google-apis-containeranalysis_v1beta1 0.7.0 → 0.11.0

data/lib/google/apis/containeranalysis_v1beta1/classes.rb

@@ -294,7 +294,7 @@ module Google
         end
       end
       
-      # Associates `members` with a `role`.
+      # Associates `members`, or principals, with a `role`.
       class Binding
         include Google::Apis::Core::Hashable
       
@@ -317,7 +317,7 @@ module Google
         # @return [Google::Apis::ContaineranalysisV1beta1::Expr]
         attr_accessor :condition
       
-        # Specifies the identities requesting access for a Cloud Platform resource. `
+        # Specifies the principals requesting access for a Cloud Platform resource. `
         # members` can have the following values: * `allUsers`: A special identifier
         # that represents anyone who is on the internet; with or without a Google
         # account. * `allAuthenticatedUsers`: A special identifier that represents
@@ -347,8 +347,8 @@ module Google
         # @return [Array<String>]
         attr_accessor :members
       
-        # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`
-        # , or `roles/owner`.
+        # Role that is assigned to the list of `members`, or principals. For example, `
+        # roles/viewer`, `roles/editor`, or `roles/owner`.
         # Corresponds to the JSON property `role`
         # @return [String]
         attr_accessor :role
@@ -537,6 +537,141 @@ module Google
         end
       end
       
+      # A step in the build pipeline.
+      class BuildStep
+        include Google::Apis::Core::Hashable
+      
+        # A list of arguments that will be presented to the step when it is started. If
+        # the image used to run the step's container has an entrypoint, the `args` are
+        # used as arguments to that entrypoint. If the image does not define an
+        # entrypoint, the first element in args is used as the entrypoint, and the
+        # remainder will be used as arguments.
+        # Corresponds to the JSON property `args`
+        # @return [Array<String>]
+        attr_accessor :args
+      
+        # Working directory to use when running this step's container. If this value is
+        # a relative path, it is relative to the build's working directory. If this
+        # value is absolute, it may be outside the build's working directory, in which
+        # case the contents of the path may not be persisted across build step
+        # executions, unless a `volume` for that path is specified. If the build
+        # specifies a `RepoSource` with `dir` and a step with a `dir`, which specifies
+        # an absolute path, the `RepoSource` `dir` is ignored for the step's execution.
+        # Corresponds to the JSON property `dir`
+        # @return [String]
+        attr_accessor :dir
+      
+        # Entrypoint to be used instead of the build step image's default entrypoint. If
+        # unset, the image's default entrypoint is used.
+        # Corresponds to the JSON property `entrypoint`
+        # @return [String]
+        attr_accessor :entrypoint
+      
+        # A list of environment variable definitions to be used when running a step. The
+        # elements are of the form "KEY=VALUE" for the environment variable "KEY" being
+        # given the value "VALUE".
+        # Corresponds to the JSON property `env`
+        # @return [Array<String>]
+        attr_accessor :env
+      
+        # Unique identifier for this build step, used in `wait_for` to reference this
+        # build step as a dependency.
+        # Corresponds to the JSON property `id`
+        # @return [String]
+        attr_accessor :id
+      
+        # Required. The name of the container image that will run this particular build
+        # step. If the image is available in the host's Docker daemon's cache, it will
+        # be run directly. If not, the host will attempt to pull the image first, using
+        # the builder service account's credentials if necessary. The Docker daemon's
+        # cache will already have the latest versions of all of the officially supported
+        # build steps ([https://github.com/GoogleCloudPlatform/cloud-builders](https://
+        # github.com/GoogleCloudPlatform/cloud-builders)). The Docker daemon will also
+        # have cached many of the layers for some popular images, like "ubuntu", "debian"
+        # , but they will be refreshed at the time you attempt to use them. If you built
+        # an image in a previous build step, it will be stored in the host's Docker
+        # daemon's cache and is available to use as the name for a later build step.
+        # Corresponds to the JSON property `name`
+        # @return [String]
+        attr_accessor :name
+      
+        # Start and end times for a build execution phase.
+        # Corresponds to the JSON property `pullTiming`
+        # @return [Google::Apis::ContaineranalysisV1beta1::TimeSpan]
+        attr_accessor :pull_timing
+      
+        # A shell script to be executed in the step. When script is provided, the user
+        # cannot specify the entrypoint or args.
+        # Corresponds to the JSON property `script`
+        # @return [String]
+        attr_accessor :script
+      
+        # A list of environment variables which are encrypted using a Cloud Key
+        # Management Service crypto key. These values must be specified in the build's `
+        # Secret`.
+        # Corresponds to the JSON property `secretEnv`
+        # @return [Array<String>]
+        attr_accessor :secret_env
+      
+        # Output only. Status of the build step. At this time, build step status is only
+        # updated on build completion; step status is not updated in real-time as the
+        # build progresses.
+        # Corresponds to the JSON property `status`
+        # @return [String]
+        attr_accessor :status
+      
+        # Time limit for executing this build step. If not defined, the step has no time
+        # limit and will be allowed to continue to run until either it completes or the
+        # build itself times out.
+        # Corresponds to the JSON property `timeout`
+        # @return [String]
+        attr_accessor :timeout
+      
+        # Start and end times for a build execution phase.
+        # Corresponds to the JSON property `timing`
+        # @return [Google::Apis::ContaineranalysisV1beta1::TimeSpan]
+        attr_accessor :timing
+      
+        # List of volumes to mount into the build step. Each volume is created as an
+        # empty volume prior to execution of the build step. Upon completion of the
+        # build, volumes and their contents are discarded. Using a named volume in only
+        # one step is not valid as it is indicative of a build request with an incorrect
+        # configuration.
+        # Corresponds to the JSON property `volumes`
+        # @return [Array<Google::Apis::ContaineranalysisV1beta1::Volume>]
+        attr_accessor :volumes
+      
+        # The ID(s) of the step(s) that this build step depends on. This build step will
+        # not start until all the build steps in `wait_for` have completed successfully.
+        # If `wait_for` is empty, this build step will start when all previous build
+        # steps in the `Build.Steps` list have completed successfully.
+        # Corresponds to the JSON property `waitFor`
+        # @return [Array<String>]
+        attr_accessor :wait_for
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @args = args[:args] if args.key?(:args)
+          @dir = args[:dir] if args.key?(:dir)
+          @entrypoint = args[:entrypoint] if args.key?(:entrypoint)
+          @env = args[:env] if args.key?(:env)
+          @id = args[:id] if args.key?(:id)
+          @name = args[:name] if args.key?(:name)
+          @pull_timing = args[:pull_timing] if args.key?(:pull_timing)
+          @script = args[:script] if args.key?(:script)
+          @secret_env = args[:secret_env] if args.key?(:secret_env)
+          @status = args[:status] if args.key?(:status)
+          @timeout = args[:timeout] if args.key?(:timeout)
+          @timing = args[:timing] if args.key?(:timing)
+          @volumes = args[:volumes] if args.key?(:volumes)
+          @wait_for = args[:wait_for] if args.key?(:wait_for)
+        end
+      end
+      
       # Defines an object for the byproducts field in in-toto links. The suggested
       # fields are "stderr", "stdout", and "return-value".
       class ByProducts
@@ -1073,6 +1208,112 @@ module Google
         end
       end
       
+      # DocumentNote represents an SPDX Document Creation Infromation section: https://
+      # spdx.github.io/spdx-spec/2-document-creation-information/
+      class DocumentNote
+        include Google::Apis::Core::Hashable
+      
+        # Compliance with the SPDX specification includes populating the SPDX fields
+        # therein with data related to such fields ("SPDX-Metadata")
+        # Corresponds to the JSON property `dataLicence`
+        # @return [String]
+        attr_accessor :data_licence
+      
+        # Provide a reference number that can be used to understand how to parse and
+        # interpret the rest of the file
+        # Corresponds to the JSON property `spdxVersion`
+        # @return [String]
+        attr_accessor :spdx_version
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @data_licence = args[:data_licence] if args.key?(:data_licence)
+          @spdx_version = args[:spdx_version] if args.key?(:spdx_version)
+        end
+      end
+      
+      # DocumentOccurrence represents an SPDX Document Creation Information section:
+      # https://spdx.github.io/spdx-spec/2-document-creation-information/
+      class DocumentOccurrence
+        include Google::Apis::Core::Hashable
+      
+        # Identify when the SPDX file was originally created. The date is to be
+        # specified according to combined date and time in UTC format as specified in
+        # ISO 8601 standard
+        # Corresponds to the JSON property `createTime`
+        # @return [String]
+        attr_accessor :create_time
+      
+        # A field for creators of the SPDX file to provide general comments about the
+        # creation of the SPDX file or any other relevant comment not included in the
+        # other fields
+        # Corresponds to the JSON property `creatorComment`
+        # @return [String]
+        attr_accessor :creator_comment
+      
+        # Identify who (or what, in the case of a tool) created the SPDX file. If the
+        # SPDX file was created by an individual, indicate the person's name
+        # Corresponds to the JSON property `creators`
+        # @return [Array<String>]
+        attr_accessor :creators
+      
+        # A field for creators of the SPDX file content to provide comments to the
+        # consumers of the SPDX document
+        # Corresponds to the JSON property `documentComment`
+        # @return [String]
+        attr_accessor :document_comment
+      
+        # Identify any external SPDX documents referenced within this SPDX document
+        # Corresponds to the JSON property `externalDocumentRefs`
+        # @return [Array<String>]
+        attr_accessor :external_document_refs
+      
+        # Identify the current SPDX document which may be referenced in relationships by
+        # other files, packages internally and documents externally
+        # Corresponds to the JSON property `id`
+        # @return [String]
+        attr_accessor :id
+      
+        # A field for creators of the SPDX file to provide the version of the SPDX
+        # License List used when the SPDX file was created
+        # Corresponds to the JSON property `licenseListVersion`
+        # @return [String]
+        attr_accessor :license_list_version
+      
+        # Provide an SPDX document specific namespace as a unique absolute Uniform
+        # Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘
+        # #’ delimiter
+        # Corresponds to the JSON property `namespace`
+        # @return [String]
+        attr_accessor :namespace
+      
+        # Identify name of this document as designated by creator
+        # Corresponds to the JSON property `title`
+        # @return [String]
+        attr_accessor :title
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @create_time = args[:create_time] if args.key?(:create_time)
+          @creator_comment = args[:creator_comment] if args.key?(:creator_comment)
+          @creators = args[:creators] if args.key?(:creators)
+          @document_comment = args[:document_comment] if args.key?(:document_comment)
+          @external_document_refs = args[:external_document_refs] if args.key?(:external_document_refs)
+          @id = args[:id] if args.key?(:id)
+          @license_list_version = args[:license_list_version] if args.key?(:license_list_version)
+          @namespace = args[:namespace] if args.key?(:namespace)
+          @title = args[:title] if args.key?(:title)
+        end
+      end
+      
       # A generic empty message that you can re-use to avoid defining duplicated empty
       # messages in your APIs. A typical example is to use it as the request or the
       # response type of an API method. For instance: service Foo ` rpc Bar(google.
@@ -1164,6 +1405,48 @@ module Google
         end
       end
       
+      # An External Reference allows a Package to reference an external source of
+      # additional information, metadata, enumerations, asset identifiers, or
+      # downloadable content believed to be relevant to the Package
+      class ExternalRef
+        include Google::Apis::Core::Hashable
+      
+        # An External Reference allows a Package to reference an external source of
+        # additional information, metadata, enumerations, asset identifiers, or
+        # downloadable content believed to be relevant to the Package
+        # Corresponds to the JSON property `category`
+        # @return [String]
+        attr_accessor :category
+      
+        # Human-readable information about the purpose and target of the reference
+        # Corresponds to the JSON property `comment`
+        # @return [String]
+        attr_accessor :comment
+      
+        # The unique string with no spaces necessary to access the package-specific
+        # information, metadata, or content within the target location
+        # Corresponds to the JSON property `locator`
+        # @return [String]
+        attr_accessor :locator
+      
+        # Type of category (e.g. 'npm' for the PACKAGE_MANAGER category)
+        # Corresponds to the JSON property `type`
+        # @return [String]
+        attr_accessor :type
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @category = args[:category] if args.key?(:category)
+          @comment = args[:comment] if args.key?(:comment)
+          @locator = args[:locator] if args.key?(:locator)
+          @type = args[:type] if args.key?(:type)
+        end
+      end
+      
       # Container message for hashes of byte content of files, used in source messages
       # to verify integrity of source input to the build.
       class FileHashes
@@ -1184,6 +1467,108 @@ module Google
         end
       end
       
+      # FileNote represents an SPDX File Information section: https://spdx.github.io/
+      # spdx-spec/4-file-information/
+      class FileNote
+        include Google::Apis::Core::Hashable
+      
+        # Provide a unique identifier to match analysis information on each specific
+        # file in a package
+        # Corresponds to the JSON property `checksum`
+        # @return [Array<String>]
+        attr_accessor :checksum
+      
+        # This field provides information about the type of file identified
+        # Corresponds to the JSON property `fileType`
+        # @return [String]
+        attr_accessor :file_type
+      
+        # Identify the full path and filename that corresponds to the file information
+        # in this section
+        # Corresponds to the JSON property `title`
+        # @return [String]
+        attr_accessor :title
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @checksum = args[:checksum] if args.key?(:checksum)
+          @file_type = args[:file_type] if args.key?(:file_type)
+          @title = args[:title] if args.key?(:title)
+        end
+      end
+      
+      # FileOccurrence represents an SPDX File Information section: https://spdx.
+      # github.io/spdx-spec/4-file-information/
+      class FileOccurrence
+        include Google::Apis::Core::Hashable
+      
+        # This field provides a place for the SPDX data creator to record, at the file
+        # level, acknowledgements that may be needed to be communicated in some contexts
+        # Corresponds to the JSON property `attributions`
+        # @return [Array<String>]
+        attr_accessor :attributions
+      
+        # This field provides a place for the SPDX file creator to record any general
+        # comments about the file
+        # Corresponds to the JSON property `comment`
+        # @return [String]
+        attr_accessor :comment
+      
+        # This field provides a place for the SPDX file creator to record file
+        # contributors
+        # Corresponds to the JSON property `contributors`
+        # @return [Array<String>]
+        attr_accessor :contributors
+      
+        # Identify the copyright holder of the file, as well as any dates present
+        # Corresponds to the JSON property `copyright`
+        # @return [String]
+        attr_accessor :copyright
+      
+        # This field contains the license information actually found in the file, if any
+        # Corresponds to the JSON property `filesLicenseInfo`
+        # @return [Array<String>]
+        attr_accessor :files_license_info
+      
+        # Uniquely identify any element in an SPDX document which may be referenced by
+        # other elements
+        # Corresponds to the JSON property `id`
+        # @return [String]
+        attr_accessor :id
+      
+        # License information: https://spdx.github.io/spdx-spec/3-package-information/#
+        # 315-declared-license
+        # Corresponds to the JSON property `licenseConcluded`
+        # @return [Google::Apis::ContaineranalysisV1beta1::License]
+        attr_accessor :license_concluded
+      
+        # This field provides a place for the SPDX file creator to record license
+        # notices or other such related notices found in the file
+        # Corresponds to the JSON property `notice`
+        # @return [String]
+        attr_accessor :notice
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @attributions = args[:attributions] if args.key?(:attributions)
+          @comment = args[:comment] if args.key?(:comment)
+          @contributors = args[:contributors] if args.key?(:contributors)
+          @copyright = args[:copyright] if args.key?(:copyright)
+          @files_license_info = args[:files_license_info] if args.key?(:files_license_info)
+          @id = args[:id] if args.key?(:id)
+          @license_concluded = args[:license_concluded] if args.key?(:license_concluded)
+          @notice = args[:notice] if args.key?(:notice)
+        end
+      end
+      
       # A set of properties that uniquely identify a given Docker image.
       class Fingerprint
         include Google::Apis::Core::Hashable
@@ -1632,7 +2017,13 @@ module Google
       
         # The distro assigned severity for this vulnerability when it is available, and
         # note provider assigned severity when distro has not yet assigned a severity
-        # for this vulnerability.
+        # for this vulnerability. When there are multiple PackageIssues for this
+        # vulnerability, they can have different effective severities because some might
+        # be provided by the distro while others are provided by the language ecosystem
+        # for a language pack. For this reason, it is advised to use the effective
+        # severity on the PackageIssue level. In the case where multiple PackageIssues
+        # have differing effective severities, this field should be the highest severity
+        # for any of the PackageIssues.
         # Corresponds to the JSON property `effectiveSeverity`
         # @return [String]
         attr_accessor :effective_severity
@@ -1868,6 +2259,33 @@ module Google
         end
       end
       
+      # License information: https://spdx.github.io/spdx-spec/3-package-information/#
+      # 315-declared-license
+      class License
+        include Google::Apis::Core::Hashable
+      
+        # Comments
+        # Corresponds to the JSON property `comments`
+        # @return [String]
+        attr_accessor :comments
+      
+        # Expression: https://spdx.github.io/spdx-spec/appendix-IV-SPDX-license-
+        # expressions/
+        # Corresponds to the JSON property `expression`
+        # @return [String]
+        attr_accessor :expression
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @comments = args[:comments] if args.key?(:comments)
+          @expression = args[:expression] if args.key?(:expression)
+        end
+      end
+      
       # This corresponds to an in-toto link.
       class Link
         include Google::Apis::Core::Hashable
@@ -2149,11 +2567,35 @@ module Google
         # @return [Array<Google::Apis::ContaineranalysisV1beta1::RelatedUrl>]
         attr_accessor :related_url
       
+        # DocumentNote represents an SPDX Document Creation Infromation section: https://
+        # spdx.github.io/spdx-spec/2-document-creation-information/
+        # Corresponds to the JSON property `sbom`
+        # @return [Google::Apis::ContaineranalysisV1beta1::DocumentNote]
+        attr_accessor :sbom
+      
         # A one sentence description of this note.
         # Corresponds to the JSON property `shortDescription`
         # @return [String]
         attr_accessor :short_description
       
+        # FileNote represents an SPDX File Information section: https://spdx.github.io/
+        # spdx-spec/4-file-information/
+        # Corresponds to the JSON property `spdxFile`
+        # @return [Google::Apis::ContaineranalysisV1beta1::FileNote]
+        attr_accessor :spdx_file
+      
+        # PackageInfoNote represents an SPDX Package Information section: https://spdx.
+        # github.io/spdx-spec/3-package-information/
+        # Corresponds to the JSON property `spdxPackage`
+        # @return [Google::Apis::ContaineranalysisV1beta1::PackageInfoNote]
+        attr_accessor :spdx_package
+      
+        # RelationshipNote represents an SPDX Relationship section: https://spdx.github.
+        # io/spdx-spec/7-relationships-between-SPDX-elements/
+        # Corresponds to the JSON property `spdxRelationship`
+        # @return [Google::Apis::ContaineranalysisV1beta1::RelationshipNote]
+        attr_accessor :spdx_relationship
+      
         # Output only. The time this note was last updated. This field can be used as a
         # filter in list requests.
         # Corresponds to the JSON property `updateTime`
@@ -2185,7 +2627,11 @@ module Google
           @package = args[:package] if args.key?(:package)
           @related_note_names = args[:related_note_names] if args.key?(:related_note_names)
           @related_url = args[:related_url] if args.key?(:related_url)
+          @sbom = args[:sbom] if args.key?(:sbom)
           @short_description = args[:short_description] if args.key?(:short_description)
+          @spdx_file = args[:spdx_file] if args.key?(:spdx_file)
+          @spdx_package = args[:spdx_package] if args.key?(:spdx_package)
+          @spdx_relationship = args[:spdx_relationship] if args.key?(:spdx_relationship)
           @update_time = args[:update_time] if args.key?(:update_time)
           @vulnerability = args[:vulnerability] if args.key?(:vulnerability)
         end
@@ -2266,6 +2712,30 @@ module Google
         # @return [Google::Apis::ContaineranalysisV1beta1::Resource]
         attr_accessor :resource
       
+        # DocumentOccurrence represents an SPDX Document Creation Information section:
+        # https://spdx.github.io/spdx-spec/2-document-creation-information/
+        # Corresponds to the JSON property `sbom`
+        # @return [Google::Apis::ContaineranalysisV1beta1::DocumentOccurrence]
+        attr_accessor :sbom
+      
+        # FileOccurrence represents an SPDX File Information section: https://spdx.
+        # github.io/spdx-spec/4-file-information/
+        # Corresponds to the JSON property `spdxFile`
+        # @return [Google::Apis::ContaineranalysisV1beta1::FileOccurrence]
+        attr_accessor :spdx_file
+      
+        # PackageInfoOccurrence represents an SPDX Package Information section: https://
+        # spdx.github.io/spdx-spec/3-package-information/
+        # Corresponds to the JSON property `spdxPackage`
+        # @return [Google::Apis::ContaineranalysisV1beta1::PackageInfoOccurrence]
+        attr_accessor :spdx_package
+      
+        # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.
+        # github.io/spdx-spec/7-relationships-between-SPDX-elements/
+        # Corresponds to the JSON property `spdxRelationship`
+        # @return [Google::Apis::ContaineranalysisV1beta1::RelationshipOccurrence]
+        attr_accessor :spdx_relationship
+      
         # Output only. The time this occurrence was last updated.
         # Corresponds to the JSON property `updateTime`
         # @return [String]
@@ -2295,6 +2765,10 @@ module Google
           @note_name = args[:note_name] if args.key?(:note_name)
           @remediation = args[:remediation] if args.key?(:remediation)
           @resource = args[:resource] if args.key?(:resource)
+          @sbom = args[:sbom] if args.key?(:sbom)
+          @spdx_file = args[:spdx_file] if args.key?(:spdx_file)
+          @spdx_package = args[:spdx_package] if args.key?(:spdx_package)
+          @spdx_relationship = args[:spdx_relationship] if args.key?(:spdx_relationship)
           @update_time = args[:update_time] if args.key?(:update_time)
           @vulnerability = args[:vulnerability] if args.key?(:vulnerability)
         end
@@ -2326,6 +2800,221 @@ module Google
         end
       end
       
+      # PackageInfoNote represents an SPDX Package Information section: https://spdx.
+      # github.io/spdx-spec/3-package-information/
+      class PackageInfoNote
+        include Google::Apis::Core::Hashable
+      
+        # Indicates whether the file content of this package has been available for or
+        # subjected to analysis when creating the SPDX document
+        # Corresponds to the JSON property `analyzed`
+        # @return [Boolean]
+        attr_accessor :analyzed
+        alias_method :analyzed?, :analyzed
+      
+        # A place for the SPDX data creator to record, at the package level,
+        # acknowledgements that may be needed to be communicated in some contexts
+        # Corresponds to the JSON property `attribution`
+        # @return [String]
+        attr_accessor :attribution
+      
+        # Provide an independently reproducible mechanism that permits unique
+        # identification of a specific package that correlates to the data in this SPDX
+        # file
+        # Corresponds to the JSON property `checksum`
+        # @return [String]
+        attr_accessor :checksum
+      
+        # Identify the copyright holders of the package, as well as any dates present
+        # Corresponds to the JSON property `copyright`
+        # @return [String]
+        attr_accessor :copyright
+      
+        # A more detailed description of the package
+        # Corresponds to the JSON property `detailedDescription`
+        # @return [String]
+        attr_accessor :detailed_description
+      
+        # This section identifies the download Universal Resource Locator (URL), or a
+        # specific location within a version control system (VCS) for the package at the
+        # time that the SPDX file was created
+        # Corresponds to the JSON property `downloadLocation`
+        # @return [String]
+        attr_accessor :download_location
+      
+        # ExternalRef
+        # Corresponds to the JSON property `externalRefs`
+        # @return [Array<Google::Apis::ContaineranalysisV1beta1::ExternalRef>]
+        attr_accessor :external_refs
+      
+        # Contain the license the SPDX file creator has concluded as governing the This
+        # field is to contain a list of all licenses found in the package. The
+        # relationship between licenses (i.e., conjunctive, disjunctive) is not
+        # specified in this field – it is simply a listing of all licenses found
+        # Corresponds to the JSON property `filesLicenseInfo`
+        # @return [Array<String>]
+        attr_accessor :files_license_info
+      
+        # Provide a place for the SPDX file creator to record a web site that serves as
+        # the package's home page
+        # Corresponds to the JSON property `homePage`
+        # @return [String]
+        attr_accessor :home_page
+      
+        # License information: https://spdx.github.io/spdx-spec/3-package-information/#
+        # 315-declared-license
+        # Corresponds to the JSON property `licenseDeclared`
+        # @return [Google::Apis::ContaineranalysisV1beta1::License]
+        attr_accessor :license_declared
+      
+        # If the package identified in the SPDX file originated from a different person
+        # or organization than identified as Package Supplier, this field identifies
+        # from where or whom the package originally came
+        # Corresponds to the JSON property `originator`
+        # @return [String]
+        attr_accessor :originator
+      
+        # The type of package: OS, MAVEN, GO, GO_STDLIB, etc.
+        # Corresponds to the JSON property `packageType`
+        # @return [String]
+        attr_accessor :package_type
+      
+        # A short description of the package
+        # Corresponds to the JSON property `summaryDescription`
+        # @return [String]
+        attr_accessor :summary_description
+      
+        # Identify the actual distribution source for the package/directory identified
+        # in the SPDX file
+        # Corresponds to the JSON property `supplier`
+        # @return [String]
+        attr_accessor :supplier
+      
+        # Identify the full name of the package as given by the Package Originator
+        # Corresponds to the JSON property `title`
+        # @return [String]
+        attr_accessor :title
+      
+        # This field provides an independently reproducible mechanism identifying
+        # specific contents of a package based on the actual files (except the SPDX file
+        # itself, if it is included in the package) that make up each package and that
+        # correlates to the data in this SPDX file
+        # Corresponds to the JSON property `verificationCode`
+        # @return [String]
+        attr_accessor :verification_code
+      
+        # Identify the version of the package
+        # Corresponds to the JSON property `version`
+        # @return [String]
+        attr_accessor :version
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @analyzed = args[:analyzed] if args.key?(:analyzed)
+          @attribution = args[:attribution] if args.key?(:attribution)
+          @checksum = args[:checksum] if args.key?(:checksum)
+          @copyright = args[:copyright] if args.key?(:copyright)
+          @detailed_description = args[:detailed_description] if args.key?(:detailed_description)
+          @download_location = args[:download_location] if args.key?(:download_location)
+          @external_refs = args[:external_refs] if args.key?(:external_refs)
+          @files_license_info = args[:files_license_info] if args.key?(:files_license_info)
+          @home_page = args[:home_page] if args.key?(:home_page)
+          @license_declared = args[:license_declared] if args.key?(:license_declared)
+          @originator = args[:originator] if args.key?(:originator)
+          @package_type = args[:package_type] if args.key?(:package_type)
+          @summary_description = args[:summary_description] if args.key?(:summary_description)
+          @supplier = args[:supplier] if args.key?(:supplier)
+          @title = args[:title] if args.key?(:title)
+          @verification_code = args[:verification_code] if args.key?(:verification_code)
+          @version = args[:version] if args.key?(:version)
+        end
+      end
+      
+      # PackageInfoOccurrence represents an SPDX Package Information section: https://
+      # spdx.github.io/spdx-spec/3-package-information/
+      class PackageInfoOccurrence
+        include Google::Apis::Core::Hashable
+      
+        # A place for the SPDX file creator to record any general comments about the
+        # package being described
+        # Corresponds to the JSON property `comment`
+        # @return [String]
+        attr_accessor :comment
+      
+        # Provide the actual file name of the package, or path of the directory being
+        # treated as a package
+        # Corresponds to the JSON property `filename`
+        # @return [String]
+        attr_accessor :filename
+      
+        # Output only. Provide a place for the SPDX file creator to record a web site
+        # that serves as the package's home page
+        # Corresponds to the JSON property `homePage`
+        # @return [String]
+        attr_accessor :home_page
+      
+        # Uniquely identify any element in an SPDX document which may be referenced by
+        # other elements
+        # Corresponds to the JSON property `id`
+        # @return [String]
+        attr_accessor :id
+      
+        # License information: https://spdx.github.io/spdx-spec/3-package-information/#
+        # 315-declared-license
+        # Corresponds to the JSON property `licenseConcluded`
+        # @return [Google::Apis::ContaineranalysisV1beta1::License]
+        attr_accessor :license_concluded
+      
+        # Output only. The type of package: OS, MAVEN, GO, GO_STDLIB, etc.
+        # Corresponds to the JSON property `packageType`
+        # @return [String]
+        attr_accessor :package_type
+      
+        # Provide a place for the SPDX file creator to record any relevant background
+        # information or additional comments about the origin of the package
+        # Corresponds to the JSON property `sourceInfo`
+        # @return [String]
+        attr_accessor :source_info
+      
+        # Output only. A short description of the package
+        # Corresponds to the JSON property `summaryDescription`
+        # @return [String]
+        attr_accessor :summary_description
+      
+        # Output only. Identify the full name of the package as given by the Package
+        # Originator
+        # Corresponds to the JSON property `title`
+        # @return [String]
+        attr_accessor :title
+      
+        # Output only. Identify the version of the package
+        # Corresponds to the JSON property `version`
+        # @return [String]
+        attr_accessor :version
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @comment = args[:comment] if args.key?(:comment)
+          @filename = args[:filename] if args.key?(:filename)
+          @home_page = args[:home_page] if args.key?(:home_page)
+          @id = args[:id] if args.key?(:id)
+          @license_concluded = args[:license_concluded] if args.key?(:license_concluded)
+          @package_type = args[:package_type] if args.key?(:package_type)
+          @source_info = args[:source_info] if args.key?(:source_info)
+          @summary_description = args[:summary_description] if args.key?(:summary_description)
+          @title = args[:title] if args.key?(:title)
+          @version = args[:version] if args.key?(:version)
+        end
+      end
+      
       # This message wraps a location affected by a vulnerability and its associated
       # fix (if one is available).
       class PackageIssue
@@ -2336,11 +3025,23 @@ module Google
         # @return [Google::Apis::ContaineranalysisV1beta1::VulnerabilityLocation]
         attr_accessor :affected_location
       
+        # Output only. The distro or language system assigned severity for this
+        # vulnerability when that is available and note provider assigned severity when
+        # it is not available.
+        # Corresponds to the JSON property `effectiveSeverity`
+        # @return [String]
+        attr_accessor :effective_severity
+      
         # The location of the vulnerability.
         # Corresponds to the JSON property `fixedLocation`
         # @return [Google::Apis::ContaineranalysisV1beta1::VulnerabilityLocation]
         attr_accessor :fixed_location
       
+        # The type of package (e.g. OS, MAVEN, GO).
+        # Corresponds to the JSON property `packageType`
+        # @return [String]
+        attr_accessor :package_type
+      
         # Deprecated, use Details.effective_severity instead The severity (e.g., distro
         # assigned severity) for this vulnerability.
         # Corresponds to the JSON property `severityName`
@@ -2354,7 +3055,9 @@ module Google
         # Update properties of this object
         def update!(**args)
           @affected_location = args[:affected_location] if args.key?(:affected_location)
+          @effective_severity = args[:effective_severity] if args.key?(:effective_severity)
           @fixed_location = args[:fixed_location] if args.key?(:fixed_location)
+          @package_type = args[:package_type] if args.key?(:package_type)
           @severity_name = args[:severity_name] if args.key?(:severity_name)
         end
       end
@@ -2414,37 +3117,42 @@ module Google
       
       # An Identity and Access Management (IAM) policy, which specifies access
       # controls for Google Cloud resources. A `Policy` is a collection of `bindings`.
-      # A `binding` binds one or more `members` to a single `role`. Members can be
-      # user accounts, service accounts, Google groups, and domains (such as G Suite).
-      # A `role` is a named list of permissions; each `role` can be an IAM predefined
-      # role or a user-created custom role. For some types of Google Cloud resources,
-      # a `binding` can also specify a `condition`, which is a logical expression that
-      # allows access to a resource only if the expression evaluates to `true`. A
-      # condition can add constraints based on attributes of the request, the resource,
-      # or both. To learn which resources support conditions in their IAM policies,
-      # see the [IAM documentation](https://cloud.google.com/iam/help/conditions/
-      # resource-policies). **JSON example:** ` "bindings": [ ` "role": "roles/
-      # resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "
-      # group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@
-      # appspot.gserviceaccount.com" ] `, ` "role": "roles/resourcemanager.
-      # organizationViewer", "members": [ "user:eve@example.com" ], "condition": ` "
-      # title": "expirable access", "description": "Does not grant access after Sep
-      # 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", `
-      # ` ], "etag": "BwWWja0YfJA=", "version": 3 ` **YAML example:** bindings: -
-      # members: - user:mike@example.com - group:admins@example.com - domain:google.
-      # com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/
-      # resourcemanager.organizationAdmin - members: - user:eve@example.com role:
-      # roles/resourcemanager.organizationViewer condition: title: expirable access
-      # description: Does not grant access after Sep 2020 expression: request.time <
-      # timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a
-      # description of IAM and its features, see the [IAM documentation](https://cloud.
-      # google.com/iam/docs/).
+      # A `binding` binds one or more `members`, or principals, to a single `role`.
+      # Principals can be user accounts, service accounts, Google groups, and domains (
+      # such as G Suite). A `role` is a named list of permissions; each `role` can be
+      # an IAM predefined role or a user-created custom role. For some types of Google
+      # Cloud resources, a `binding` can also specify a `condition`, which is a
+      # logical expression that allows access to a resource only if the expression
+      # evaluates to `true`. A condition can add constraints based on attributes of
+      # the request, the resource, or both. To learn which resources support
+      # conditions in their IAM policies, see the [IAM documentation](https://cloud.
+      # google.com/iam/help/conditions/resource-policies). **JSON example:** ` "
+      # bindings": [ ` "role": "roles/resourcemanager.organizationAdmin", "members": [
+      # "user:mike@example.com", "group:admins@example.com", "domain:google.com", "
+      # serviceAccount:my-project-id@appspot.gserviceaccount.com" ] `, ` "role": "
+      # roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com"
+      # ], "condition": ` "title": "expirable access", "description": "Does not grant
+      # access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:
+      # 00:00.000Z')", ` ` ], "etag": "BwWWja0YfJA=", "version": 3 ` **YAML example:**
+      # bindings: - members: - user:mike@example.com - group:admins@example.com -
+      # domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com
+      # role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.
+      # com role: roles/resourcemanager.organizationViewer condition: title: expirable
+      # access description: Does not grant access after Sep 2020 expression: request.
+      # time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For
+      # a description of IAM and its features, see the [IAM documentation](https://
+      # cloud.google.com/iam/docs/).
       class Policy
         include Google::Apis::Core::Hashable
       
-        # Associates a list of `members` to a `role`. Optionally, may specify a `
-        # condition` that determines how and when the `bindings` are applied. Each of
-        # the `bindings` must contain at least one member.
+        # Associates a list of `members`, or principals, with a `role`. Optionally, may
+        # specify a `condition` that determines how and when the `bindings` are applied.
+        # Each of the `bindings` must contain at least one principal. The `bindings` in
+        # a `Policy` can refer to up to 1,500 principals; up to 250 of these principals
+        # can be Google groups. Each occurrence of a principal counts towards these
+        # limits. For example, if the `bindings` grant 50 different roles to `user:alice@
+        # example.com`, and not to any other principal, then you can add another 1,450
+        # principals to the `bindings` in the `Policy`.
         # Corresponds to the JSON property `bindings`
         # @return [Array<Google::Apis::ContaineranalysisV1beta1::Binding>]
         attr_accessor :bindings
@@ -2547,6 +3255,70 @@ module Google
         end
       end
       
+      # RelationshipNote represents an SPDX Relationship section: https://spdx.github.
+      # io/spdx-spec/7-relationships-between-SPDX-elements/
+      class RelationshipNote
+        include Google::Apis::Core::Hashable
+      
+        # The type of relationship between the source and target SPDX elements
+        # Corresponds to the JSON property `type`
+        # @return [String]
+        attr_accessor :type
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @type = args[:type] if args.key?(:type)
+        end
+      end
+      
+      # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.
+      # github.io/spdx-spec/7-relationships-between-SPDX-elements/
+      class RelationshipOccurrence
+        include Google::Apis::Core::Hashable
+      
+        # A place for the SPDX file creator to record any general comments about the
+        # relationship
+        # Corresponds to the JSON property `comment`
+        # @return [String]
+        attr_accessor :comment
+      
+        # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+        # Corresponds to the JSON property `source`
+        # @return [String]
+        attr_accessor :source
+      
+        # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In
+        # cases where there are "known unknowns", the use of the keyword NOASSERTION can
+        # be used The keywords NONE can be used to indicate that an SPDX element (
+        # package/file/snippet) has no other elements connected by some relationship to
+        # it
+        # Corresponds to the JSON property `target`
+        # @return [String]
+        attr_accessor :target
+      
+        # Output only. The type of relationship between the source and target SPDX
+        # elements
+        # Corresponds to the JSON property `type`
+        # @return [String]
+        attr_accessor :type
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @comment = args[:comment] if args.key?(:comment)
+          @source = args[:source] if args.key?(:source)
+          @target = args[:target] if args.key?(:target)
+          @type = args[:type] if args.key?(:type)
+        end
+      end
+      
       # A unique identifier for a Cloud Repo.
       class RepoId
         include Google::Apis::Core::Hashable
@@ -2659,31 +3431,31 @@ module Google
       
         # An Identity and Access Management (IAM) policy, which specifies access
         # controls for Google Cloud resources. A `Policy` is a collection of `bindings`.
-        # A `binding` binds one or more `members` to a single `role`. Members can be
-        # user accounts, service accounts, Google groups, and domains (such as G Suite).
-        # A `role` is a named list of permissions; each `role` can be an IAM predefined
-        # role or a user-created custom role. For some types of Google Cloud resources,
-        # a `binding` can also specify a `condition`, which is a logical expression that
-        # allows access to a resource only if the expression evaluates to `true`. A
-        # condition can add constraints based on attributes of the request, the resource,
-        # or both. To learn which resources support conditions in their IAM policies,
-        # see the [IAM documentation](https://cloud.google.com/iam/help/conditions/
-        # resource-policies). **JSON example:** ` "bindings": [ ` "role": "roles/
-        # resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "
-        # group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@
-        # appspot.gserviceaccount.com" ] `, ` "role": "roles/resourcemanager.
-        # organizationViewer", "members": [ "user:eve@example.com" ], "condition": ` "
-        # title": "expirable access", "description": "Does not grant access after Sep
-        # 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", `
-        # ` ], "etag": "BwWWja0YfJA=", "version": 3 ` **YAML example:** bindings: -
-        # members: - user:mike@example.com - group:admins@example.com - domain:google.
-        # com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/
-        # resourcemanager.organizationAdmin - members: - user:eve@example.com role:
-        # roles/resourcemanager.organizationViewer condition: title: expirable access
-        # description: Does not grant access after Sep 2020 expression: request.time <
-        # timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a
-        # description of IAM and its features, see the [IAM documentation](https://cloud.
-        # google.com/iam/docs/).
+        # A `binding` binds one or more `members`, or principals, to a single `role`.
+        # Principals can be user accounts, service accounts, Google groups, and domains (
+        # such as G Suite). A `role` is a named list of permissions; each `role` can be
+        # an IAM predefined role or a user-created custom role. For some types of Google
+        # Cloud resources, a `binding` can also specify a `condition`, which is a
+        # logical expression that allows access to a resource only if the expression
+        # evaluates to `true`. A condition can add constraints based on attributes of
+        # the request, the resource, or both. To learn which resources support
+        # conditions in their IAM policies, see the [IAM documentation](https://cloud.
+        # google.com/iam/help/conditions/resource-policies). **JSON example:** ` "
+        # bindings": [ ` "role": "roles/resourcemanager.organizationAdmin", "members": [
+        # "user:mike@example.com", "group:admins@example.com", "domain:google.com", "
+        # serviceAccount:my-project-id@appspot.gserviceaccount.com" ] `, ` "role": "
+        # roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com"
+        # ], "condition": ` "title": "expirable access", "description": "Does not grant
+        # access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:
+        # 00:00.000Z')", ` ` ], "etag": "BwWWja0YfJA=", "version": 3 ` **YAML example:**
+        # bindings: - members: - user:mike@example.com - group:admins@example.com -
+        # domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com
+        # role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.
+        # com role: roles/resourcemanager.organizationViewer condition: title: expirable
+        # access description: Does not grant access after Sep 2020 expression: request.
+        # time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For
+        # a description of IAM and its features, see the [IAM documentation](https://
+        # cloud.google.com/iam/docs/).
         # Corresponds to the JSON property `policy`
         # @return [Google::Apis::ContaineranalysisV1beta1::Policy]
         attr_accessor :policy
@@ -2962,6 +3734,31 @@ module Google
         end
       end
       
+      # Start and end times for a build execution phase.
+      class TimeSpan
+        include Google::Apis::Core::Hashable
+      
+        # End of time span.
+        # Corresponds to the JSON property `endTime`
+        # @return [String]
+        attr_accessor :end_time
+      
+        # Start of time span.
+        # Corresponds to the JSON property `startTime`
+        # @return [String]
+        attr_accessor :start_time
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @end_time = args[:end_time] if args.key?(:end_time)
+          @start_time = args[:start_time] if args.key?(:start_time)
+        end
+      end
+      
       # Version contains structured information about the version of a package.
       class Version
         include Google::Apis::Core::Hashable
@@ -3011,6 +3808,36 @@ module Google
         end
       end
       
+      # Volume describes a Docker container volume which is mounted into build steps
+      # in order to persist files across build step execution.
+      class Volume
+        include Google::Apis::Core::Hashable
+      
+        # Name of the volume to mount. Volume names must be unique per build step and
+        # must be valid names for Docker volumes. Each named volume must be used by at
+        # least two build steps.
+        # Corresponds to the JSON property `name`
+        # @return [String]
+        attr_accessor :name
+      
+        # Path at which to mount the volume. Paths must be absolute and cannot conflict
+        # with other volume paths on the same build step or with certain reserved volume
+        # paths.
+        # Corresponds to the JSON property `path`
+        # @return [String]
+        attr_accessor :path
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @name = args[:name] if args.key?(:name)
+          @path = args[:path] if args.key?(:path)
+        end
+      end
+      
       # Vulnerability provides metadata about a security vulnerability in a Note.
       class Vulnerability
         include Google::Apis::Core::Hashable