@google-cloud/containeranalysis 3.3.0 → 4.1.0

package/build/protos/grafeas/v1/vulnerability.proto

@@ -21,28 +21,13 @@ import "google/protobuf/timestamp.proto";
 import "grafeas/v1/common.proto";
 import "grafeas/v1/cvss.proto";
 import "grafeas/v1/package.proto";
+import "grafeas/v1/severity.proto";
 
 option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
 option java_multiple_files = true;
 option java_package = "io.grafeas.v1";
 option objc_class_prefix = "GRA";
 
-// Note provider assigned severity/impact ranking.
-enum Severity {
-  // Unknown.
-  SEVERITY_UNSPECIFIED = 0;
-  // Minimal severity.
-  MINIMAL = 1;
-  // Low severity.
-  LOW = 2;
-  // Medium severity.
-  MEDIUM = 3;
-  // High severity.
-  HIGH = 4;
-  // Critical severity.
-  CRITICAL = 5;
-}
-
 // A security vulnerability that can be found in resources.
 message VulnerabilityNote {
   // The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10
@@ -50,7 +35,7 @@ message VulnerabilityNote {
   float cvss_score = 1;
 
   // The note provider assigned severity of this vulnerability.
-  Severity severity = 2;
+  grafeas.v1.Severity severity = 2;
 
   // Details of all known distros and packages affected by this vulnerability.
   repeated Detail details = 3;
@@ -172,24 +157,15 @@ message VulnerabilityOccurrence {
   string type = 1;
 
   // Output only. The note provider assigned severity of this vulnerability.
-  Severity severity = 2;
+  grafeas.v1.Severity severity = 2;
 
   // Output only. The CVSS score of this vulnerability. CVSS score is on a
   // scale of 0 - 10 where 0 indicates low severity and 10 indicates high
   // severity.
   float cvss_score = 3;
 
-  // The CVSS v3 score for this vulnerability.
-  message CVSSV3 {
-    // The base score for for this vulnerability according to cvss v3.
-    float base_score = 1;
-    // The severity rating assigned to this vulnerability by vulnerability
-    // provider.
-    Severity severity = 2;
-  }
-
   // The cvss v3 score for the vulnerability.
-  CVSSV3 cvssv3 = 10;
+  CVSS cvssv3 = 10;
 
   // Required. The set of affected locations and their fixes (if available)
   // within the associated resource.
@@ -231,7 +207,11 @@ message VulnerabilityOccurrence {
     // The distro or language system assigned severity for this vulnerability
     // when that is available and note provider assigned severity when it is not
     // available.
-    Severity effective_severity = 9 [(google.api.field_behavior) = OUTPUT_ONLY];
+    grafeas.v1.Severity effective_severity = 9
+        [(google.api.field_behavior) = OUTPUT_ONLY];
+
+    // The location at which this package was found.
+    repeated FileLocation file_location = 10;
   }
 
   // Output only. A one sentence description of this vulnerability.
@@ -253,7 +233,7 @@ message VulnerabilityOccurrence {
   // PackageIssue level. In the case where multiple PackageIssues have differing
   // effective severities, this field should be the highest severity for any of
   // the PackageIssues.
-  Severity effective_severity = 8;
+  grafeas.v1.Severity effective_severity = 8;
 
   // Output only. Whether at least one of the affected packages has a fix
   // available.