeNote

UpgradeOccurrence

An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). For Windows, both distribution and windows_update contain information for the Windows update.

Protobuf type grafeas.v1.UpgradeOccurrence