@google-cloud/containeranalysis 3.3.0 → 4.1.0

package/CHANGELOG.md

@@ -4,6 +4,41 @@
 
 [1]: https://www.npmjs.com/package/@google-cloud/containeranalysis?activeTab=versions
 
+## [4.1.0](https://github.com/googleapis/nodejs-containeranalysis/compare/v4.0.0...v4.1.0) (2022-06-10)
+
+
+### Features
+
+* Import of Grafeas from Github ([#413](https://github.com/googleapis/nodejs-containeranalysis/issues/413)) ([fda2b32](https://github.com/googleapis/nodejs-containeranalysis/commit/fda2b3218680d9f0b81435ba9913d150eeded826))
+
+
+### Bug Fixes
+
+* **deps:** update dependency @google-cloud/pubsub to v3 ([#410](https://github.com/googleapis/nodejs-containeranalysis/issues/410)) ([fb503c8](https://github.com/googleapis/nodejs-containeranalysis/commit/fb503c89c6e0b8af7c4a4c60cddae7cf8727bd2b))
+
+## [4.0.0](https://github.com/googleapis/nodejs-containeranalysis/compare/v3.4.0...v4.0.0) (2022-05-17)
+
+
+### ⚠ BREAKING CHANGES
+
+* update library to use Node 12 (#408)
+
+### Bug Fixes
+
+* Flaky pubsub test ([#394](https://github.com/googleapis/nodejs-containeranalysis/issues/394)) ([eb74ba8](https://github.com/googleapis/nodejs-containeranalysis/commit/eb74ba886c2a3397d57b3f99fca0fe1df1216f2d))
+
+
+### Build System
+
+* update library to use Node 12 ([#408](https://github.com/googleapis/nodejs-containeranalysis/issues/408)) ([4aeecf8](https://github.com/googleapis/nodejs-containeranalysis/commit/4aeecf8ea7c476aa3dab167766121eeec7346a85))
+
+## [3.4.0](https://github.com/googleapis/nodejs-containeranalysis/compare/v3.3.0...v3.4.0) (2022-04-05)
+
+
+### Features
+
+* AuditConfig for IAM v1 ([#388](https://github.com/googleapis/nodejs-containeranalysis/issues/388)) ([f4d14d7](https://github.com/googleapis/nodejs-containeranalysis/commit/f4d14d7734054b8bd7037b189e7af1876e119f51))
+
 ## [3.3.0](https://www.github.com/googleapis/nodejs-containeranalysis/compare/v3.2.0...v3.3.0) (2021-11-11)
 
 

package/README.md

@@ -4,9 +4,8 @@
 
 # [Google Container Analysis: Node.js Client](https://github.com/googleapis/nodejs-containeranalysis)
 
-[![release level](https://img.shields.io/badge/release%20level-general%20availability%20%28GA%29-brightgreen.svg?style=flat)](https://cloud.google.com/terms/launch-stages)
+[![release level](https://img.shields.io/badge/release%20level-stable-brightgreen.svg?style=flat)](https://cloud.google.com/terms/launch-stages)
 [![npm version](https://img.shields.io/npm/v/@google-cloud/containeranalysis.svg)](https://www.npmjs.org/package/@google-cloud/containeranalysis)
-[![codecov](https://img.shields.io/codecov/c/github/googleapis/nodejs-containeranalysis/main.svg?style=flat)](https://codecov.io/gh/googleapis/nodejs-containeranalysis)
 
 
 
@@ -136,37 +135,38 @@ also contains samples.
 Our client libraries follow the [Node.js release schedule](https://nodejs.org/en/about/releases/).
 Libraries are compatible with all current _active_ and _maintenance_ versions of
 Node.js.
+If you are using an end-of-life version of Node.js, we recommend that you update
+as soon as possible to an actively supported LTS version.
 
-Client libraries targeting some end-of-life versions of Node.js are available, and
-can be installed via npm [dist-tags](https://docs.npmjs.com/cli/dist-tag).
-The dist-tags follow the naming convention `legacy-(version)`.
-
-_Legacy Node.js versions are supported as a best effort:_
-
-* Legacy versions will not be tested in continuous integration.
-* Some security patches may not be able to be backported.
-* Dependencies will not be kept up-to-date, and features will not be backported.
+Google's client libraries support legacy versions of Node.js runtimes on a
+best-efforts basis with the following warnings:
 
-#### Legacy tags available
+* Legacy versions are not tested in continuous integration.
+* Some security patches and features cannot be backported.
+* Dependencies cannot be kept up-to-date.
 
-* `legacy-8`: install client libraries from this dist-tag for versions
-  compatible with Node.js 8.
+Client libraries targeting some end-of-life versions of Node.js are available, and
+can be installed through npm [dist-tags](https://docs.npmjs.com/cli/dist-tag).
+The dist-tags follow the naming convention `legacy-(version)`.
+For example, `npm install @google-cloud/containeranalysis@legacy-8` installs client libraries
+for versions compatible with Node.js 8.
 
 ## Versioning
 
 This library follows [Semantic Versioning](http://semver.org/).
 
 
-This library is considered to be **General Availability (GA)**. This means it
-is stable; the code surface will not change in backwards-incompatible ways
+
+This library is considered to be **stable**. The code surface will not change in backwards-incompatible ways
 unless absolutely necessary (e.g. because of critical security issues) or with
-an extensive deprecation period. Issues and requests against **GA** libraries
+an extensive deprecation period. Issues and requests against **stable** libraries
 are addressed with the highest priority.
 
 
 
 
 
+
 More Information: [Google Cloud Platform Launch Stages][launch_stages]
 
 [launch_stages]: https://cloud.google.com/terms/launch-stages

package/build/protos/google/devtools/containeranalysis/v1/containeranalysis.proto

@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2021 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -22,8 +22,7 @@ import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
 import "google/iam/v1/iam_policy.proto";
 import "google/iam/v1/policy.proto";
-import "google/protobuf/timestamp.proto";
-import "grafeas/v1/vulnerability.proto";
+import "grafeas/v1/severity.proto";
 
 option csharp_namespace = "Google.Cloud.DevTools.ContainerAnalysis.V1";
 option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1;containeranalysis";
@@ -48,8 +47,7 @@ option php_namespace = "Google\\Cloud\\ContainerAnalysis\\V1";
 // image with the vulnerability referring to that note.
 service ContainerAnalysis {
   option (google.api.default_host) = "containeranalysis.googleapis.com";
-  option (google.api.oauth_scopes) =
-      "https://www.googleapis.com/auth/cloud-platform";
+  option (google.api.oauth_scopes) = "https://www.googleapis.com/auth/cloud-platform";
 
   // Sets the access control policy on the specified note or occurrence.
   // Requires `containeranalysis.notes.setIamPolicy` or
@@ -59,8 +57,7 @@ service ContainerAnalysis {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest)
-      returns (google.iam.v1.Policy) {
+  rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest) returns (google.iam.v1.Policy) {
     option (google.api.http) = {
       post: "/v1/{resource=projects/*/notes/*}:setIamPolicy"
       body: "*"
@@ -80,8 +77,7 @@ service ContainerAnalysis {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest)
-      returns (google.iam.v1.Policy) {
+  rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest) returns (google.iam.v1.Policy) {
     option (google.api.http) = {
       post: "/v1/{resource=projects/*/notes/*}:getIamPolicy"
       body: "*"
@@ -100,8 +96,7 @@ service ContainerAnalysis {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest)
-      returns (google.iam.v1.TestIamPermissionsResponse) {
+  rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest) returns (google.iam.v1.TestIamPermissionsResponse) {
     option (google.api.http) = {
       post: "/v1/{resource=projects/*/notes/*}:testIamPermissions"
       body: "*"
@@ -114,9 +109,7 @@ service ContainerAnalysis {
   }
 
   // Gets a summary of the number and severity of occurrences.
-  rpc GetVulnerabilityOccurrencesSummary(
-      GetVulnerabilityOccurrencesSummaryRequest)
-      returns (VulnerabilityOccurrencesSummary) {
+  rpc GetVulnerabilityOccurrencesSummary(GetVulnerabilityOccurrencesSummaryRequest) returns (VulnerabilityOccurrencesSummary) {
     option (google.api.http) = {
       get: "/v1/{parent=projects/*}/occurrences:vulnerabilitySummary"
     };
@@ -126,12 +119,13 @@ service ContainerAnalysis {
 
 // Request to get a vulnerability summary for some set of occurrences.
 message GetVulnerabilityOccurrencesSummaryRequest {
-  // The name of the project to get a vulnerability summary for in the form of
+  // Required. The name of the project to get a vulnerability summary for in the form of
   // `projects/[PROJECT_ID]`.
   string parent = 1 [
-    (google.api.resource_reference).type =
-        "cloudresourcemanager.googleapis.com/Project",
-    (google.api.field_behavior) = REQUIRED
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudresourcemanager.googleapis.com/Project"
+    }
   ];
 
   // The filter expression.

package/build/protos/grafeas/v1/common.proto

@@ -119,3 +119,32 @@ message EnvelopeSignature {
   bytes sig = 1;
   string keyid = 2;
 }
+
+// Indicates the location at which a package was found.
+message FileLocation {
+  // For jars that are contained inside .war files, this filepath
+  // can indicate the path to war file combined with the path to jar file.
+  string file_path = 1;
+}
+
+// License information.
+message License {
+  // Often a single license can be used to represent the licensing terms.
+  // Sometimes it is necessary to include a choice of one or more licenses
+  // or some combination of license identifiers.
+  // Examples: "LGPL-2.1-only OR MIT", "LGPL-2.1-only AND MIT",
+  // "GPL-2.0-or-later WITH Bison-exception-2.2".
+  string expression = 1;
+
+  // Comments
+  string comments = 2;
+}
+
+// Digest information.
+message Digest {
+  // `SHA1`, `SHA512` etc.
+  string algo = 1;
+
+  // Value of the digest.
+  bytes digest_bytes = 2;
+}

package/build/protos/grafeas/v1/compliance.proto

@@ -16,7 +16,7 @@ syntax = "proto3";
 
 package grafeas.v1;
 
-import "grafeas/v1/vulnerability.proto";
+import "grafeas/v1/severity.proto";
 
 option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
 option java_multiple_files = true;
@@ -52,6 +52,9 @@ message ComplianceVersion {
   // The CPE URI (https://cpe.mitre.org/specification/) this benchmark is
   // applicable to.
   string cpe_uri = 1;
+  // The name of the document that defines this benchmark, e.g. "CIS
+  // Container-Optimized OS".
+  string benchmark_document = 3;
   // The version of the benchmark. This is set to the version of the OS-specific
   // CIS document the benchmark is defined in.
   string version = 2;

package/build/protos/grafeas/v1/cvss.proto

@@ -20,6 +20,7 @@ option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
 option java_multiple_files = true;
 option java_package = "io.grafeas.v1";
 option objc_class_prefix = "GRA";
+option java_outer_classname = "CVSSProto";
 
 // Common Vulnerability Scoring System version 3.
 // For details, see https://www.first.org/cvss/specification-document
@@ -83,3 +84,76 @@ message CVSSv3 {
     IMPACT_NONE = 3;
   }
 }
+
+// Common Vulnerability Scoring System.
+// For details, see https://www.first.org/cvss/specification-document
+// This is a message we will try to use for storing various versions of CVSS
+// rather than making a separate proto for storing a specific version.
+message CVSS {
+  // The base score is a function of the base metric scores.
+  float base_score = 1;
+
+  float exploitability_score = 2;
+
+  float impact_score = 3;
+
+  // Base Metrics
+  // Represents the intrinsic characteristics of a vulnerability that are
+  // constant over time and across user environments.
+  AttackVector attack_vector = 4;
+  AttackComplexity attack_complexity = 5;
+  Authentication authentication = 6;
+  PrivilegesRequired privileges_required = 7;
+  UserInteraction user_interaction = 8;
+  Scope scope = 9;
+  Impact confidentiality_impact = 10;
+  Impact integrity_impact = 11;
+  Impact availability_impact = 12;
+
+  enum AttackVector {
+    ATTACK_VECTOR_UNSPECIFIED = 0;
+    ATTACK_VECTOR_NETWORK = 1;
+    ATTACK_VECTOR_ADJACENT = 2;
+    ATTACK_VECTOR_LOCAL = 3;
+    ATTACK_VECTOR_PHYSICAL = 4;
+  }
+
+  enum AttackComplexity {
+    ATTACK_COMPLEXITY_UNSPECIFIED = 0;
+    ATTACK_COMPLEXITY_LOW = 1;
+    ATTACK_COMPLEXITY_HIGH = 2;
+  }
+
+  enum Authentication {
+    AUTHENTICATION_UNSPECIFIED = 0;
+    AUTHENTICATION_MULTIPLE = 1;
+    AUTHENTICATION_SINGLE = 2;
+    AUTHENTICATION_NONE = 3;
+  }
+
+  enum PrivilegesRequired {
+    PRIVILEGES_REQUIRED_UNSPECIFIED = 0;
+    PRIVILEGES_REQUIRED_NONE = 1;
+    PRIVILEGES_REQUIRED_LOW = 2;
+    PRIVILEGES_REQUIRED_HIGH = 3;
+  }
+
+  enum UserInteraction {
+    USER_INTERACTION_UNSPECIFIED = 0;
+    USER_INTERACTION_NONE = 1;
+    USER_INTERACTION_REQUIRED = 2;
+  }
+
+  enum Scope {
+    SCOPE_UNSPECIFIED = 0;
+    SCOPE_UNCHANGED = 1;
+    SCOPE_CHANGED = 2;
+  }
+
+  enum Impact {
+    IMPACT_UNSPECIFIED = 0;
+    IMPACT_HIGH = 1;
+    IMPACT_LOW = 2;
+    IMPACT_NONE = 3;
+  }
+}

package/build/protos/grafeas/v1/discovery.proto

@@ -16,6 +16,7 @@ syntax = "proto3";
 
 package grafeas.v1;
 
+import "google/api/field_behavior.proto";
 import "google/protobuf/timestamp.proto";
 import "google/rpc/status.proto";
 import "grafeas/v1/common.proto";
@@ -80,4 +81,8 @@ message DiscoveryOccurrence {
 
   // The last time this resource was scanned.
   google.protobuf.Timestamp last_scan_time = 5;
+
+  // The time occurrences related to this discovery occurrence were archived.
+  google.protobuf.Timestamp archive_time = 6
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 }

package/build/protos/grafeas/v1/dsse_attestation.proto

@@ -49,4 +49,4 @@ message DSSEAttestationOccurrence {
   oneof decoded_payload {
     InTotoStatement statement = 2;
   }
-}
+}

package/build/protos/grafeas/v1/intoto_provenance.proto

@@ -23,6 +23,7 @@ option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
 option java_multiple_files = true;
 option java_package = "io.grafeas.v1";
 option objc_class_prefix = "GRA";
+option java_outer_classname = "InTotoProvenanceProto";
 
 // Spec defined at
 // https://github.com/in-toto/attestation/blob/main/spec/predicates/provenance.md

package/build/protos/grafeas/v1/intoto_statement.proto

@@ -18,11 +18,13 @@ package grafeas.v1;
 
 import "grafeas/v1/intoto_provenance.proto";
 import "grafeas/v1/slsa_provenance.proto";
+import "grafeas/v1/slsa_provenance_zero_two.proto";
 
 option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
 option java_multiple_files = true;
 option java_package = "io.grafeas.v1";
 option objc_class_prefix = "GRA";
+option java_outer_classname = "InTotoStatementProto";
 
 // Spec defined at
 // https://github.com/in-toto/attestation/tree/main/spec#statement The
@@ -37,6 +39,7 @@ message InTotoStatement {
   oneof predicate {
     InTotoProvenance provenance = 4;
     SlsaProvenance slsa_provenance = 5;
+    SlsaProvenanceZeroTwo slsa_provenance_zero_two = 6;
   }
 }
 message Subject {

package/build/protos/grafeas/v1/package.proto

@@ -16,6 +16,9 @@ syntax = "proto3";
 
 package grafeas.v1;
 
+import "google/api/field_behavior.proto";
+import "grafeas/v1/common.proto";
+
 option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
 option java_multiple_files = true;
 option java_package = "io.grafeas.v1";
@@ -34,9 +37,9 @@ enum Architecture {
 // This represents a particular channel of distribution for a given package.
 // E.g., Debian's jessie-backports dpkg mirror.
 message Distribution {
-  // Required. The cpe_uri in [CPE format](https://cpe.mitre.org/specification/)
+  // The cpe_uri in [CPE format](https://cpe.mitre.org/specification/)
   // denoting the package manager version distributing a package.
-  string cpe_uri = 1;
+  string cpe_uri = 1 [(google.api.field_behavior) = REQUIRED];
 
   // The CPU architecture for which packages in this distribution channel were
   // built.
@@ -58,10 +61,11 @@ message Distribution {
 // An occurrence of a particular package installation found within a system's
 // filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
 message Location {
-  // Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
-  // denoting the package manager version distributing a package.
+  // Deprecated.
+  // The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
   string cpe_uri = 1;
 
+  // Deprecated.
   // The version installed at this location.
   Version version = 2;
 
@@ -69,25 +73,81 @@ message Location {
   string path = 3;
 }
 
-// This represents a particular package that is distributed over various
-// channels. E.g., glibc (aka libc6) is distributed by many, at various
-// versions.
+// PackageNote represents a particular package version.
 message PackageNote {
-  // Required. Immutable. The name of the package.
-  string name = 1;
+  // The name of the package.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.field_behavior) = IMMUTABLE
+  ];
 
+  // Deprecated.
   // The various channels by which a package is distributed.
   repeated Distribution distribution = 10;
+
+  // The type of package; whether native or non native (e.g., ruby gems,
+  // node.js packages, etc.).
+  string package_type = 11;
+
+  // The cpe_uri in [CPE format](https://cpe.mitre.org/specification/)
+  // denoting the package manager version distributing a package.
+  // The cpe_uri will be blank for language packages.
+  string cpe_uri = 12;
+
+  // The CPU architecture for which packages in this distribution channel were
+  // built. Architecture will be blank for language packages.
+  Architecture architecture = 13;
+
+  // The version of the package.
+  Version version = 14;
+
+  // A freeform text denoting the maintainer of this package.
+  string maintainer = 15;
+
+  // The homepage for this package.
+  string url = 16;
+
+  // The description of this package.
+  string description = 17;
+
+  // Licenses that have been declared by the authors of the package.
+  License license = 18;
+
+  // Hash value, typically a file digest, that allows unique
+  // identification a specific package.
+  repeated Digest digest = 19;
 }
 
 // Details on how a particular software package was installed on a system.
 message PackageOccurrence {
-  // Output only. The name of the installed package.
-  string name = 1;
+  // The name of the installed package.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.field_behavior) = OUTPUT_ONLY
+  ];
 
-  // Required. All of the places within the filesystem versions of this package
+  // All of the places within the filesystem versions of this package
   // have been found.
   repeated Location location = 2;
+
+  // The type of package; whether native or non native (e.g., ruby gems,
+  // node.js packages, etc.).
+  string package_type = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The cpe_uri in [CPE format](https://cpe.mitre.org/specification/)
+  // denoting the package manager version distributing a package.
+  // The cpe_uri will be blank for language packages.
+  string cpe_uri = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The CPU architecture for which packages in this distribution channel were
+  // built. Architecture will be blank for language packages.
+  Architecture architecture = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Licenses that have been declared by the authors of the package.
+  License license = 6;
+
+  // The version of the package.
+  Version version = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
 }
 
 // Version contains structured information about the version of a package.

package/build/protos/grafeas/v1/severity.proto

@@ -0,0 +1,38 @@
+// Copyright 2021 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package grafeas.v1;
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+
+// Note provider assigned severity/impact ranking.
+enum Severity {
+  // Unknown.
+  SEVERITY_UNSPECIFIED = 0;
+  // Minimal severity.
+  MINIMAL = 1;
+  // Low severity.
+  LOW = 2;
+  // Medium severity.
+  MEDIUM = 3;
+  // High severity.
+  HIGH = 4;
+  // Critical severity.
+  CRITICAL = 5;
+}

package/build/protos/grafeas/v1/slsa_provenance.proto

@@ -23,6 +23,7 @@ option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
 option java_multiple_files = true;
 option java_package = "io.grafeas.v1";
 option objc_class_prefix = "GRA";
+option java_outer_classname = "SlsaProvenanceProto";
 
 message SlsaProvenance {
   // Steps taken to build the artifact.
@@ -111,4 +112,4 @@ message SlsaProvenance {
   // incomplete unless metadata.completeness.materials is true. Unset or null is
   // equivalent to empty.
   repeated Material materials = 4;
-}
+}

package/build/protos/grafeas/v1/slsa_provenance_zero_two.proto

@@ -0,0 +1,82 @@
+// Copyright 2021 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package grafeas.v1;
+
+import "google/protobuf/struct.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+option java_outer_classname = "SlsaProvenanceZeroTwoProto";
+
+message SlsaProvenanceZeroTwo {
+  // See full explanation of fields at slsa.dev/provenance/v0.2.
+
+  // Identifies the entity that executed the recipe, which is trusted to have
+  // correctly performed the operation and populated this provenance.
+  message SlsaBuilder {
+    string id = 1;
+  }
+
+  // The collection of artifacts that influenced the build including sources,
+  // dependencies, build tools, base images, and so on.
+  message SlsaMaterial {
+    string uri = 1;
+    map<string, string> digest = 2;
+  }
+
+  // Identifies the event that kicked off the build.
+  message SlsaInvocation {
+    SlsaConfigSource config_source = 1;
+    google.protobuf.Struct parameters = 2;
+    google.protobuf.Struct environment = 3;
+  }
+
+  // Describes where the config file that kicked off the build came from.
+  // This is effectively a pointer to the source where buildConfig came from.
+  message SlsaConfigSource {
+    string uri = 1;
+    map<string, string> digest = 2;
+    string entry_point = 3;
+  }
+
+  // Other properties of the build.
+  message SlsaMetadata {
+    string build_invocation_id = 1;
+    google.protobuf.Timestamp build_started_on = 2;
+    google.protobuf.Timestamp build_finished_on = 3;
+    SlsaCompleteness completeness = 4;
+    bool reproducible = 5;
+  }
+
+  // Indicates that the builder claims certain fields in this message to be
+  // complete.
+  message SlsaCompleteness {
+    bool parameters = 1;
+    bool environment = 2;
+    bool materials = 3;
+  }
+
+  SlsaBuilder builder = 1;
+  string build_type = 2;
+  SlsaInvocation invocation = 3;
+  google.protobuf.Struct build_config = 4;
+  SlsaMetadata metadata = 5;
+  repeated SlsaMaterial materials = 6;
+}