@google-cloud/containeranalysis 6.2.0 → 6.3.0

package/README.md

@@ -44,7 +44,7 @@ Google APIs Client Libraries, in [Client Libraries Explained][explained].
 1.  [Select or create a Cloud Platform project][projects].
 1.  [Enable billing for your project][billing].
 1.  [Enable the Google Container Analysis API][enable_api].
-1.  [Set up authentication with a service account][auth] so you can access the
+1.  [Set up authentication][auth] so you can access the
     API from your local workstation.
 
 ### Installing the client library
@@ -174,4 +174,4 @@ See [LICENSE](https://github.com/googleapis/google-cloud-node/blob/main/LICENSE)
 [projects]: https://console.cloud.google.com/project
 [billing]: https://support.google.com/cloud/answer/6293499#enable-billing
 [enable_api]: https://console.cloud.google.com/flows/enableapi?apiid=containeranalysis.googleapis.com
-[auth]: https://cloud.google.com/docs/authentication/getting-started
+[auth]: https://cloud.google.com/docs/authentication/external/set-up-adc-local

package/build/protos/grafeas/v1/common.proto

@@ -49,6 +49,8 @@ enum NoteKind {
   VULNERABILITY_ASSESSMENT = 11;
   // This represents an SBOM Reference.
   SBOM_REFERENCE = 12;
+  // This represents a secret.
+  SECRET = 13;
 }
 
 // Metadata for any related URL information.
@@ -129,6 +131,35 @@ message FileLocation {
   // For jars that are contained inside .war files, this filepath
   // can indicate the path to war file combined with the path to jar file.
   string file_path = 1;
+  // Each package found in a file should have its own layer metadata (that is,
+  // information from the origin layer of the package).
+  LayerDetails layer_details = 2;
+}
+
+// BaseImage describes a base image of a container image.
+message BaseImage {
+  // The name of the base image.
+  string name = 1;
+  // The repository name in which the base image is from.
+  string repository = 2;
+  // The number of layers that the base image is composed of.
+  int32 layer_count = 3;
+}
+
+// Details about the layer a package was found in.
+message LayerDetails {
+  // The index of the layer in the container image.
+  int32 index = 1;
+  // The diff ID (typically a sha256 hash) of the layer in the container image.
+  string diff_id = 2;
+  // The layer chain ID (sha256 hash) of the layer in the container image.
+  // https://github.com/opencontainers/image-spec/blob/main/config.md#layer-chainid
+  string chain_id = 5;
+  // The layer build command that was used to build the layer. This may not be
+  // found in all layers depending on how the container image is built.
+  string command = 3;
+  // The base images the layer is found within.
+  repeated BaseImage base_images = 4;
 }
 
 // License information.

package/build/protos/grafeas/v1/grafeas.proto

@@ -33,6 +33,7 @@ import "grafeas/v1/dsse_attestation.proto";
 import "grafeas/v1/image.proto";
 import "grafeas/v1/package.proto";
 import "grafeas/v1/sbom.proto";
+import "grafeas/v1/secret.proto";
 import "grafeas/v1/upgrade.proto";
 import "grafeas/v1/vex.proto";
 import "grafeas/v1/vulnerability.proto";
@@ -296,6 +297,8 @@ message Occurrence {
     grafeas.v1.DSSEAttestationOccurrence dsse_attestation = 17;
     // Describes a specific SBOM reference occurrences.
     grafeas.v1.SBOMReferenceOccurrence sbom_reference = 19;
+    // Describes a secret.
+    grafeas.v1.SecretOccurrence secret = 20;
   }
 
   // https://github.com/secure-systems-lab/dsse
@@ -366,6 +369,8 @@ message Note {
     grafeas.v1.VulnerabilityAssessmentNote vulnerability_assessment = 20;
     // A note describing an SBOM reference.
     grafeas.v1.SBOMReferenceNote sbom_reference = 21;
+    // A note describing a secret.
+    grafeas.v1.SecretNote secret = 22;
   }
 }
 

package/build/protos/grafeas/v1/secret.proto

@@ -0,0 +1,90 @@
+// Copyright 2025 The Grafeas Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package grafeas.v1;
+
+import "google/api/field_behavior.proto";
+import "google/protobuf/timestamp.proto";
+import "grafeas/v1/common.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
+option java_multiple_files = true;
+option java_package = "io.grafeas.v1";
+option objc_class_prefix = "GRA";
+
+// The note representing a secret.
+message SecretNote {}
+
+// The occurrence provides details of a secret.
+message SecretOccurrence {
+  // Type of secret.
+  SecretKind kind = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Locations where the secret is detected.
+  repeated SecretLocation locations = 2
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Status of the secret.
+  repeated SecretStatus statuses = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// The location of the secret.
+message SecretLocation {
+  // The detailed location of the secret.
+  oneof location {
+    // The secret is found from a file.
+    FileLocation file_location = 1;
+  }
+}
+
+// The status of the secret with a timestamp.
+message SecretStatus {
+  // The status of the secret.
+  enum Status {
+    // Unspecified
+    STATUS_UNSPECIFIED = 0;
+
+    // The status of the secret is unknown.
+    UNKNOWN = 1;
+
+    // The secret is valid.
+    VALID = 2;
+
+    // The secret is invalid.
+    INVALID = 3;
+  }
+
+  // The status of the secret.
+  Status status = 1 [(google.api.field_behavior) = OPTIONAL];
+
+  // The time the secret status was last updated.
+  google.protobuf.Timestamp update_time = 2
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional message about the status code.
+  string message = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Kind of secret.
+enum SecretKind {
+  // Unspecified
+  SECRET_KIND_UNSPECIFIED = 0;
+  // The secret kind is unknown.
+  SECRET_KIND_UNKNOWN = 1;
+  // A GCP service account key per:
+  // https://cloud.google.com/iam/docs/creating-managing-service-account-keys
+  SECRET_KIND_GCP_SERVICE_ACCOUNT_KEY = 2;
+}