@google-cloud/containeranalysis 3.2.0 → 4.0.0

package/build/protos/grafeas/v1/intoto_provenance.proto

@@ -0,0 +1,113 @@
+// Copyright 2021 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package grafeas.v1;
+
+import "google/protobuf/any.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+option java_outer_classname = "InTotoProvenanceProto";
+
+// Spec defined at
+// https://github.com/in-toto/attestation/blob/main/spec/predicates/provenance.md
+
+// Steps taken to build the artifact.
+// For a TaskRun, typically each container corresponds to one step in the
+// recipe.
+message Recipe {
+  // URI indicating what type of recipe was performed. It determines the meaning
+  // of recipe.entryPoint, recipe.arguments, recipe.environment, and materials.
+  string type = 1;
+  // Index in materials containing the recipe steps that are not implied by
+  // recipe.type. For example, if the recipe type were "make", then this would
+  // point to the source containing the Makefile, not the make program itself.
+  // Set to -1 if the recipe doesn't come from a material, as zero is default
+  // unset value for int64.
+  int64 defined_in_material = 2;
+  // String identifying the entry point into the build.
+  // This is often a path to a configuration file and/or a target label within
+  // that file. The syntax and meaning are defined by recipe.type. For example,
+  // if the recipe type were "make", then this would reference the directory in
+  // which to run make as well as which target to use.
+  string entry_point = 3;
+  // Collection of all external inputs that influenced the build on top of
+  // recipe.definedInMaterial and recipe.entryPoint. For example, if the recipe
+  // type were "make", then this might be the flags passed to make aside from
+  // the target, which is captured in recipe.entryPoint. Since the arguments
+  // field can greatly vary in structure, depending on the builder and recipe
+  // type, this is of form "Any".
+  repeated google.protobuf.Any arguments = 4;
+  // Any other builder-controlled inputs necessary for correctly evaluating the
+  // recipe. Usually only needed for reproducing the build but not evaluated as
+  // part of policy. Since the environment field can greatly vary in structure,
+  // depending on the builder and recipe type, this is of form "Any".
+  repeated google.protobuf.Any environment = 5;
+}
+
+// Indicates that the builder claims certain fields in this message to be
+// complete.
+message Completeness {
+  // If true, the builder claims that recipe.arguments is complete, meaning that
+  // all external inputs are properly captured in the recipe.
+  bool arguments = 1;
+  // If true, the builder claims that recipe.environment is claimed to be
+  // complete.
+  bool environment = 2;
+  // If true, the builder claims that materials are complete, usually through
+  // some controls to prevent network access. Sometimes called "hermetic".
+  bool materials = 3;
+}
+
+// Other properties of the build.
+message Metadata {
+  // Identifies the particular build invocation, which can be useful for finding
+  // associated logs or other ad-hoc analysis. The value SHOULD be globally
+  // unique, per in-toto Provenance spec.
+  string build_invocation_id = 1;
+  // The timestamp of when the build started.
+  google.protobuf.Timestamp build_started_on = 2;
+  // The timestamp of when the build completed.
+  google.protobuf.Timestamp build_finished_on = 3;
+  // Indicates that the builder claims certain fields in this message to be
+  // complete.
+  Completeness completeness = 4;
+  // If true, the builder claims that running the recipe on materials will
+  // produce bit-for-bit identical output.
+  bool reproducible = 5;
+}
+
+message BuilderConfig {
+  string id = 1;
+}
+
+message InTotoProvenance {
+  BuilderConfig builder_config = 1;  // required
+  // Identifies the configuration used for the build.
+  // When combined with materials, this SHOULD fully describe the build,
+  // such that re-running this recipe results in bit-for-bit identical output
+  // (if the build is reproducible).
+  Recipe recipe = 2;  // required
+  Metadata metadata = 3;
+  // The collection of artifacts that influenced the build including sources,
+  // dependencies, build tools, base images, and so on. This is considered to be
+  // incomplete unless metadata.completeness.materials is true. Unset or null is
+  // equivalent to empty.
+  repeated string materials = 4;
+}

package/build/protos/grafeas/v1/intoto_statement.proto

@@ -0,0 +1,50 @@
+// Copyright 2021 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package grafeas.v1;
+
+import "grafeas/v1/intoto_provenance.proto";
+import "grafeas/v1/slsa_provenance.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+option java_outer_classname = "InTotoStatementProto";
+
+// Spec defined at
+// https://github.com/in-toto/attestation/tree/main/spec#statement The
+// serialized InTotoStatement will be stored as Envelope.payload.
+// Envelope.payloadType is always "application/vnd.in-toto+json".
+message InTotoStatement {
+  // Always `https://in-toto.io/Statement/v0.1`.
+  string type = 1 [json_name = "_type"];
+  repeated Subject subject = 2;
+  // `https://slsa.dev/provenance/v0.1` for SlsaProvenance.
+  string predicate_type = 3;
+  oneof predicate {
+    InTotoProvenance provenance = 4;
+    SlsaProvenance slsa_provenance = 5;
+  }
+}
+message Subject {
+  string name = 1;
+  // `"<ALGORITHM>": "<HEX_VALUE>"`
+  // Algorithms can be e.g. sha256, sha512
+  // See
+  // https://github.com/in-toto/attestation/blob/main/spec/field_types.md#DigestSet
+  map<string, string> digest = 2;
+}

package/build/protos/grafeas/v1/package.proto

@@ -102,6 +102,14 @@ message Version {
   // The iteration of the package build from the above version.
   string revision = 3;
 
+  // Whether this version is specifying part of an inclusive range. Grafeas
+  // does not have the capability to specify version ranges; instead we have
+  // fields that specify start version and end versions. At times this is
+  // insufficient - we also need to specify whether the version is included in
+  // the range or is excluded from the range. This boolean is expected to be set
+  // to true when the version is included in a range.
+  bool inclusive = 6;
+
   // Whether this is an ordinary package version or a sentinel MIN/MAX version.
   enum VersionKind {
     // Unknown.
@@ -112,7 +120,7 @@ message Version {
     MINIMUM = 2;
     // A special version representing positive infinity.
     MAXIMUM = 3;
-  };
+  }
 
   // Required. Distinguishes between sentinel MIN/MAX versions and normal
   // versions.

package/build/protos/grafeas/v1/severity.proto

@@ -0,0 +1,38 @@
+// Copyright 2021 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package grafeas.v1;
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+
+// Note provider assigned severity/impact ranking.
+enum Severity {
+  // Unknown.
+  SEVERITY_UNSPECIFIED = 0;
+  // Minimal severity.
+  MINIMAL = 1;
+  // Low severity.
+  LOW = 2;
+  // Medium severity.
+  MEDIUM = 3;
+  // High severity.
+  HIGH = 4;
+  // Critical severity.
+  CRITICAL = 5;
+}

package/build/protos/grafeas/v1/slsa_provenance.proto

@@ -0,0 +1,114 @@
+// Copyright 2021 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package grafeas.v1;
+
+import "google/protobuf/any.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+
+message SlsaProvenance {
+  // Steps taken to build the artifact.
+  // For a TaskRun, typically each container corresponds to one step in the
+  // recipe.
+  message SlsaRecipe {
+    // URI indicating what type of recipe was performed. It determines the
+    // meaning of recipe.entryPoint, recipe.arguments, recipe.environment, and
+    // materials.
+    string type = 1;
+    // Index in materials containing the recipe steps that are not implied by
+    // recipe.type. For example, if the recipe type were "make", then this would
+    // point to the source containing the Makefile, not the make program itself.
+    // Set to -1 if the recipe doesn't come from a material, as zero is default
+    // unset value for int64.
+    int64 defined_in_material = 2;
+    // String identifying the entry point into the build.
+    // This is often a path to a configuration file and/or a target label within
+    // that file. The syntax and meaning are defined by recipe.type. For
+    // example, if the recipe type were "make", then this would reference the
+    // directory in which to run make as well as which target to use.
+    string entry_point = 3;
+    // Collection of all external inputs that influenced the build on top of
+    // recipe.definedInMaterial and recipe.entryPoint. For example, if the
+    // recipe type were "make", then this might be the flags passed to make
+    // aside from the target, which is captured in recipe.entryPoint. Depending
+    // on the recipe Type, the structure may be different.
+    google.protobuf.Any arguments = 4;
+    // Any other builder-controlled inputs necessary for correctly evaluating
+    // the recipe. Usually only needed for reproducing the build but not
+    // evaluated as part of policy. Depending on the recipe Type, the structure
+    // may be different.
+    google.protobuf.Any environment = 5;
+  }
+
+  // Indicates that the builder claims certain fields in this message to be
+  // complete.
+  message SlsaCompleteness {
+    // If true, the builder claims that recipe.arguments is complete, meaning
+    // that all external inputs are properly captured in the recipe.
+    bool arguments = 1;
+    // If true, the builder claims that recipe.environment is claimed to be
+    // complete.
+    bool environment = 2;
+    // If true, the builder claims that materials are complete, usually through
+    // some controls to prevent network access. Sometimes called "hermetic".
+    bool materials = 3;
+  }
+
+  // Other properties of the build.
+  message SlsaMetadata {
+    // Identifies the particular build invocation, which can be useful for
+    // finding associated logs or other ad-hoc analysis. The value SHOULD be
+    // globally unique, per in-toto Provenance spec.
+    string build_invocation_id = 1;
+    // The timestamp of when the build started.
+    google.protobuf.Timestamp build_started_on = 2;
+    // The timestamp of when the build completed.
+    google.protobuf.Timestamp build_finished_on = 3;
+    // Indicates that the builder claims certain fields in this message to be
+    // complete.
+    SlsaCompleteness completeness = 4;
+    // If true, the builder claims that running the recipe on materials will
+    // produce bit-for-bit identical output.
+    bool reproducible = 5;
+  }
+
+  message SlsaBuilder {
+    string id = 1;
+  }
+
+  message Material {
+    string uri = 1;
+    map<string, string> digest = 2;
+  }
+
+  SlsaBuilder builder = 1;  // required
+  // Identifies the configuration used for the build.
+  // When combined with materials, this SHOULD fully describe the build,
+  // such that re-running this recipe results in bit-for-bit identical output
+  // (if the build is reproducible).
+  SlsaRecipe recipe = 2;  // required
+  SlsaMetadata metadata = 3;
+  // The collection of artifacts that influenced the build including sources,
+  // dependencies, build tools, base images, and so on. This is considered to be
+  // incomplete unless metadata.completeness.materials is true. Unset or null is
+  // equivalent to empty.
+  repeated Material materials = 4;
+}

package/build/protos/grafeas/v1/vulnerability.proto

@@ -16,32 +16,18 @@ syntax = "proto3";
 
 package grafeas.v1;
 
+import "google/api/field_behavior.proto";
 import "google/protobuf/timestamp.proto";
 import "grafeas/v1/common.proto";
 import "grafeas/v1/cvss.proto";
 import "grafeas/v1/package.proto";
+import "grafeas/v1/severity.proto";
 
 option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
 option java_multiple_files = true;
 option java_package = "io.grafeas.v1";
 option objc_class_prefix = "GRA";
 
-// Note provider assigned severity/impact ranking.
-enum Severity {
-  // Unknown.
-  SEVERITY_UNSPECIFIED = 0;
-  // Minimal severity.
-  MINIMAL = 1;
-  // Low severity.
-  LOW = 2;
-  // Medium severity.
-  MEDIUM = 3;
-  // High severity.
-  HIGH = 4;
-  // Critical severity.
-  CRITICAL = 5;
-}
-
 // A security vulnerability that can be found in resources.
 message VulnerabilityNote {
   // The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10
@@ -49,7 +35,7 @@ message VulnerabilityNote {
   float cvss_score = 1;
 
   // The note provider assigned severity of this vulnerability.
-  Severity severity = 2;
+  grafeas.v1.Severity severity = 2;
 
   // Details of all known distros and packages affected by this vulnerability.
   repeated Detail details = 3;
@@ -115,6 +101,12 @@ message VulnerabilityNote {
     // upstream timestamp from the underlying information source - e.g. Ubuntu
     // security tracker.
     google.protobuf.Timestamp source_update_time = 12;
+
+    // The source from which the information in this Detail was obtained.
+    string source = 13;
+
+    // The name of the vendor of the product.
+    string vendor = 14;
   }
 
   // The full description of the CVSSv3 for this vulnerability.
@@ -165,13 +157,16 @@ message VulnerabilityOccurrence {
   string type = 1;
 
   // Output only. The note provider assigned severity of this vulnerability.
-  Severity severity = 2;
+  grafeas.v1.Severity severity = 2;
 
   // Output only. The CVSS score of this vulnerability. CVSS score is on a
   // scale of 0 - 10 where 0 indicates low severity and 10 indicates high
   // severity.
   float cvss_score = 3;
 
+  // The cvss v3 score for the vulnerability.
+  CVSS cvssv3 = 10;
+
   // Required. The set of affected locations and their fixes (if available)
   // within the associated resource.
   repeated PackageIssue package_issue = 4;
@@ -205,6 +200,15 @@ message VulnerabilityOccurrence {
 
     // Output only. Whether a fix is available for this package.
     bool fix_available = 7;
+
+    // The type of package (e.g. OS, MAVEN, GO).
+    string package_type = 8;
+
+    // The distro or language system assigned severity for this vulnerability
+    // when that is available and note provider assigned severity when it is not
+    // available.
+    grafeas.v1.Severity effective_severity = 9
+        [(google.api.field_behavior) = OUTPUT_ONLY];
   }
 
   // Output only. A one sentence description of this vulnerability.
@@ -218,7 +222,15 @@ message VulnerabilityOccurrence {
 
   // The distro assigned severity for this vulnerability when it is available,
   // otherwise this is the note provider assigned severity.
-  Severity effective_severity = 8;
+  //
+  // When there are multiple PackageIssues for this vulnerability, they can have
+  // different effective severities because some might be provided by the distro
+  // while others are provided by the language ecosystem for a language pack.
+  // For this reason, it is advised to use the effective severity on the
+  // PackageIssue level. In the case where multiple PackageIssues have differing
+  // effective severities, this field should be the highest severity for any of
+  // the PackageIssues.
+  grafeas.v1.Severity effective_severity = 8;
 
   // Output only. Whether at least one of the affected packages has a fix
   // available.