@google-cloud/containeranalysis 5.2.0 → 5.3.0

package/CHANGELOG.md

@@ -4,6 +4,13 @@
 
 [1]: https://www.npmjs.com/package/@google-cloud/containeranalysis?activeTab=versions
 
+## [5.3.0](https://github.com/googleapis/google-cloud-node/compare/containeranalysis-v5.2.0...containeranalysis-v5.3.0) (2024-03-23)
+
+
+### Features
+
+* [containeranalysis] A new field `in_toto_slsa_provenance_v1` is added to message `BuildOccurrence` ([#5134](https://github.com/googleapis/google-cloud-node/issues/5134)) ([e15c0fa](https://github.com/googleapis/google-cloud-node/commit/e15c0fa84d38e7bfd1e1ff2551b6b39ccbbd8554))
+
 ## [5.2.0](https://github.com/googleapis/google-cloud-node/compare/containeranalysis-v5.1.1...containeranalysis-v5.2.0) (2024-02-09)
 
 

package/build/protos/grafeas/v1/build.proto

@@ -59,4 +59,10 @@ message BuildOccurrence {
   // payload of the statement can be stored and signed in the Occurrence's
   // envelope.
   InTotoStatement intoto_statement = 4;
+
+  // In-Toto Slsa Provenance V1 represents a slsa provenance meeting the slsa
+  // spec, wrapped in an in-toto statement. This allows for direct
+  // jsonification of a to-spec in-toto slsa statement with a to-spec
+  // slsa provenance.
+  InTotoSlsaProvenanceV1 in_toto_slsa_provenance_v1 = 5;
 }

package/build/protos/grafeas/v1/common.proto

@@ -47,6 +47,8 @@ enum NoteKind {
   DSSE_ATTESTATION = 10;
   // This represents a Vulnerability Assessment.
   VULNERABILITY_ASSESSMENT = 11;
+  // This represents an SBOM Reference.
+  SBOM_REFERENCE = 12;
 }
 
 // Metadata for any related URL information.

package/build/protos/grafeas/v1/compliance.proto

@@ -44,6 +44,10 @@ message ComplianceNote {
   }
   // Serialized scan instructions with a predefined format.
   bytes scan_instructions = 7;
+  // Potential impact of the suggested remediation
+  oneof potential_impact {
+    string impact = 8;
+  }
 }
 
 // Describes the CIS benchmark version that is applicable to a given OS and

package/build/protos/grafeas/v1/discovery.proto

@@ -101,4 +101,26 @@ message DiscoveryOccurrence {
   // The time occurrences related to this discovery occurrence were archived.
   google.protobuf.Timestamp archive_time = 6
       [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The status of an SBOM generation.
+  message SBOMStatus {
+    // An enum indicating the progress of the SBOM generation.
+    enum SBOMState {
+      // Default unknown state.
+      SBOM_STATE_UNSPECIFIED = 0;
+      // SBOM scanning is pending.
+      PENDING = 1;
+      // SBOM scanning has completed.
+      COMPLETE = 2;
+    }
+
+    // The progress of the SBOM generation.
+    SBOMState sbom_state = 1;
+    // If there was an error generating an SBOM, this will indicate what that
+    // error was.
+    string error = 2;
+  }
+
+  // The status of an SBOM generation.
+  SBOMStatus sbom_status = 9;
 }

package/build/protos/grafeas/v1/grafeas.proto

@@ -32,6 +32,7 @@ import "grafeas/v1/discovery.proto";
 import "grafeas/v1/dsse_attestation.proto";
 import "grafeas/v1/image.proto";
 import "grafeas/v1/package.proto";
+import "grafeas/v1/sbom.proto";
 import "grafeas/v1/upgrade.proto";
 import "grafeas/v1/vex.proto";
 import "grafeas/v1/vulnerability.proto";
@@ -66,6 +67,9 @@ service Grafeas {
   rpc GetOccurrence(GetOccurrenceRequest) returns (Occurrence) {
     option (google.api.http) = {
       get: "/v1/{name=projects/*/occurrences/*}"
+      additional_bindings {
+        get: "/v1/{name=projects/*/locations/*/occurrences/*}"
+      }
     };
     option (google.api.method_signature) = "name";
   }
@@ -75,6 +79,9 @@ service Grafeas {
       returns (ListOccurrencesResponse) {
     option (google.api.http) = {
       get: "/v1/{parent=projects/*}/occurrences"
+      additional_bindings {
+        get: "/v1/{parent=projects/*/locations/*}/occurrences"
+      }
     };
     option (google.api.method_signature) = "parent,filter";
   }
@@ -123,6 +130,9 @@ service Grafeas {
   rpc GetOccurrenceNote(GetOccurrenceNoteRequest) returns (Note) {
     option (google.api.http) = {
       get: "/v1/{name=projects/*/occurrences/*}/notes"
+      additional_bindings {
+        get: "/v1/{name=projects/*/locations/*/occurrences/*}/notes"
+      }
     };
     option (google.api.method_signature) = "name";
   }
@@ -131,6 +141,7 @@ service Grafeas {
   rpc GetNote(GetNoteRequest) returns (Note) {
     option (google.api.http) = {
       get: "/v1/{name=projects/*/notes/*}"
+      additional_bindings { get: "/v1/{name=projects/*/locations/*/notes/*}" }
     };
     option (google.api.method_signature) = "name";
   }
@@ -139,6 +150,7 @@ service Grafeas {
   rpc ListNotes(ListNotesRequest) returns (ListNotesResponse) {
     option (google.api.http) = {
       get: "/v1/{parent=projects/*}/notes"
+      additional_bindings { get: "/v1/{parent=projects/*/locations/*}/notes" }
     };
     option (google.api.method_signature) = "parent,filter";
   }
@@ -186,6 +198,9 @@ service Grafeas {
       returns (ListNoteOccurrencesResponse) {
     option (google.api.http) = {
       get: "/v1/{name=projects/*/notes/*}/occurrences"
+      additional_bindings {
+        get: "/v1/{name=projects/*/locations/*/notes/*}/occurrences"
+      }
     };
     option (google.api.method_signature) = "name,filter";
   }
@@ -249,6 +264,8 @@ message Occurrence {
     grafeas.v1.ComplianceOccurrence compliance = 16;
     // Describes an attestation of an artifact using dsse.
     grafeas.v1.DSSEAttestationOccurrence dsse_attestation = 17;
+    // Describes a specific SBOM reference occurrences.
+    grafeas.v1.SBOMReferenceOccurrence sbom_reference = 19;
   }
 
   // https://github.com/secure-systems-lab/dsse
@@ -317,6 +334,8 @@ message Note {
     grafeas.v1.DSSEAttestationNote dsse_attestation = 19;
     // A note describing a vulnerability assessment.
     grafeas.v1.VulnerabilityAssessmentNote vulnerability_assessment = 20;
+    // A note describing an SBOM reference.
+    grafeas.v1.SBOMReferenceNote sbom_reference = 21;
   }
 }
 

package/build/protos/grafeas/v1/intoto_statement.proto

@@ -16,6 +16,8 @@ syntax = "proto3";
 
 package grafeas.v1;
 
+import "google/protobuf/struct.proto";
+import "google/protobuf/timestamp.proto";
 import "grafeas/v1/intoto_provenance.proto";
 import "grafeas/v1/slsa_provenance.proto";
 import "grafeas/v1/slsa_provenance_zero_two.proto";
@@ -50,3 +52,55 @@ message Subject {
   // https://github.com/in-toto/attestation/blob/main/spec/field_types.md#DigestSet
   map<string, string> digest = 2;
 }
+
+message InTotoSlsaProvenanceV1 {
+  // InToto spec defined at
+  // https://github.com/in-toto/attestation/tree/main/spec#statement
+  string type = 1 [json_name = "_type"];
+  repeated Subject subject = 2;
+  string predicate_type = 3;
+  SlsaProvenanceV1 predicate = 4;
+
+  // Keep in sync with schema at
+  // https://github.com/slsa-framework/slsa/blob/main/docs/provenance/schema/v1/provenance.proto
+  // Builder renamed to ProvenanceBuilder because of Java conflicts.
+  message SlsaProvenanceV1 {
+    BuildDefinition build_definition = 1;
+    RunDetails run_details = 2;
+  }
+
+  message BuildDefinition {
+    string build_type = 1;
+    google.protobuf.Struct external_parameters = 2;
+    google.protobuf.Struct internal_parameters = 3;
+    repeated ResourceDescriptor resolved_dependencies = 4;
+  }
+
+  message ResourceDescriptor {
+    string name = 1;
+    string uri = 2;
+    map<string, string> digest = 3;
+    bytes content = 4;
+    string download_location = 5;
+    string media_type = 6;
+    map<string, google.protobuf.Value> annotations = 7;
+  }
+
+  message RunDetails {
+    ProvenanceBuilder builder = 1;
+    BuildMetadata metadata = 2;
+    repeated ResourceDescriptor byproducts = 3;
+  }
+
+  message ProvenanceBuilder {
+    string id = 1;
+    map<string, string> version = 2;
+    repeated ResourceDescriptor builder_dependencies = 3;
+  }
+
+  message BuildMetadata {
+    string invocation_id = 1;
+    google.protobuf.Timestamp started_on = 2;
+    google.protobuf.Timestamp finished_on = 3;
+  }
+}

package/build/protos/grafeas/v1/sbom.proto

@@ -0,0 +1,78 @@
+// Copyright 2023 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package grafeas.v1;
+
+import "grafeas/v1/common.proto";
+import "grafeas/v1/intoto_statement.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+
+// The note representing an SBOM reference.
+message SBOMReferenceNote {
+  // The format that SBOM takes. E.g. may be spdx, cyclonedx, etc...
+  string format = 1;
+  // The version of the format that the SBOM takes. E.g. if the format
+  // is spdx, the version may be 2.3.
+  string version = 2;
+}
+
+// The occurrence representing an SBOM reference as applied to a specific
+// resource. The occurrence follows the DSSE specification. See
+// https://github.com/secure-systems-lab/dsse/blob/master/envelope.md for more
+// details.
+message SBOMReferenceOccurrence {
+  // The actual payload that contains the SBOM reference data.
+  SbomReferenceIntotoPayload payload = 1;
+  // The kind of payload that SbomReferenceIntotoPayload takes. Since it's in
+  // the intoto format, this value is expected to be
+  // 'application/vnd.in-toto+json'.
+  string payload_type = 2;
+  // The signatures over the payload.
+  repeated EnvelopeSignature signatures = 3;
+}
+
+// The actual payload that contains the SBOM Reference data.
+// The payload follows the intoto statement specification. See
+// https://github.com/in-toto/attestation/blob/main/spec/v1.0/statement.md
+// for more details.
+message SbomReferenceIntotoPayload {
+  // Identifier for the schema of the Statement.
+  string type = 1 [json_name = "_type"];
+  // URI identifying the type of the Predicate.
+  string predicate_type = 2;
+  // Set of software artifacts that the attestation applies to. Each element
+  // represents a single software artifact.
+  repeated Subject subject = 3;
+  // Additional parameters of the Predicate. Includes the actual data about the
+  // SBOM.
+  SbomReferenceIntotoPredicate predicate = 4;
+}
+
+// A predicate which describes the SBOM being referenced.
+message SbomReferenceIntotoPredicate {
+  // The person or system referring this predicate to the consumer.
+  string referrer_id = 1;
+  // The location of the SBOM.
+  string location = 2;
+  // The mime type of the SBOM.
+  string mime_type = 3;
+  // A map of algorithm to digest of the contents of the SBOM.
+  map<string, string> digest = 4;
+}

package/build/protos/grafeas/v1/vex.proto

@@ -91,7 +91,12 @@ message VulnerabilityAssessmentNote {
   message Assessment {
     // Holds the MITRE standard Common Vulnerabilities and Exposures (CVE)
     // tracking number for the vulnerability.
-    string cve = 1;
+    // Deprecated: Use vulnerability_id instead to denote CVEs.
+    string cve = 1 [deprecated = true];
+
+    // The vulnerability identifier for this Assessment. Will hold one of
+    // common identifiers e.g. CVE, GHSA etc.
+    string vulnerability_id = 9;
 
     // A one sentence description of this Vex.
     string short_description = 2;

package/build/protos/grafeas/v1/vulnerability.proto

@@ -259,7 +259,12 @@ message VulnerabilityOccurrence {
   message VexAssessment {
     // Holds the MITRE standard Common Vulnerabilities and Exposures (CVE)
     // tracking number for the vulnerability.
-    string cve = 1;
+    // Deprecated: Use vulnerability_id instead to denote CVEs.
+    string cve = 1 [deprecated = true];
+
+    // The vulnerability identifier for this Assessment. Will hold one of
+    // common identifiers e.g. CVE, GHSA etc.
+    string vulnerability_id = 8;
 
     // Holds a list of references associated with this vulnerability item and
     // assessment.
@@ -288,10 +293,13 @@ message VulnerabilityOccurrence {
     grafeas.v1.VulnerabilityAssessmentNote.Assessment.Justification
         justification = 7;
 
-    // Next ID: 8
+    // Next ID: 9
   }
 
   VexAssessment vex_assessment = 13;
 
-  // Next free ID is 14.
+  // Occurrence-specific extra details about the vulnerability.
+  string extra_details = 14;
+
+  // Next free ID is 15.
 }