pulumi-google-native-kotlin/com.pulumi.googlenative.containeranalysis.v1alpha1.kotlin.outputs

Package-level declarations

Types

AnalysisCompletedResponse

data class AnalysisCompletedResponse(val analysisType: List<String>)

Indicates which analysis completed successfully. Multiple types of analysis can be performed on a single resource.

ArtifactResponse

data class ArtifactResponse(val checksum: String, val name: String, val names: List<String>)

Artifact describes a build product.

AssessmentResponse

data class AssessmentResponse(val cve: String, val impacts: List<String>, val justification: JustificationResponse, val longDescription: String, val relatedUris: List<URIResponse>, val remediations: List<RemediationResponse>, val shortDescription: String, val state: String)

Assessment provides all information that is related to a single vulnerability for this product.

AttestationAuthorityHintResponse

data class AttestationAuthorityHintResponse(val humanReadableName: String)

This submessage provides human-readable hints about the purpose of the AttestationAuthority. Because the name of a Note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from "readable" names more suitable for debug output. Note that these hints should NOT be used to look up AttestationAuthorities in security sensitive contexts, such as when looking up Attestations to verify.

AttestationAuthorityResponse

data class AttestationAuthorityResponse(val hint: AttestationAuthorityHintResponse)

Note kind that represents a logical attestation "role" or "authority". For example, an organization might have one AttestationAuthority for "QA" and one for "build". This Note is intended to act strictly as a grouping mechanism for the attached Occurrences (Attestations). This grouping mechanism also provides a security boundary, since IAM ACLs gate the ability for a principle to attach an Occurrence to a given Note. It also provides a single point of lookup to find all attached Attestation Occurrences, even if they don't all live in the same project.

AttestationResponse

data class AttestationResponse(val pgpSignedAttestation: PgpSignedAttestationResponse)

Occurrence that represents a single "attestation". The authenticity of an Attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the AttestationAuthority to which this Attestation is attached is primarily useful for look-up (how to find this Attestation if you already know the Authority and artifact to be verified) and intent (which authority was this attestation intended to sign for).

BasisResponse

data class BasisResponse(val fingerprint: FingerprintResponse, val resourceUrl: String)

Basis describes the base image portion (Note) of the DockerImage relationship. Linked occurrences are derived from this or an equivalent image via: FROM Or an equivalent reference, e.g. a tag of the resource_url.

BindingResponse

data class BindingResponse(val condition: ExprResponse, val members: List<String>, val role: String)

Associates members, or principals, with a role.

BuildDetailsResponse

data class BuildDetailsResponse(val intotoProvenance: InTotoProvenanceResponse, val intotoStatement: InTotoStatementResponse, val provenance: BuildProvenanceResponse, val provenanceBytes: String)

Message encapsulating build provenance details.

BuilderConfigResponse

class BuilderConfigResponse

BuildProvenanceResponse

data class BuildProvenanceResponse(val buildOptions: Map<String, String>, val builderVersion: String, val builtArtifacts: List<ArtifactResponse>, val commands: List<CommandResponse>, val createTime: String, val creator: String, val finishTime: String, val logsBucket: String, val project: String, val sourceProvenance: SourceResponse, val startTime: String, val triggerId: String)

Provenance of a build. Contains all information needed to verify the full details about the build from source to completion.

BuildSignatureResponse

data class BuildSignatureResponse(val keyId: String, val keyType: String, val publicKey: String, val signature: String)

Message encapsulating the signature of the verified build.

BuildTypeResponse

data class BuildTypeResponse(val builderVersion: String, val signature: BuildSignatureResponse)

Note holding the version of the provider's builder and the signature of the provenance message in linked BuildDetails.

CisBenchmarkResponse

data class CisBenchmarkResponse(val profileLevel: Int, val severity: String)

A compliance check that is a CIS benchmark.

CommandResponse

data class CommandResponse(val args: List<String>, val dir: String, val env: List<String>, val name: String, val waitFor: List<String>)

Command describes a step performed as part of the build pipeline.

CompletenessResponse

data class CompletenessResponse(val arguments: Boolean, val environment: Boolean, val materials: Boolean)

Indicates that the builder claims certain fields in this message to be complete.

ComplianceNoteResponse

data class ComplianceNoteResponse(val cisBenchmark: CisBenchmarkResponse, val description: String, val rationale: String, val remediation: String, val scanInstructions: String, val title: String, val version: List<ComplianceVersionResponse>)

ComplianceNote encapsulates all information about a specific compliance check.

ComplianceOccurrenceResponse

data class ComplianceOccurrenceResponse(val nonComplianceReason: String, val nonCompliantFiles: List<NonCompliantFileResponse>)

An indication that the compliance checks in the associated ComplianceNote were not satisfied for particular resources or a specified reason.

ComplianceVersionResponse

data class ComplianceVersionResponse(val benchmarkDocument: String, val cpeUri: String, val version: String)

Describes the CIS benchmark version that is applicable to a given OS and os version.

CVSSResponse

data class CVSSResponse(val attackComplexity: String, val attackVector: String, val authentication: String, val availabilityImpact: String, val baseScore: Double, val confidentialityImpact: String, val exploitabilityScore: Double, val impactScore: Double, val integrityImpact: String, val privilegesRequired: String, val scope: String, val userInteraction: String)

Common Vulnerability Scoring System. This message is compatible with CVSS v2 and v3. For CVSS v2 details, see https://www.first.org/cvss/v2/guide CVSS v2 calculator: https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator For CVSS v3 details, see https://www.first.org/cvss/specification-document CVSS v3 calculator: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

DeployableResponse

data class DeployableResponse(val resourceUri: List<String>)

An artifact that can be deployed in some runtime.

DeploymentResponse

data class DeploymentResponse(val address: String, val config: String, val deployTime: String, val platform: String, val resourceUri: List<String>, val undeployTime: String, val userEmail: String)

The period during which some deployable was active in a runtime.

DerivedResponse

data class DerivedResponse(val baseResourceUrl: String, val distance: Int, val fingerprint: FingerprintResponse, val layerInfo: List<LayerResponse>)

Derived describes the derived image portion (Occurrence) of the DockerImage relationship. This image would be produced from a Dockerfile with FROM .

DetailResponse

data class DetailResponse(val cpeUri: String, val description: String, val fixedLocation: VulnerabilityLocationResponse, val isObsolete: Boolean, val maxAffectedVersion: VersionResponse, val minAffectedVersion: VersionResponse, val package: String, val packageType: String, val severityName: String, val source: String, val vendor: String)

Identifies all occurrences of this vulnerability in the package for a specific distro/location For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

DigestResponse

data class DigestResponse(val algo: String, val digestBytes: String)

Digest information.

DiscoveredResponse

data class DiscoveredResponse(val analysisCompleted: AnalysisCompletedResponse, val analysisError: List<StatusResponse>, val analysisStatus: String, val analysisStatusError: StatusResponse, val archiveTime: String, val continuousAnalysis: String, val cpe: String, val lastScanTime: String, val operation: OperationResponse)

Provides information about the scan status of a discovered resource.

DiscoveryResponse

data class DiscoveryResponse(val analysisKind: String)

A note that indicates a type of analysis a provider would perform. This note exists in a provider's project. A Discovery occurrence is created in a consumer's project at the start of analysis. The occurrence's operation will indicate the status of the analysis. Absence of an occurrence linked to this note for a resource indicates that analysis hasn't started.

DistributionResponse

data class DistributionResponse(val architecture: String, val cpeUri: String, val description: String, val latestVersion: VersionResponse, val maintainer: String, val url: String)

This represents a particular channel of distribution for a given package. e.g. Debian's jessie-backports dpkg mirror

DocumentNoteResponse

data class DocumentNoteResponse(val dataLicence: String, val spdxVersion: String)

DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/

DocumentOccurrenceResponse

data class DocumentOccurrenceResponse(val createTime: String, val creatorComment: String, val creators: List<String>, val documentComment: String, val externalDocumentRefs: List<String>, val licenseListVersion: String, val namespace: String, val title: String)

DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/

DSSEAttestationNoteResponse

data class DSSEAttestationNoteResponse(val hint: DSSEHintResponse)

A note describing an attestation

DSSEAttestationOccurrenceResponse

data class DSSEAttestationOccurrenceResponse(val envelope: EnvelopeResponse, val statement: InTotoStatementResponse)

An occurrence describing an attestation on a resource

DSSEHintResponse

data class DSSEHintResponse(val humanReadableName: String)

This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from "readable" names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.

EnvelopeResponse

data class EnvelopeResponse(val payload: String, val payloadType: String, val signatures: List<EnvelopeSignatureResponse>)

MUST match https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An authenticated message of arbitrary type.

EnvelopeSignatureResponse

data class EnvelopeSignatureResponse(val keyid: String, val sig: String)

A DSSE signature

ExprResponse

data class ExprResponse(val description: String, val expression: String, val location: String, val title: String)

Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.

ExternalRefResponse

data class ExternalRefResponse(val category: String, val comment: String, val locator: String, val type: String)

An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package

FileLocationResponse

data class FileLocationResponse(val filePath: String)

Indicates the location at which a package was found.

FileNoteResponse

data class FileNoteResponse(val checksum: List<String>, val fileType: String, val title: String)

FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/

FileOccurrenceResponse

data class FileOccurrenceResponse(val attributions: List<String>, val comment: String, val contributors: List<String>, val copyright: String, val filesLicenseInfo: List<String>, val licenseConcluded: LicenseResponse, val notice: String)

FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/

FingerprintResponse

data class FingerprintResponse(val v1Name: String, val v2Blob: List<String>, val v2Name: String)

A set of properties that uniquely identify a given Docker image.

GetNoteIamPolicyResult

data class GetNoteIamPolicyResult(val bindings: List<BindingResponse>, val etag: String, val version: Int)

GetNoteResult

data class GetNoteResult(val attestationAuthority: AttestationAuthorityResponse, val baseImage: BasisResponse, val buildType: BuildTypeResponse, val compliance: ComplianceNoteResponse, val createTime: String, val deployable: DeployableResponse, val discovery: DiscoveryResponse, val dsseAttestation: DSSEAttestationNoteResponse, val expirationTime: String, val kind: String, val longDescription: String, val name: String, val package: PackageResponse, val relatedUrl: List<RelatedUrlResponse>, val sbom: DocumentNoteResponse, val sbomReference: SBOMReferenceNoteResponse, val shortDescription: String, val spdxFile: FileNoteResponse, val spdxPackage: PackageInfoNoteResponse, val spdxRelationship: RelationshipNoteResponse, val updateTime: String, val upgrade: UpgradeNoteResponse, val vulnerabilityAssessment: VulnerabilityAssessmentNoteResponse, val vulnerabilityType: VulnerabilityTypeResponse)

GetOccurrenceIamPolicyResult

data class GetOccurrenceIamPolicyResult(val bindings: List<BindingResponse>, val etag: String, val version: Int)

GetOccurrenceResult

GetProviderNoteIamPolicyResult

data class GetProviderNoteIamPolicyResult(val bindings: List<BindingResponse>, val etag: String, val version: Int)

GoogleDevtoolsContaineranalysisV1alpha1AliasContextResponse

data class GoogleDevtoolsContaineranalysisV1alpha1AliasContextResponse(val kind: String, val name: String)

An alias to a repo revision.

GoogleDevtoolsContaineranalysisV1alpha1CloudRepoSourceContextResponse

data class GoogleDevtoolsContaineranalysisV1alpha1CloudRepoSourceContextResponse(val aliasContext: GoogleDevtoolsContaineranalysisV1alpha1AliasContextResponse, val repoId: GoogleDevtoolsContaineranalysisV1alpha1RepoIdResponse, val revisionId: String)

A CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.

GoogleDevtoolsContaineranalysisV1alpha1GerritSourceContextResponse

data class GoogleDevtoolsContaineranalysisV1alpha1GerritSourceContextResponse(val aliasContext: GoogleDevtoolsContaineranalysisV1alpha1AliasContextResponse, val gerritProject: String, val hostUri: String, val revisionId: String)

A SourceContext referring to a Gerrit project.

GoogleDevtoolsContaineranalysisV1alpha1GitSourceContextResponse

data class GoogleDevtoolsContaineranalysisV1alpha1GitSourceContextResponse(val revisionId: String, val url: String)

A GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).

GoogleDevtoolsContaineranalysisV1alpha1ProjectRepoIdResponse

data class GoogleDevtoolsContaineranalysisV1alpha1ProjectRepoIdResponse(val project: String, val repoName: String)

Selects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.

GoogleDevtoolsContaineranalysisV1alpha1RepoIdResponse

data class GoogleDevtoolsContaineranalysisV1alpha1RepoIdResponse(val projectRepoId: GoogleDevtoolsContaineranalysisV1alpha1ProjectRepoIdResponse, val uid: String)

A unique identifier for a Cloud Repo.

GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaBuilderResponse

class GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaBuilderResponse

Identifies the entity that executed the recipe, which is trusted to have correctly performed the operation and populated this provenance.

GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaCompletenessResponse

data class GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaCompletenessResponse(val environment: Boolean, val materials: Boolean, val parameters: Boolean)

Indicates that the builder claims certain fields in this message to be complete.

GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaConfigSourceResponse

data class GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaConfigSourceResponse(val digest: Map<String, String>, val entryPoint: String, val uri: String)

Describes where the config file that kicked off the build came from. This is effectively a pointer to the source where buildConfig came from.

GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaInvocationResponse

data class GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaInvocationResponse(val configSource: GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaConfigSourceResponse, val environment: Map<String, String>, val parameters: Map<String, String>)

Identifies the event that kicked off the build.

GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaMaterialResponse

data class GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaMaterialResponse(val digest: Map<String, String>, val uri: String)

The collection of artifacts that influenced the build including sources, dependencies, build tools, base images, and so on.

GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaMetadataResponse

data class GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaMetadataResponse(val buildFinishedOn: String, val buildInvocationId: String, val buildStartedOn: String, val completeness: GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaCompletenessResponse, val reproducible: Boolean)

Other properties of the build.

GoogleDevtoolsContaineranalysisV1alpha1SourceContextResponse

data class GoogleDevtoolsContaineranalysisV1alpha1SourceContextResponse(val cloudRepo: GoogleDevtoolsContaineranalysisV1alpha1CloudRepoSourceContextResponse, val gerrit: GoogleDevtoolsContaineranalysisV1alpha1GerritSourceContextResponse, val git: GoogleDevtoolsContaineranalysisV1alpha1GitSourceContextResponse, val labels: Map<String, String>)

A SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.

HashResponse

data class HashResponse(val type: String, val value: String)

Container message for hash values.

IdentifierHelperResponse

data class IdentifierHelperResponse(val field: String, val genericUri: String)

Helps in identifying the underlying product. This should be treated like a one-of field. Only one field should be set in this proto. This is a workaround because spanner indexes on one-of fields restrict addition and deletion of fields.

InstallationResponse

data class InstallationResponse(val architecture: String, val cpeUri: String, val license: LicenseResponse, val location: List<LocationResponse>, val name: String, val packageType: String, val version: VersionResponse)

This represents how a particular software package may be installed on a system.

InTotoProvenanceResponse

data class InTotoProvenanceResponse(val builderConfig: BuilderConfigResponse, val materials: List<String>, val metadata: MetadataResponse, val recipe: RecipeResponse)

InTotoStatementResponse

data class InTotoStatementResponse(val predicateType: String, val provenance: InTotoProvenanceResponse, val slsaProvenance: SlsaProvenanceResponse, val slsaProvenanceZeroTwo: SlsaProvenanceZeroTwoResponse, val subject: List<SubjectResponse>, val type: String)

Spec defined at https://github.com/in-toto/attestation/tree/main/spec#statement The serialized InTotoStatement will be stored as Envelope.payload. Envelope.payloadType is always "application/vnd.in-toto+json".

JustificationResponse

data class JustificationResponse(val details: String, val justificationType: String)

Justification provides the justification when the state of the assessment if NOT_AFFECTED.

LayerResponse

data class LayerResponse(val arguments: String, val directive: String)

Layer holds metadata specific to a layer of a Docker image.

LicenseResponse

data class LicenseResponse(val comments: String, val expression: String)

License information.

LocationResponse

data class LocationResponse(val cpeUri: String, val path: String, val version: VersionResponse)

An occurrence of a particular package installation found within a system's filesystem. e.g. glibc was found in /var/lib/dpkg/status

MaterialResponse

data class MaterialResponse(val digest: Map<String, String>, val uri: String)

Material is a material used in the generation of the provenance

MetadataResponse

data class MetadataResponse(val buildFinishedOn: String, val buildInvocationId: String, val buildStartedOn: String, val completeness: CompletenessResponse, val reproducible: Boolean)

Other properties of the build.

NonCompliantFileResponse

data class NonCompliantFileResponse(val displayCommand: String, val path: String, val reason: String)

Details about files that caused a compliance check to fail.

OperationResponse

data class OperationResponse(val done: Boolean, val error: StatusResponse, val metadata: Map<String, String>, val name: String, val response: Map<String, String>)

This resource represents a long-running operation that is the result of a network API call.

PackageInfoNoteResponse

data class PackageInfoNoteResponse(val analyzed: Boolean, val attribution: String, val checksum: String, val copyright: String, val detailedDescription: String, val downloadLocation: String, val externalRefs: List<ExternalRefResponse>, val filesLicenseInfo: List<String>, val homePage: String, val licenseDeclared: LicenseResponse, val originator: String, val packageType: String, val summaryDescription: String, val supplier: String, val title: String, val verificationCode: String, val version: String)

PackageInfoNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/

PackageInfoOccurrenceResponse

data class PackageInfoOccurrenceResponse(val comment: String, val filename: String, val homePage: String, val licenseConcluded: LicenseResponse, val packageType: String, val sourceInfo: String, val summaryDescription: String, val title: String, val version: String)

PackageInfoOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/

PackageIssueResponse

data class PackageIssueResponse(val affectedLocation: VulnerabilityLocationResponse, val effectiveSeverity: String, val fixedLocation: VulnerabilityLocationResponse, val packageType: String, val severityName: String)

This message wraps a location affected by a vulnerability and its associated fix (if one is available).

PackageResponse

data class PackageResponse(val architecture: String, val cpeUri: String, val description: String, val digest: List<DigestResponse>, val distribution: List<DistributionResponse>, val license: LicenseResponse, val maintainer: String, val name: String, val packageType: String, val url: String, val version: VersionResponse)

This represents a particular package that is distributed over various channels. e.g. glibc (aka libc6) is distributed by many, at various versions.

PgpSignedAttestationResponse

data class PgpSignedAttestationResponse(val contentType: String, val pgpKeyId: String, val signature: String)

An attestation wrapper with a PGP-compatible signature. This message only supports ATTACHED signatures, where the payload that is signed is included alongside the signature itself in the same file.

ProductResponse

data class ProductResponse(val identifierHelper: IdentifierHelperResponse, val name: String)

Product contains information about a product and how to uniquely identify it.

PublisherResponse

data class PublisherResponse(val issuingAuthority: String, val name: String, val publisherNamespace: String)

Publisher contains information about the publisher of this Note.

RecipeResponse

data class RecipeResponse(val arguments: List<Map<String, String>>, val definedInMaterial: String, val entryPoint: String, val environment: List<Map<String, String>>, val type: String)

Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.

RelatedUrlResponse

data class RelatedUrlResponse(val label: String, val url: String)

Metadata for any related URL information

RelationshipNoteResponse

data class RelationshipNoteResponse(val type: String)

RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/

RelationshipOccurrenceResponse

data class RelationshipOccurrenceResponse(val comment: String, val source: String, val target: String, val type: String)

RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/

RemediationResponse

data class RemediationResponse(val details: String, val remediationType: String, val remediationUri: URIResponse)

Specifies details on how to handle (and presumably, fix) a vulnerability.

RepoSourceResponse

data class RepoSourceResponse(val branchName: String, val commitSha: String, val project: String, val repoName: String, val tagName: String)

RepoSource describes the location of the source in a Google Cloud Source Repository.

ResourceResponse

data class ResourceResponse(val contentHash: HashResponse, val name: String, val uri: String)

Resource is an entity that can have metadata. E.g., a Docker image.

SbomReferenceIntotoPayloadResponse

data class SbomReferenceIntotoPayloadResponse(val predicate: SbomReferenceIntotoPredicateResponse, val predicateType: String, val subject: List<SubjectResponse>, val type: String)

The actual payload that contains the SBOM Reference data. The payload follows the intoto statement specification. See https://github.com/in-toto/attestation/blob/main/spec/v1.0/statement.md for more details.

SbomReferenceIntotoPredicateResponse

data class SbomReferenceIntotoPredicateResponse(val digest: Map<String, String>, val location: String, val mimeType: String, val referrerId: String)

A predicate which describes the SBOM being referenced.

SBOMReferenceNoteResponse

data class SBOMReferenceNoteResponse(val format: String, val version: String)

The note representing an SBOM reference.

SBOMReferenceOccurrenceResponse

data class SBOMReferenceOccurrenceResponse(val payload: SbomReferenceIntotoPayloadResponse, val payloadType: String, val signatures: List<EnvelopeSignatureResponse>)

The occurrence representing an SBOM reference as applied to a specific resource. The occurrence follows the DSSE specification. See https://github.com/secure-systems-lab/dsse/blob/master/envelope.md for more details.

SlsaBuilderResponse

class SlsaBuilderResponse

SlsaBuilder encapsulates the identity of the builder of this provenance.

SlsaCompletenessResponse

data class SlsaCompletenessResponse(val arguments: Boolean, val environment: Boolean, val materials: Boolean)

Indicates that the builder claims certain fields in this message to be complete.

SlsaMetadataResponse

data class SlsaMetadataResponse(val buildFinishedOn: String, val buildInvocationId: String, val buildStartedOn: String, val completeness: SlsaCompletenessResponse, val reproducible: Boolean)

Other properties of the build.

SlsaProvenanceResponse

data class SlsaProvenanceResponse(val builder: SlsaBuilderResponse, val materials: List<MaterialResponse>, val metadata: SlsaMetadataResponse, val recipe: SlsaRecipeResponse)

SlsaProvenance is the slsa provenance as defined by the slsa spec.

SlsaProvenanceZeroTwoResponse

data class SlsaProvenanceZeroTwoResponse(val buildConfig: Map<String, String>, val buildType: String, val builder: GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaBuilderResponse, val invocation: GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaInvocationResponse, val materials: List<GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaMaterialResponse>, val metadata: GoogleDevtoolsContaineranalysisV1alpha1SlsaProvenanceZeroTwoSlsaMetadataResponse)

SlsaProvenanceZeroTwo is the slsa provenance as defined by the slsa spec. See full explanation of fields at slsa.dev/provenance/v0.2.

SlsaRecipeResponse

data class SlsaRecipeResponse(val arguments: Map<String, String>, val definedInMaterial: String, val entryPoint: String, val environment: Map<String, String>, val type: String)

Steps taken to build the artifact. For a TaskRun, typically each container corresponds to one step in the recipe.

SourceResponse

data class SourceResponse(val additionalContexts: List<GoogleDevtoolsContaineranalysisV1alpha1SourceContextResponse>, val artifactStorageSource: StorageSourceResponse, val context: GoogleDevtoolsContaineranalysisV1alpha1SourceContextResponse, val fileHashes: Map<String, String>, val repoSource: RepoSourceResponse, val storageSource: StorageSourceResponse)

Source describes the location of the source used for the build.

StatusResponse

data class StatusResponse(val code: Int, val details: List<Map<String, String>>, val message: String)

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.

StorageSourceResponse

data class StorageSourceResponse(val bucket: String, val generation: String, val object: String)

StorageSource describes the location of the source in an archive file in Google Cloud Storage.

SubjectResponse

data class SubjectResponse(val digest: Map<String, String>, val name: String)

Subject refers to the subject of the intoto statement

UpgradeDistributionResponse

data class UpgradeDistributionResponse(val classification: String, val cpeUri: String, val cve: List<String>, val severity: String)

The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities.

UpgradeNoteResponse

data class UpgradeNoteResponse(val distributions: List<UpgradeDistributionResponse>, val package: String, val version: VersionResponse)

An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note.

UpgradeOccurrenceResponse

data class UpgradeOccurrenceResponse(val distribution: UpgradeDistributionResponse, val package: String, val parsedVersion: VersionResponse)

An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability).

URIResponse

data class URIResponse(val label: String, val uri: String)

An URI message.

VersionResponse

data class VersionResponse(val epoch: Int, val inclusive: Boolean, val kind: String, val name: String, val revision: String)

Version contains structured information about the version of the package. For a discussion of this in Debian/Ubuntu: http://serverfault.com/questions/604541/debian-packages-version-convention For a discussion of this in Redhat/Fedora/Centos: http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

VexAssessmentResponse

data class VexAssessmentResponse(val cve: String, val impacts: List<String>, val justification: JustificationResponse, val noteName: String, val relatedUris: List<URIResponse>, val remediations: List<RemediationResponse>, val state: String)

VexAssessment provides all publisher provided Vex information that is related to this vulnerability.

VulnerabilityAssessmentNoteResponse

data class VulnerabilityAssessmentNoteResponse(val assessment: AssessmentResponse, val languageCode: String, val longDescription: String, val product: ProductResponse, val publisher: PublisherResponse, val shortDescription: String, val title: String)

A single VulnerabilityAssessmentNote represents one particular product's vulnerability assessment for one CVE. Multiple VulnerabilityAssessmentNotes together form a Vex statement. Please go/sds-vex-example for a sample Vex statement in the CSAF format.

VulnerabilityDetailsResponse

data class VulnerabilityDetailsResponse(val cvssScore: Double, val cvssV2: CVSSResponse, val cvssV3: CVSSResponse, val cvssVersion: String, val effectiveSeverity: String, val packageIssue: List<PackageIssueResponse>, val severity: String, val type: String, val vexAssessment: VexAssessmentResponse)

Used by Occurrence to point to where the vulnerability exists and how to fix it.

VulnerabilityLocationResponse

data class VulnerabilityLocationResponse(val cpeUri: String, val fileLocation: List<FileLocationResponse>, val package: String, val version: VersionResponse)

The location of the vulnerability

VulnerabilityTypeResponse

data class VulnerabilityTypeResponse(val cvssScore: Double, val cvssV2: CVSSResponse, val cvssVersion: String, val cwe: List<String>, val details: List<DetailResponse>, val severity: String)

VulnerabilityType provides metadata about a security vulnerability.