@google-cloud/containeranalysis 3.1.8 → 3.4.0

package/CHANGELOG.md

@@ -4,6 +4,27 @@
 
 [1]: https://www.npmjs.com/package/@google-cloud/containeranalysis?activeTab=versions
 
+## [3.4.0](https://github.com/googleapis/nodejs-containeranalysis/compare/v3.3.0...v3.4.0) (2022-04-05)
+
+
+### Features
+
+* AuditConfig for IAM v1 ([#388](https://github.com/googleapis/nodejs-containeranalysis/issues/388)) ([f4d14d7](https://github.com/googleapis/nodejs-containeranalysis/commit/f4d14d7734054b8bd7037b189e7af1876e119f51))
+
+## [3.3.0](https://www.github.com/googleapis/nodejs-containeranalysis/compare/v3.2.0...v3.3.0) (2021-11-11)
+
+
+### Features
+
+* Updating the grafeas protos to include compliance and intoto attestation protos ([#352](https://www.github.com/googleapis/nodejs-containeranalysis/issues/352)) ([ea334fb](https://www.github.com/googleapis/nodejs-containeranalysis/commit/ea334fb38ba769af3e7473db9414db0850d2bbdb))
+
+## [3.2.0](https://www.github.com/googleapis/nodejs-containeranalysis/compare/v3.1.8...v3.2.0) (2021-08-23)
+
+
+### Features
+
+* turns on self-signed JWT feature flag ([#339](https://www.github.com/googleapis/nodejs-containeranalysis/issues/339)) ([98de66a](https://www.github.com/googleapis/nodejs-containeranalysis/commit/98de66a7ad503a0b1e5f4d3f8fd94f49ac156dfa))
+
 ### [3.1.8](https://www.github.com/googleapis/nodejs-containeranalysis/compare/v3.1.7...v3.1.8) (2021-08-17)
 
 

package/README.md

@@ -4,9 +4,8 @@
 
 # [Google Container Analysis: Node.js Client](https://github.com/googleapis/nodejs-containeranalysis)
 
-[![release level](https://img.shields.io/badge/release%20level-general%20availability%20%28GA%29-brightgreen.svg?style=flat)](https://cloud.google.com/terms/launch-stages)
+[![release level](https://img.shields.io/badge/release%20level-stable-brightgreen.svg?style=flat)](https://cloud.google.com/terms/launch-stages)
 [![npm version](https://img.shields.io/npm/v/@google-cloud/containeranalysis.svg)](https://www.npmjs.org/package/@google-cloud/containeranalysis)
-[![codecov](https://img.shields.io/codecov/c/github/googleapis/nodejs-containeranalysis/main.svg?style=flat)](https://codecov.io/gh/googleapis/nodejs-containeranalysis)
 
 
 
@@ -136,37 +135,38 @@ also contains samples.
 Our client libraries follow the [Node.js release schedule](https://nodejs.org/en/about/releases/).
 Libraries are compatible with all current _active_ and _maintenance_ versions of
 Node.js.
+If you are using an end-of-life version of Node.js, we recommend that you update
+as soon as possible to an actively supported LTS version.
 
-Client libraries targeting some end-of-life versions of Node.js are available, and
-can be installed via npm [dist-tags](https://docs.npmjs.com/cli/dist-tag).
-The dist-tags follow the naming convention `legacy-(version)`.
-
-_Legacy Node.js versions are supported as a best effort:_
-
-* Legacy versions will not be tested in continuous integration.
-* Some security patches may not be able to be backported.
-* Dependencies will not be kept up-to-date, and features will not be backported.
+Google's client libraries support legacy versions of Node.js runtimes on a
+best-efforts basis with the following warnings:
 
-#### Legacy tags available
+* Legacy versions are not tested in continuous integration.
+* Some security patches and features cannot be backported.
+* Dependencies cannot be kept up-to-date.
 
-* `legacy-8`: install client libraries from this dist-tag for versions
-  compatible with Node.js 8.
+Client libraries targeting some end-of-life versions of Node.js are available, and
+can be installed through npm [dist-tags](https://docs.npmjs.com/cli/dist-tag).
+The dist-tags follow the naming convention `legacy-(version)`.
+For example, `npm install @google-cloud/containeranalysis@legacy-8` installs client libraries
+for versions compatible with Node.js 8.
 
 ## Versioning
 
 This library follows [Semantic Versioning](http://semver.org/).
 
 
-This library is considered to be **General Availability (GA)**. This means it
-is stable; the code surface will not change in backwards-incompatible ways
+
+This library is considered to be **stable**. The code surface will not change in backwards-incompatible ways
 unless absolutely necessary (e.g. because of critical security issues) or with
-an extensive deprecation period. Issues and requests against **GA** libraries
+an extensive deprecation period. Issues and requests against **stable** libraries
 are addressed with the highest priority.
 
 
 
 
 
+
 More Information: [Google Cloud Platform Launch Stages][launch_stages]
 
 [launch_stages]: https://cloud.google.com/terms/launch-stages

package/build/protos/google/devtools/containeranalysis/v1/containeranalysis.proto

@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2021 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -23,7 +23,9 @@ import "google/api/resource.proto";
 import "google/iam/v1/iam_policy.proto";
 import "google/iam/v1/policy.proto";
 import "google/protobuf/timestamp.proto";
-import "grafeas/v1/vulnerability.proto";
+import "grafeas/v1/common.proto";
+import "grafeas/v1/grafeas.proto";
+import "grafeas/v1/severity.proto";
 
 option csharp_namespace = "Google.Cloud.DevTools.ContainerAnalysis.V1";
 option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1;containeranalysis";
@@ -48,8 +50,7 @@ option php_namespace = "Google\\Cloud\\ContainerAnalysis\\V1";
 // image with the vulnerability referring to that note.
 service ContainerAnalysis {
   option (google.api.default_host) = "containeranalysis.googleapis.com";
-  option (google.api.oauth_scopes) =
-      "https://www.googleapis.com/auth/cloud-platform";
+  option (google.api.oauth_scopes) = "https://www.googleapis.com/auth/cloud-platform";
 
   // Sets the access control policy on the specified note or occurrence.
   // Requires `containeranalysis.notes.setIamPolicy` or
@@ -59,8 +60,7 @@ service ContainerAnalysis {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest)
-      returns (google.iam.v1.Policy) {
+  rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest) returns (google.iam.v1.Policy) {
     option (google.api.http) = {
       post: "/v1/{resource=projects/*/notes/*}:setIamPolicy"
       body: "*"
@@ -80,8 +80,7 @@ service ContainerAnalysis {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest)
-      returns (google.iam.v1.Policy) {
+  rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest) returns (google.iam.v1.Policy) {
     option (google.api.http) = {
       post: "/v1/{resource=projects/*/notes/*}:getIamPolicy"
       body: "*"
@@ -100,8 +99,7 @@ service ContainerAnalysis {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest)
-      returns (google.iam.v1.TestIamPermissionsResponse) {
+  rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest) returns (google.iam.v1.TestIamPermissionsResponse) {
     option (google.api.http) = {
       post: "/v1/{resource=projects/*/notes/*}:testIamPermissions"
       body: "*"
@@ -114,9 +112,7 @@ service ContainerAnalysis {
   }
 
   // Gets a summary of the number and severity of occurrences.
-  rpc GetVulnerabilityOccurrencesSummary(
-      GetVulnerabilityOccurrencesSummaryRequest)
-      returns (VulnerabilityOccurrencesSummary) {
+  rpc GetVulnerabilityOccurrencesSummary(GetVulnerabilityOccurrencesSummaryRequest) returns (VulnerabilityOccurrencesSummary) {
     option (google.api.http) = {
       get: "/v1/{parent=projects/*}/occurrences:vulnerabilitySummary"
     };
@@ -126,12 +122,13 @@ service ContainerAnalysis {
 
 // Request to get a vulnerability summary for some set of occurrences.
 message GetVulnerabilityOccurrencesSummaryRequest {
-  // The name of the project to get a vulnerability summary for in the form of
+  // Required. The name of the project to get a vulnerability summary for in the form of
   // `projects/[PROJECT_ID]`.
   string parent = 1 [
-    (google.api.resource_reference).type =
-        "cloudresourcemanager.googleapis.com/Project",
-    (google.api.field_behavior) = REQUIRED
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudresourcemanager.googleapis.com/Project"
+    }
   ];
 
   // The filter expression.

package/build/protos/grafeas/v1/attestation.proto

@@ -53,6 +53,13 @@ message AttestationNote {
   Hint hint = 1;
 }
 
+message Jwt {
+  // The compact encoding of a JWS, which is always three base64 encoded strings
+  // joined by periods. For details, see:
+  // https://tools.ietf.org/html/rfc7515.html#section-3.1
+  string compact_jwt = 1;
+}
+
 // Occurrence that represents a single "attestation". The authenticity of an
 // attestation can be verified using the attached signature. If the verifier
 // trusts the public key of the signer, then verifying the signature is
@@ -70,4 +77,14 @@ message AttestationOccurrence {
   // `signature` verifies `serialized_payload`.  See `Signature` in common.proto
   // for more details on signature structure and verification.
   repeated Signature signatures = 2;
+  // One or more JWTs encoding a self-contained attestation.
+  // Each JWT encodes the payload that it verifies within the JWT itself.
+  // Verifier implementation SHOULD ignore the `serialized_payload` field
+  // when verifying these JWTs.
+  // If only JWTs are present on this AttestationOccurrence, then the
+  // `serialized_payload` SHOULD be left empty.
+  // Each JWT SHOULD encode a claim specific to the `resource_uri` of this
+  // Occurrence, but this is not validated by Grafeas metadata API
+  // implementations.  The JWT itself is opaque to Grafeas.
+  repeated Jwt jwts = 3;
 }

package/build/protos/grafeas/v1/build.proto

@@ -16,6 +16,8 @@ syntax = "proto3";
 
 package grafeas.v1;
 
+import "grafeas/v1/intoto_provenance.proto";
+import "grafeas/v1/intoto_statement.proto";
 import "grafeas/v1/provenance.proto";
 
 option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
@@ -32,7 +34,7 @@ message BuildNote {
 
 // Details of a build occurrence.
 message BuildOccurrence {
-  // Required. The actual provenance for the build.
+  // The actual provenance for the build.
   grafeas.v1.BuildProvenance provenance = 1;
 
   // Serialized JSON representation of the provenance, used in generating the
@@ -47,4 +49,14 @@ message BuildOccurrence {
   // provenance is marshalled to json as well to prevent incompatibilities with
   // future changes.
   string provenance_bytes = 2;
+
+  // Deprecated. See InTotoStatement for the replacement.
+  // In-toto Provenance representation as defined in spec.
+  InTotoProvenance intoto_provenance = 3;
+
+  // In-toto Statement representation as defined in spec.
+  // The intoto_statement can contain any type of provenance. The serialized
+  // payload of the statement can be stored and signed in the Occurrence's
+  // envelope.
+  InTotoStatement intoto_statement = 4;
 }

package/build/protos/grafeas/v1/common.proto

@@ -23,7 +23,7 @@ option objc_class_prefix = "GRA";
 
 // Kind represents the kinds of notes supported.
 enum NoteKind {
-  // Unknown.
+  // Default value. This value is unused.
   NOTE_KIND_UNSPECIFIED = 0;
   // The note and occurrence represent a package vulnerability.
   VULNERABILITY = 1;
@@ -41,6 +41,10 @@ enum NoteKind {
   ATTESTATION = 7;
   // This represents an available package upgrade.
   UPGRADE = 8;
+  // This represents a Compliance Note
+  COMPLIANCE = 9;
+  // This represents a DSSE attestation Note
+  DSSE_ATTESTATION = 10;
 }
 
 // Metadata for any related URL information.
@@ -84,7 +88,7 @@ message Signature {
 
   // The identifier for the public key that verifies this signature.
   //   * The `public_key_id` is required.
-  //   * The `public_key_id` MUST be an RFC3986 conformant URI.
+  //   * The `public_key_id` SHOULD be an RFC3986 conformant URI.
   //   * When possible, the `public_key_id` SHOULD be an immutable reference,
   //     such as a cryptographic digest.
   //
@@ -101,3 +105,17 @@ message Signature {
   //   * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
   string public_key_id = 2;
 }
+
+// MUST match
+// https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An
+// authenticated message of arbitrary type.
+message Envelope {
+  bytes payload = 1;
+  string payload_type = 2;
+  repeated EnvelopeSignature signatures = 3;
+}
+
+message EnvelopeSignature {
+  bytes sig = 1;
+  string keyid = 2;
+}

package/build/protos/grafeas/v1/compliance.proto

@@ -0,0 +1,79 @@
+// Copyright 2021 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package grafeas.v1;
+
+import "grafeas/v1/severity.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+
+message ComplianceNote {
+  // The title that identifies this compliance check.
+  string title = 1;
+  // A description about this compliance check.
+  string description = 2;
+  // The OS and config versions the benchmark applies to.
+  repeated grafeas.v1.ComplianceVersion version = 3;
+  // A rationale for the existence of this compliance check.
+  string rationale = 4;
+  // A description of remediation steps if the compliance check fails.
+  string remediation = 5;
+  // A compliance check that is a CIS benchmark.
+  message CisBenchmark {
+    int32 profile_level = 1;
+    grafeas.v1.Severity severity = 2;
+  }
+  oneof compliance_type {
+    CisBenchmark cis_benchmark = 6;
+  }
+  // Serialized scan instructions with a predefined format.
+  bytes scan_instructions = 7;
+}
+
+// Describes the CIS benchmark version that is applicable to a given OS and
+// os version.
+message ComplianceVersion {
+  // The CPE URI (https://cpe.mitre.org/specification/) this benchmark is
+  // applicable to.
+  string cpe_uri = 1;
+  // The version of the benchmark. This is set to the version of the OS-specific
+  // CIS document the benchmark is defined in.
+  string version = 2;
+}
+
+// An indication that the compliance checks in the associated ComplianceNote
+// were not satisfied for particular resources or a specified reason.
+message ComplianceOccurrence {
+  repeated NonCompliantFile non_compliant_files = 2;
+  string non_compliance_reason = 3;
+}
+
+// Details about files that caused a compliance check to fail.
+message NonCompliantFile {
+  // display_command is a single command that can be used to display a list of
+  // non compliant files. When there is no such command, we can also iterate a
+  // list of non compliant file using 'path'.
+
+  // Empty if `display_command` is set.
+  string path = 1;
+  // Command to display the non-compliant files.
+  string display_command = 2;
+  // Explains why a file is non compliant for a CIS check.
+  string reason = 3;
+}

package/build/protos/grafeas/v1/cvss.proto

@@ -19,6 +19,7 @@ package grafeas.v1;
 option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
 option java_multiple_files = true;
 option java_package = "io.grafeas.v1";
+option java_outer_classname = "CvssProto";
 option objc_class_prefix = "GRA";
 
 // Common Vulnerability Scoring System version 3.
@@ -83,3 +84,78 @@ message CVSSv3 {
     IMPACT_NONE = 3;
   }
 }
+
+// Common Vulnerability Scoring System.
+// For details, see https://www.first.org/cvss/specification-document
+// This is a message we will try to use for storing multiple versions of
+// CVSS. The intention is that as new versions of CVSS scores get added, we
+// will be able to modify this message rather than adding new protos for each
+// new version of the score.
+message CVSS {
+  // The base score is a function of the base metric scores.
+  float base_score = 1;
+
+  float exploitability_score = 2;
+
+  float impact_score = 3;
+
+  // Base Metrics
+  // Represents the intrinsic characteristics of a vulnerability that are
+  // constant over time and across user environments.
+  AttackVector attack_vector = 4;
+  AttackComplexity attack_complexity = 5;
+  Authentication authentication = 6;
+  PrivilegesRequired privileges_required = 7;
+  UserInteraction user_interaction = 8;
+  Scope scope = 9;
+  Impact confidentiality_impact = 10;
+  Impact integrity_impact = 11;
+  Impact availability_impact = 12;
+
+  enum AttackVector {
+    ATTACK_VECTOR_UNSPECIFIED = 0;
+    ATTACK_VECTOR_NETWORK = 1;
+    ATTACK_VECTOR_ADJACENT = 2;
+    ATTACK_VECTOR_LOCAL = 3;
+    ATTACK_VECTOR_PHYSICAL = 4;
+  }
+
+  enum AttackComplexity {
+    ATTACK_COMPLEXITY_UNSPECIFIED = 0;
+    ATTACK_COMPLEXITY_LOW = 1;
+    ATTACK_COMPLEXITY_HIGH = 2;
+  }
+
+  enum Authentication {
+    AUTHENTICATION_UNSPECIFIED = 0;
+    AUTHENTICATION_MULTIPLE = 1;
+    AUTHENTICATION_SINGLE = 2;
+    AUTHENTICATION_NONE = 3;
+  }
+
+  enum PrivilegesRequired {
+    PRIVILEGES_REQUIRED_UNSPECIFIED = 0;
+    PRIVILEGES_REQUIRED_NONE = 1;
+    PRIVILEGES_REQUIRED_LOW = 2;
+    PRIVILEGES_REQUIRED_HIGH = 3;
+  }
+
+  enum UserInteraction {
+    USER_INTERACTION_UNSPECIFIED = 0;
+    USER_INTERACTION_NONE = 1;
+    USER_INTERACTION_REQUIRED = 2;
+  }
+
+  enum Scope {
+    SCOPE_UNSPECIFIED = 0;
+    SCOPE_UNCHANGED = 1;
+    SCOPE_CHANGED = 2;
+  }
+
+  enum Impact {
+    IMPACT_UNSPECIFIED = 0;
+    IMPACT_HIGH = 1;
+    IMPACT_LOW = 2;
+    IMPACT_NONE = 3;
+  }
+}

package/build/protos/grafeas/v1/discovery.proto

@@ -16,6 +16,7 @@ syntax = "proto3";
 
 package grafeas.v1;
 
+import "google/api/field_behavior.proto";
 import "google/protobuf/timestamp.proto";
 import "google/rpc/status.proto";
 import "grafeas/v1/common.proto";
@@ -80,4 +81,8 @@ message DiscoveryOccurrence {
 
   // The last time this resource was scanned.
   google.protobuf.Timestamp last_scan_time = 5;
+
+  // The time occurrences related to this discovery occurrence were archived.
+  google.protobuf.Timestamp archive_time = 6
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 }

package/build/protos/grafeas/v1/dsse_attestation.proto

@@ -0,0 +1,52 @@
+// Copyright 2021 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+syntax = "proto3";
+
+package grafeas.v1;
+
+import "grafeas/v1/common.proto";
+import "grafeas/v1/intoto_statement.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+
+message DSSEAttestationNote {
+  // This submessage provides human-readable hints about the purpose of the
+  // authority. Because the name of a note acts as its resource reference, it is
+  // important to disambiguate the canonical name of the Note (which might be a
+  // UUID for security purposes) from "readable" names more suitable for debug
+  // output. Note that these hints should not be used to look up authorities in
+  // security sensitive contexts, such as when looking up attestations to
+  // verify.
+  message DSSEHint {
+    // Required. The human readable name of this attestation authority, for
+    // example "cloudbuild-prod".
+    string human_readable_name = 1;
+  }
+  // DSSEHint hints at the purpose of the attestation authority.
+  DSSEHint hint = 1;
+}
+
+// Deprecated. Prefer to use a regular Occurrence, and populate the
+// Envelope at the top level of the Occurrence.
+message DSSEAttestationOccurrence {
+  // If doing something security critical, make sure to verify the signatures in
+  // this metadata.
+  Envelope envelope = 1;
+  oneof decoded_payload {
+    InTotoStatement statement = 2;
+  }
+}

package/build/protos/grafeas/v1/grafeas.proto

@@ -26,8 +26,10 @@ import "google/protobuf/timestamp.proto";
 import "grafeas/v1/attestation.proto";
 import "grafeas/v1/build.proto";
 import "grafeas/v1/common.proto";
+import "grafeas/v1/compliance.proto";
 import "grafeas/v1/deployment.proto";
 import "grafeas/v1/discovery.proto";
+import "grafeas/v1/dsse_attestation.proto";
 import "grafeas/v1/image.proto";
 import "grafeas/v1/package.proto";
 import "grafeas/v1/upgrade.proto";
@@ -242,7 +244,14 @@ message Occurrence {
     grafeas.v1.AttestationOccurrence attestation = 14;
     // Describes an available package upgrade on the linked resource.
     grafeas.v1.UpgradeOccurrence upgrade = 15;
+    // Describes a compliance violation on a linked resource.
+    grafeas.v1.ComplianceOccurrence compliance = 16;
+    // Describes an attestation of an artifact using dsse.
+    grafeas.v1.DSSEAttestationOccurrence dsse_attestation = 17;
   }
+
+  // https://github.com/secure-systems-lab/dsse
+  grafeas.v1.Envelope envelope = 18;
 }
 
 // A type of analysis that can be done for a resource.
@@ -301,6 +310,10 @@ message Note {
     grafeas.v1.AttestationNote attestation = 16;
     // A note describing available package upgrades.
     grafeas.v1.UpgradeNote upgrade = 17;
+    // A note describing a compliance check.
+    grafeas.v1.ComplianceNote compliance = 18;
+    // A note describing a dsse attestation note.
+    grafeas.v1.DSSEAttestationNote dsse_attestation = 19;
   }
 }