@google-cloud/containeranalysis 4.4.2 → 4.6.0

package/build/protos/google/devtools/containeranalysis/v1beta1/containeranalysis.proto

@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC.
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -11,7 +11,6 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-//
 
 syntax = "proto3";
 
@@ -20,10 +19,8 @@ package google.devtools.containeranalysis.v1beta1;
 import "google/api/annotations.proto";
 import "google/api/client.proto";
 import "google/api/field_behavior.proto";
-import "google/api/resource.proto";
 import "google/iam/v1/iam_policy.proto";
 import "google/iam/v1/policy.proto";
-import "google/protobuf/timestamp.proto";
 
 option go_package = "google.golang.org/genproto/googleapis/devtools/containeranalysis/v1beta1;containeranalysis";
 option java_multiple_files = true;
@@ -32,7 +29,7 @@ option objc_class_prefix = "GCA";
 
 // Retrieves analysis results of Cloud components such as Docker container
 // images. The Container Analysis API is an implementation of the
-// [Grafeas](grafeas.io) API.
+// [Grafeas](https://grafeas.io) API.
 //
 // Analysis results are stored as a series of occurrences. An `Occurrence`
 // contains information about a specific analysis instance on a resource. An
@@ -45,7 +42,8 @@ option objc_class_prefix = "GCA";
 // image with the vulnerability referring to that note.
 service ContainerAnalysisV1Beta1 {
   option (google.api.default_host) = "containeranalysis.googleapis.com";
-  option (google.api.oauth_scopes) = "https://www.googleapis.com/auth/cloud-platform";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/cloud-platform";
 
   // Sets the access control policy on the specified note or occurrence.
   // Requires `containeranalysis.notes.setIamPolicy` or
@@ -55,7 +53,8 @@ service ContainerAnalysisV1Beta1 {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest) returns (google.iam.v1.Policy) {
+  rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest)
+      returns (google.iam.v1.Policy) {
     option (google.api.http) = {
       post: "/v1beta1/{resource=projects/*/notes/*}:setIamPolicy"
       body: "*"
@@ -75,7 +74,8 @@ service ContainerAnalysisV1Beta1 {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest) returns (google.iam.v1.Policy) {
+  rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest)
+      returns (google.iam.v1.Policy) {
     option (google.api.http) = {
       post: "/v1beta1/{resource=projects/*/notes/*}:getIamPolicy"
       body: "*"
@@ -94,7 +94,8 @@ service ContainerAnalysisV1Beta1 {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest) returns (google.iam.v1.TestIamPermissionsResponse) {
+  rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest)
+      returns (google.iam.v1.TestIamPermissionsResponse) {
     option (google.api.http) = {
       post: "/v1beta1/{resource=projects/*/notes/*}:testIamPermissions"
       body: "*"
@@ -105,115 +106,4 @@ service ContainerAnalysisV1Beta1 {
     };
     option (google.api.method_signature) = "resource,permissions";
   }
-
-  // Gets the specified scan configuration.
-  rpc GetScanConfig(GetScanConfigRequest) returns (ScanConfig) {
-    option (google.api.http) = {
-      get: "/v1beta1/{name=projects/*/scanConfigs/*}"
-    };
-    option (google.api.method_signature) = "name";
-  }
-
-  // Lists scan configurations for the specified project.
-  rpc ListScanConfigs(ListScanConfigsRequest) returns (ListScanConfigsResponse) {
-    option (google.api.http) = {
-      get: "/v1beta1/{parent=projects/*}/scanConfigs"
-    };
-    option (google.api.method_signature) = "parent,filter";
-  }
-
-  // Updates the specified scan configuration.
-  rpc UpdateScanConfig(UpdateScanConfigRequest) returns (ScanConfig) {
-    option (google.api.http) = {
-      put: "/v1beta1/{name=projects/*/scanConfigs/*}"
-      body: "scan_config"
-    };
-    option (google.api.method_signature) = "name,scan_config";
-  }
-}
-
-// A scan configuration specifies whether Cloud components in a project have a
-// particular type of analysis being run. For example, it can configure whether
-// vulnerability scanning is being done on Docker images or not.
-message ScanConfig {
-  option (google.api.resource) = {
-    type: "containeranalysis.googleapis.com/ScanConfig"
-    pattern: "projects/{project}/scanConfigs/{scan_config}"
-  };
-
-  // Output only. The name of the scan configuration in the form of
-  // `projects/[PROJECT_ID]/scanConfigs/[SCAN_CONFIG_ID]`.
-  string name = 1;
-
-  // Output only. A human-readable description of what the scan configuration
-  // does.
-  string description = 2;
-
-  // Whether the scan is enabled.
-  bool enabled = 3;
-
-  // Output only. The time this scan config was created.
-  google.protobuf.Timestamp create_time = 4;
-
-  // Output only. The time this scan config was last updated.
-  google.protobuf.Timestamp update_time = 5;
-}
-
-// Request to get a scan configuration.
-message GetScanConfigRequest {
-  // Required. The name of the scan configuration in the form of
-  // `projects/[PROJECT_ID]/scanConfigs/[SCAN_CONFIG_ID]`.
-  string name = 1 [
-    (google.api.field_behavior) = REQUIRED,
-    (google.api.resource_reference) = {
-      type: "containeranalysis.googleapis.com/ScanConfig"
-    }
-  ];
-}
-
-// Request to list scan configurations.
-message ListScanConfigsRequest {
-  // Required. The name of the project to list scan configurations for in the form of
-  // `projects/[PROJECT_ID]`.
-  string parent = 1 [
-    (google.api.field_behavior) = REQUIRED,
-    (google.api.resource_reference) = {
-      type: "cloudresourcemanager.googleapis.com/Project"
-    }
-  ];
-
-  // Required. The filter expression.
-  string filter = 2 [(google.api.field_behavior) = REQUIRED];
-
-  // The number of scan configs to return in the list.
-  int32 page_size = 3;
-
-  // Token to provide to skip to a particular spot in the list.
-  string page_token = 4;
-}
-
-// Response for listing scan configurations.
-message ListScanConfigsResponse {
-  // The scan configurations requested.
-  repeated ScanConfig scan_configs = 1;
-
-  // The next pagination token in the list response. It should be used as
-  // `page_token` for the following request. An empty value means no more
-  // results.
-  string next_page_token = 2;
-}
-
-// A request to update a scan configuration.
-message UpdateScanConfigRequest {
-  // Required. The name of the scan configuration in the form of
-  // `projects/[PROJECT_ID]/scanConfigs/[SCAN_CONFIG_ID]`.
-  string name = 1 [
-    (google.api.field_behavior) = REQUIRED,
-    (google.api.resource_reference) = {
-      type: "containeranalysis.googleapis.com/ScanConfig"
-    }
-  ];
-
-  // Required. The updated scan configuration.
-  ScanConfig scan_config = 2 [(google.api.field_behavior) = REQUIRED];
 }

package/build/protos/grafeas/v1/common.proto

@@ -45,6 +45,8 @@ enum NoteKind {
   COMPLIANCE = 9;
   // This represents a DSSE attestation Note
   DSSE_ATTESTATION = 10;
+  // This represents a Vulnerability Assessment.
+  VULNERABILITY_ASSESSMENT = 11;
 }
 
 // Metadata for any related URL information.

package/build/protos/grafeas/v1/grafeas.proto

@@ -33,6 +33,7 @@ import "grafeas/v1/dsse_attestation.proto";
 import "grafeas/v1/image.proto";
 import "grafeas/v1/package.proto";
 import "grafeas/v1/upgrade.proto";
+import "grafeas/v1/vex.proto";
 import "grafeas/v1/vulnerability.proto";
 
 option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
@@ -314,6 +315,8 @@ message Note {
     grafeas.v1.ComplianceNote compliance = 18;
     // A note describing a dsse attestation note.
     grafeas.v1.DSSEAttestationNote dsse_attestation = 19;
+    // A note describing a vulnerability assessment.
+    grafeas.v1.VulnerabilityAssessmentNote vulnerability_assessment = 20;
   }
 }
 

package/build/protos/grafeas/v1/vex.proto

@@ -0,0 +1,203 @@
+// Copyright 2023 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package grafeas.v1;
+
+import "grafeas/v1/common.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+
+// A single VulnerabilityAssessmentNote represents
+// one particular product's vulnerability assessment for one CVE.
+message VulnerabilityAssessmentNote {
+  // The title of the note. E.g. `Vex-Debian-11.4`
+  string title = 1;
+
+  // A one sentence description of this Vex.
+  string short_description = 2;
+
+  // A detailed description of this Vex.
+  string long_description = 3;
+
+  // Identifies the language used by this document,
+  // corresponding to IETF BCP 47 / RFC 5646.
+  string language_code = 4;
+
+  // Publisher contains information about the publisher of
+  // this Note.
+  // (-- api-linter: core::0123::resource-annotation=disabled
+  //     aip.dev/not-precedent: Publisher is not a separate resource. --)
+  message Publisher {
+    // Name of the publisher.
+    // Examples: 'Google', 'Google Cloud Platform'.
+    string name = 1;
+
+    // Provides information about the authority of the issuing party to
+    // release the document, in particular, the party's constituency and
+    // responsibilities or other obligations.
+    string issuing_authority = 2;
+
+    // The context or namespace.
+    // Contains a URL which is under control of the issuing party and can
+    // be used as a globally unique identifier for that issuing party.
+    // Example: https://csaf.io
+    string publisher_namespace = 3;
+  }
+
+  // Publisher details of this Note.
+  Publisher publisher = 5;
+
+  // Product contains information about a product and how to uniquely identify
+  // it.
+  // (-- api-linter: core::0123::resource-annotation=disabled
+  //     aip.dev/not-precedent: Product is not a separate resource. --)
+  message Product {
+    // Name of the product.
+    string name = 1;
+
+    // Token that identifies a product so that it can be referred to from other
+    // parts in the document. There is no predefined format as long as it
+    // uniquely identifies a group in the context of the current document.
+    string id = 2;
+
+    oneof identifier {
+      // Contains a URI which is vendor-specific.
+      // Example: The artifact repository URL of an image.
+      string generic_uri = 3;
+    }
+  }
+
+  // The product affected by this vex.
+  Product product = 6;
+
+  // Assessment provides all information that is related to a single
+  // vulnerability for this product.
+  message Assessment {
+    // Holds the MITRE standard Common Vulnerabilities and Exposures (CVE)
+    // tracking number for the vulnerability.
+    string cve = 1;
+
+    // A one sentence description of this Vex.
+    string short_description = 2;
+
+    // A detailed description of this Vex.
+    string long_description = 3;
+
+    // Holds a list of references associated with this vulnerability item and
+    // assessment. These uris have additional information about the
+    // vulnerability and the assessment itself. E.g. Link to a document which
+    // details how this assessment concluded the state of this vulnerability.
+    repeated grafeas.v1.RelatedUrl related_uris = 4;
+
+    // Provides the state of this Vulnerability assessment.
+    enum State {
+      // No state is specified.
+      STATE_UNSPECIFIED = 0;
+      // This product is known to be affected by this vulnerability.
+      AFFECTED = 1;
+      // This product is known to be not affected by this vulnerability.
+      NOT_AFFECTED = 2;
+      // This product contains a fix for this vulnerability.
+      FIXED = 3;
+      // It is not known yet whether these versions are or are not affected
+      // by the vulnerability. However, it is still under investigation.
+      UNDER_INVESTIGATION = 4;
+    }
+
+    // Provides the state of this Vulnerability assessment.
+    State state = 5;
+
+    // Contains information about the impact of this vulnerability,
+    // this will change with time.
+    repeated string impacts = 6;
+
+    // Justification provides the justification when the state of the
+    // assessment if NOT_AFFECTED.
+    message Justification {
+      // Provides the type of justification.
+      enum JustificationType {
+        // JUSTIFICATION_TYPE_UNSPECIFIED.
+        JUSTIFICATION_TYPE_UNSPECIFIED = 0;
+        // The vulnerable component is not present in the product.
+        COMPONENT_NOT_PRESENT = 1;
+        // The vulnerable code is not present. Typically this case
+        // occurs when source code is configured or built in a way that excludes
+        // the vulnerable code.
+        VULNERABLE_CODE_NOT_PRESENT = 2;
+        // The vulnerable code can not be executed.
+        // Typically this case occurs when the product includes the vulnerable
+        // code but does not call or use the vulnerable code.
+        VULNERABLE_CODE_NOT_IN_EXECUTE_PATH = 3;
+        // The vulnerable code cannot be controlled by an attacker to exploit
+        // the vulnerability.
+        VULNERABLE_CODE_CANNOT_BE_CONTROLLED_BY_ADVERSARY = 4;
+        // The product includes built-in protections or features that prevent
+        // exploitation of the vulnerability. These built-in protections cannot
+        // be subverted by the attacker and cannot be configured or disabled by
+        // the user. These mitigations completely prevent exploitation based on
+        // known attack vectors.
+        INLINE_MITIGATIONS_ALREADY_EXIST = 5;
+      }
+
+      // The justification type for this vulnerability.
+      JustificationType justification_type = 1;
+
+      // Additional details on why this justification was chosen.
+      string details = 2;
+    }
+
+    // Justification provides the justification when the state of the
+    // assessment if NOT_AFFECTED.
+    Justification justification = 7;
+
+    // Specifies details on how to handle (and presumably, fix) a vulnerability.
+    message Remediation {
+      // The type of remediation that can be applied.
+      enum RemediationType {
+        // No remediation type specified.
+        REMEDIATION_TYPE_UNSPECIFIED = 0;
+        // A MITIGATION is available.
+        MITIGATION = 1;
+        // No fix is planned.
+        NO_FIX_PLANNED = 2;
+        // Not available.
+        NONE_AVAILABLE = 3;
+        // A vendor fix is available.
+        VENDOR_FIX = 4;
+        // A workaround is available.
+        WORKAROUND = 5;
+      }
+
+      // The type of remediation that can be applied.
+      RemediationType remediation_type = 1;
+
+      // Contains a comprehensive human-readable discussion of the remediation.
+      string details = 2;
+
+      // Contains the URL where to obtain the remediation.
+      grafeas.v1.RelatedUrl remediation_uri = 3;
+    }
+
+    // Specifies details on how to handle (and presumably, fix) a vulnerability.
+    repeated Remediation remediations = 8;
+  }
+
+  // Represents a vulnerability assessment for the product.
+  Assessment assessment = 7;
+}

package/build/protos/grafeas/v1/vulnerability.proto

@@ -22,6 +22,7 @@ import "grafeas/v1/common.proto";
 import "grafeas/v1/cvss.proto";
 import "grafeas/v1/package.proto";
 import "grafeas/v1/severity.proto";
+import "grafeas/v1/vex.proto";
 
 option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
 option java_multiple_files = true;
@@ -152,7 +153,10 @@ message VulnerabilityNote {
   // CVSS version used to populate cvss_score and severity.
   grafeas.v1.CVSSVersion cvss_version = 7;
 
-  // Next free ID is 8.
+  // The full description of the v2 CVSS for this vulnerability.
+  CVSS cvss_v2 = 8;
+
+  // Next free ID is 9.
 }
 
 // An occurrence of a severity vulnerability on a resource.
@@ -247,5 +251,47 @@ message VulnerabilityOccurrence {
   // Output only. CVSS version used to populate cvss_score and severity.
   grafeas.v1.CVSSVersion cvss_version = 11;
 
-  // Next free ID is 12.
+  // The cvss v2 score for the vulnerability.
+  CVSS cvss_v2 = 12;
+
+  // VexAssessment provides all publisher provided Vex information that is
+  // related to this vulnerability.
+  message VexAssessment {
+    // Holds the MITRE standard Common Vulnerabilities and Exposures (CVE)
+    // tracking number for the vulnerability.
+    string cve = 1;
+
+    // Holds a list of references associated with this vulnerability item and
+    // assessment.
+    repeated grafeas.v1.RelatedUrl related_uris = 2;
+
+    // The VulnerabilityAssessment note from which this VexAssessment was
+    // generated.
+    // This will be of the form: `projects/[PROJECT_ID]/notes/[NOTE_ID]`.
+    // (-- api-linter: core::0122::name-suffix=disabled
+    //     aip.dev/not-precedent: The suffix is kept for consistency. --)
+    string note_name = 3;
+
+    // Provides the state of this Vulnerability assessment.
+    grafeas.v1.VulnerabilityAssessmentNote.Assessment.State state = 4;
+
+    // Contains information about the impact of this vulnerability,
+    // this will change with time.
+    repeated string impacts = 5;
+
+    // Specifies details on how to handle (and presumably, fix) a vulnerability.
+    repeated grafeas.v1.VulnerabilityAssessmentNote.Assessment.Remediation
+        remediations = 6;
+
+    // Justification provides the justification when the state of the
+    // assessment if NOT_AFFECTED.
+    grafeas.v1.VulnerabilityAssessmentNote.Assessment.Justification
+        justification = 7;
+
+    // Next ID: 8
+  }
+
+  VexAssessment vex_assessment = 13;
+
+  // Next free ID is 14.
 }