@google-cloud/containeranalysis 6.1.0 → 6.3.0

package/README.md

@@ -44,7 +44,7 @@ Google APIs Client Libraries, in [Client Libraries Explained][explained].
 1.  [Select or create a Cloud Platform project][projects].
 1.  [Enable billing for your project][billing].
 1.  [Enable the Google Container Analysis API][enable_api].
-1.  [Set up authentication with a service account][auth] so you can access the
+1.  [Set up authentication][auth] so you can access the
     API from your local workstation.
 
 ### Installing the client library
@@ -62,6 +62,7 @@ Samples are in the [`samples/`](https://github.com/googleapis/google-cloud-node/
 
 | Sample                      | Source Code                       | Try it |
 | --------------------------- | --------------------------------- | ------ |
+| Container_analysis.export_s_b_o_m | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-devtools-containeranalysis/samples/generated/v1/container_analysis.export_s_b_o_m.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/google-cloud-node&page=editor&open_in_editor=packages/google-devtools-containeranalysis/samples/generated/v1/container_analysis.export_s_b_o_m.js,packages/google-devtools-containeranalysis/samples/README.md) |
 | Container_analysis.get_iam_policy | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-devtools-containeranalysis/samples/generated/v1/container_analysis.get_iam_policy.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/google-cloud-node&page=editor&open_in_editor=packages/google-devtools-containeranalysis/samples/generated/v1/container_analysis.get_iam_policy.js,packages/google-devtools-containeranalysis/samples/README.md) |
 | Container_analysis.get_vulnerability_occurrences_summary | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-devtools-containeranalysis/samples/generated/v1/container_analysis.get_vulnerability_occurrences_summary.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/google-cloud-node&page=editor&open_in_editor=packages/google-devtools-containeranalysis/samples/generated/v1/container_analysis.get_vulnerability_occurrences_summary.js,packages/google-devtools-containeranalysis/samples/README.md) |
 | Container_analysis.set_iam_policy | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-devtools-containeranalysis/samples/generated/v1/container_analysis.set_iam_policy.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/google-cloud-node&page=editor&open_in_editor=packages/google-devtools-containeranalysis/samples/generated/v1/container_analysis.set_iam_policy.js,packages/google-devtools-containeranalysis/samples/README.md) |
@@ -173,4 +174,4 @@ See [LICENSE](https://github.com/googleapis/google-cloud-node/blob/main/LICENSE)
 [projects]: https://console.cloud.google.com/project
 [billing]: https://support.google.com/cloud/answer/6293499#enable-billing
 [enable_api]: https://console.cloud.google.com/flows/enableapi?apiid=containeranalysis.googleapis.com
-[auth]: https://cloud.google.com/docs/authentication/getting-started
+[auth]: https://cloud.google.com/docs/authentication/external/set-up-adc-local

package/build/protos/google/devtools/containeranalysis/v1/containeranalysis.proto

@@ -29,8 +29,8 @@ option go_package = "cloud.google.com/go/containeranalysis/apiv1/containeranalys
 option java_multiple_files = true;
 option java_package = "com.google.containeranalysis.v1";
 option objc_class_prefix = "GCA";
-option ruby_package = "Google::Cloud::ContainerAnalysis::V1";
 option php_namespace = "Google\\Cloud\\ContainerAnalysis\\V1";
+option ruby_package = "Google::Cloud::ContainerAnalysis::V1";
 
 // Retrieves analysis results of Cloud components such as Docker container
 // images. The Container Analysis API is an implementation of the
@@ -47,7 +47,8 @@ option php_namespace = "Google\\Cloud\\ContainerAnalysis\\V1";
 // image with the vulnerability referring to that note.
 service ContainerAnalysis {
   option (google.api.default_host) = "containeranalysis.googleapis.com";
-  option (google.api.oauth_scopes) = "https://www.googleapis.com/auth/cloud-platform";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/cloud-platform";
 
   // Sets the access control policy on the specified note or occurrence.
   // Requires `containeranalysis.notes.setIamPolicy` or
@@ -57,7 +58,8 @@ service ContainerAnalysis {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest) returns (google.iam.v1.Policy) {
+  rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest)
+      returns (google.iam.v1.Policy) {
     option (google.api.http) = {
       post: "/v1/{resource=projects/*/notes/*}:setIamPolicy"
       body: "*"
@@ -65,6 +67,14 @@ service ContainerAnalysis {
         post: "/v1/{resource=projects/*/occurrences/*}:setIamPolicy"
         body: "*"
       }
+      additional_bindings {
+        post: "/v1/{resource=projects/*/locations/*/notes/*}:setIamPolicy"
+        body: "*"
+      }
+      additional_bindings {
+        post: "/v1/{resource=projects/*/locations/*/occurrences/*}:setIamPolicy"
+        body: "*"
+      }
     };
     option (google.api.method_signature) = "resource,policy";
   }
@@ -77,7 +87,8 @@ service ContainerAnalysis {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest) returns (google.iam.v1.Policy) {
+  rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest)
+      returns (google.iam.v1.Policy) {
     option (google.api.http) = {
       post: "/v1/{resource=projects/*/notes/*}:getIamPolicy"
       body: "*"
@@ -85,6 +96,14 @@ service ContainerAnalysis {
         post: "/v1/{resource=projects/*/occurrences/*}:getIamPolicy"
         body: "*"
       }
+      additional_bindings {
+        post: "/v1/{resource=projects/*/locations/*/notes/*}:getIamPolicy"
+        body: "*"
+      }
+      additional_bindings {
+        post: "/v1/{resource=projects/*/locations/*/occurrences/*}:getIamPolicy"
+        body: "*"
+      }
     };
     option (google.api.method_signature) = "resource";
   }
@@ -96,7 +115,8 @@ service ContainerAnalysis {
   // The resource takes the format `projects/[PROJECT_ID]/notes/[NOTE_ID]` for
   // notes and `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]` for
   // occurrences.
-  rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest) returns (google.iam.v1.TestIamPermissionsResponse) {
+  rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest)
+      returns (google.iam.v1.TestIamPermissionsResponse) {
     option (google.api.http) = {
       post: "/v1/{resource=projects/*/notes/*}:testIamPermissions"
       body: "*"
@@ -104,23 +124,76 @@ service ContainerAnalysis {
         post: "/v1/{resource=projects/*/occurrences/*}:testIamPermissions"
         body: "*"
       }
+      additional_bindings {
+        post: "/v1/{resource=projects/*/locations/*/notes/*}:testIamPermissions"
+        body: "*"
+      }
+      additional_bindings {
+        post: "/v1/{resource=projects/*/locations/*/occurrences/*}:testIamPermissions"
+        body: "*"
+      }
     };
     option (google.api.method_signature) = "resource,permissions";
   }
 
   // Gets a summary of the number and severity of occurrences.
-  rpc GetVulnerabilityOccurrencesSummary(GetVulnerabilityOccurrencesSummaryRequest) returns (VulnerabilityOccurrencesSummary) {
+  rpc GetVulnerabilityOccurrencesSummary(
+      GetVulnerabilityOccurrencesSummaryRequest)
+      returns (VulnerabilityOccurrencesSummary) {
     option (google.api.http) = {
       get: "/v1/{parent=projects/*}/occurrences:vulnerabilitySummary"
+      additional_bindings {
+        get: "/v1/{parent=projects/*/locations/*}/occurrences:vulnerabilitySummary"
+      }
     };
     option (google.api.method_signature) = "parent,filter";
   }
+
+  // Generates an SBOM for the given resource.
+  rpc ExportSBOM(ExportSBOMRequest) returns (ExportSBOMResponse) {
+    option (google.api.http) = {
+      post: "/v1/{name=projects/*/resources/**}:exportSBOM"
+      body: "*"
+      additional_bindings {
+        post: "/v1/{name=projects/*/locations/*/resources/**}:exportSBOM"
+        body: "*"
+      }
+    };
+  }
+}
+
+// The request to generate and export SBOM. Target must be specified for the
+// request.
+message ExportSBOMRequest {
+  // Empty placeholder to denote that this is a Google Cloud Storage
+  // export request.
+  message CloudStorageLocation {}
+
+  // Required. The name of the resource in the form of
+  // `projects/[PROJECT_ID]/resources/[RESOURCE_URL]`.
+  string name = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // The location of the SBOM export.
+  oneof target {
+    // Optional. Empty placeholder to denote that this is a Google Cloud Storage
+    // export request.
+    CloudStorageLocation cloud_storage_location = 2
+        [(google.api.field_behavior) = OPTIONAL];
+  }
+}
+
+// The response from a call to ExportSBOM.
+message ExportSBOMResponse {
+  // The name of the discovery occurrence in the form
+  // "projects/{project_id}/occurrences/{OCCURRENCE_ID}
+  // It can be used to track the progress of the SBOM export.
+  string discovery_occurrence = 1;
 }
 
 // Request to get a vulnerability summary for some set of occurrences.
 message GetVulnerabilityOccurrencesSummaryRequest {
-  // Required. The name of the project to get a vulnerability summary for in the form of
-  // `projects/[PROJECT_ID]`.
+  // Required. The name of the project to get a vulnerability summary for in the
+  // form of `projects/[PROJECT_ID]`.
   string parent = 1 [
     (google.api.field_behavior) = REQUIRED,
     (google.api.resource_reference) = {

package/build/protos/google/devtools/containeranalysis/v1beta1/containeranalysis.proto

@@ -62,6 +62,14 @@ service ContainerAnalysisV1Beta1 {
         post: "/v1beta1/{resource=projects/*/occurrences/*}:setIamPolicy"
         body: "*"
       }
+      additional_bindings {
+        post: "/v1beta1/{resource=projects/*/locations/*/notes/*}:setIamPolicy"
+        body: "*"
+      }
+      additional_bindings {
+        post: "/v1beta1/{resource=projects/*/locations/*/occurrences/*}:setIamPolicy"
+        body: "*"
+      }
     };
     option (google.api.method_signature) = "resource,policy";
   }
@@ -83,6 +91,14 @@ service ContainerAnalysisV1Beta1 {
         post: "/v1beta1/{resource=projects/*/occurrences/*}:getIamPolicy"
         body: "*"
       }
+      additional_bindings {
+        post: "/v1beta1/{resource=projects/*/locations/*/notes/*}:getIamPolicy"
+        body: "*"
+      }
+      additional_bindings {
+        post: "/v1beta1/{resource=projects/*/locations/*/occurrences/*}:getIamPolicy"
+        body: "*"
+      }
     };
     option (google.api.method_signature) = "resource";
   }
@@ -103,6 +119,14 @@ service ContainerAnalysisV1Beta1 {
         post: "/v1beta1/{resource=projects/*/occurrences/*}:testIamPermissions"
         body: "*"
       }
+      additional_bindings {
+        post: "/v1beta1/{resource=projects/*/locations/*/notes/*}:testIamPermissions"
+        body: "*"
+      }
+      additional_bindings {
+        post: "/v1beta1/{resource=projects/*/locations/*/occurrences/*}:testIamPermissions"
+        body: "*"
+      }
     };
     option (google.api.method_signature) = "resource,permissions";
   }
@@ -113,6 +137,10 @@ service ContainerAnalysisV1Beta1 {
     option (google.api.http) = {
       post: "/v1beta1/{name=projects/*/resources/**}:generatePackagesSummary"
       body: "*"
+      additional_bindings {
+        post: "/v1beta1/{name=projects/*/locations/*/resources/**}:generatePackagesSummary"
+        body: "*"
+      }
     };
   }
 
@@ -121,6 +149,10 @@ service ContainerAnalysisV1Beta1 {
     option (google.api.http) = {
       post: "/v1beta1/{name=projects/*/resources/**}:exportSBOM"
       body: "*"
+      additional_bindings {
+        post: "/v1beta1/{name=projects/*/locations/*/resources/**}:exportSBOM"
+        body: "*"
+      }
     };
   }
 }

package/build/protos/grafeas/v1/common.proto

@@ -49,6 +49,8 @@ enum NoteKind {
   VULNERABILITY_ASSESSMENT = 11;
   // This represents an SBOM Reference.
   SBOM_REFERENCE = 12;
+  // This represents a secret.
+  SECRET = 13;
 }
 
 // Metadata for any related URL information.
@@ -129,6 +131,35 @@ message FileLocation {
   // For jars that are contained inside .war files, this filepath
   // can indicate the path to war file combined with the path to jar file.
   string file_path = 1;
+  // Each package found in a file should have its own layer metadata (that is,
+  // information from the origin layer of the package).
+  LayerDetails layer_details = 2;
+}
+
+// BaseImage describes a base image of a container image.
+message BaseImage {
+  // The name of the base image.
+  string name = 1;
+  // The repository name in which the base image is from.
+  string repository = 2;
+  // The number of layers that the base image is composed of.
+  int32 layer_count = 3;
+}
+
+// Details about the layer a package was found in.
+message LayerDetails {
+  // The index of the layer in the container image.
+  int32 index = 1;
+  // The diff ID (typically a sha256 hash) of the layer in the container image.
+  string diff_id = 2;
+  // The layer chain ID (sha256 hash) of the layer in the container image.
+  // https://github.com/opencontainers/image-spec/blob/main/config.md#layer-chainid
+  string chain_id = 5;
+  // The layer build command that was used to build the layer. This may not be
+  // found in all layers depending on how the container image is built.
+  string command = 3;
+  // The base images the layer is found within.
+  repeated BaseImage base_images = 4;
 }
 
 // License information.

package/build/protos/grafeas/v1/grafeas.proto

@@ -33,6 +33,7 @@ import "grafeas/v1/dsse_attestation.proto";
 import "grafeas/v1/image.proto";
 import "grafeas/v1/package.proto";
 import "grafeas/v1/sbom.proto";
+import "grafeas/v1/secret.proto";
 import "grafeas/v1/upgrade.proto";
 import "grafeas/v1/vex.proto";
 import "grafeas/v1/vulnerability.proto";
@@ -296,6 +297,8 @@ message Occurrence {
     grafeas.v1.DSSEAttestationOccurrence dsse_attestation = 17;
     // Describes a specific SBOM reference occurrences.
     grafeas.v1.SBOMReferenceOccurrence sbom_reference = 19;
+    // Describes a secret.
+    grafeas.v1.SecretOccurrence secret = 20;
   }
 
   // https://github.com/secure-systems-lab/dsse
@@ -366,6 +369,8 @@ message Note {
     grafeas.v1.VulnerabilityAssessmentNote vulnerability_assessment = 20;
     // A note describing an SBOM reference.
     grafeas.v1.SBOMReferenceNote sbom_reference = 21;
+    // A note describing a secret.
+    grafeas.v1.SecretNote secret = 22;
   }
 }
 

package/build/protos/grafeas/v1/secret.proto

@@ -0,0 +1,90 @@
+// Copyright 2025 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package grafeas.v1;
+
+import "google/api/field_behavior.proto";
+import "google/protobuf/timestamp.proto";
+import "grafeas/v1/common.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+
+// The note representing a secret.
+message SecretNote {}
+
+// The occurrence provides details of a secret.
+message SecretOccurrence {
+  // Type of secret.
+  SecretKind kind = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Locations where the secret is detected.
+  repeated SecretLocation locations = 2
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Status of the secret.
+  repeated SecretStatus statuses = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// The location of the secret.
+message SecretLocation {
+  // The detailed location of the secret.
+  oneof location {
+    // The secret is found from a file.
+    FileLocation file_location = 1;
+  }
+}
+
+// The status of the secret with a timestamp.
+message SecretStatus {
+  // The status of the secret.
+  enum Status {
+    // Unspecified
+    STATUS_UNSPECIFIED = 0;
+
+    // The status of the secret is unknown.
+    UNKNOWN = 1;
+
+    // The secret is valid.
+    VALID = 2;
+
+    // The secret is invalid.
+    INVALID = 3;
+  }
+
+  // The status of the secret.
+  Status status = 1 [(google.api.field_behavior) = OPTIONAL];
+
+  // The time the secret status was last updated.
+  google.protobuf.Timestamp update_time = 2
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional message about the status code.
+  string message = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Kind of secret.
+enum SecretKind {
+  // Unspecified
+  SECRET_KIND_UNSPECIFIED = 0;
+  // The secret kind is unknown.
+  SECRET_KIND_UNKNOWN = 1;
+  // A GCP service account key per:
+  // https://cloud.google.com/iam/docs/creating-managing-service-account-keys
+  SECRET_KIND_GCP_SERVICE_ACCOUNT_KEY = 2;
+}