Skip to content

Commit ac9c393

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat:Import of Grafeas from Github
PiperOrigin-RevId: 453542250
1 parent f735ad0 commit ac9c393

11 files changed

Lines changed: 3398 additions & 19 deletions

‎grafeas/v1/BUILD.bazel‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ proto_library(
3737
"provenance.proto",
3838
"severity.proto",
3939
"slsa_provenance.proto",
40+
"slsa_provenance_zero_two.proto",
4041
"upgrade.proto",
4142
"vulnerability.proto",
4243
],
@@ -49,6 +50,7 @@ proto_library(
4950
"@com_google_protobuf//:any_proto",
5051
"@com_google_protobuf//:empty_proto",
5152
"@com_google_protobuf//:field_mask_proto",
53+
"@com_google_protobuf//:struct_proto",
5254
"@com_google_protobuf//:timestamp_proto",
5355
],
5456
)

‎grafeas/v1/common.proto‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,3 +119,32 @@ message EnvelopeSignature {
119119
bytes sig = 1;
120120
string keyid = 2;
121121
}
122+
123+
// Indicates the location at which a package was found.
124+
message FileLocation {
125+
// For jars that are contained inside .war files, this filepath
126+
// can indicate the path to war file combined with the path to jar file.
127+
string file_path = 1;
128+
}
129+
130+
// License information.
131+
message License {
132+
// Often a single license can be used to represent the licensing terms.
133+
// Sometimes it is necessary to include a choice of one or more licenses
134+
// or some combination of license identifiers.
135+
// Examples: "LGPL-2.1-only OR MIT", "LGPL-2.1-only AND MIT",
136+
// "GPL-2.0-or-later WITH Bison-exception-2.2".
137+
string expression = 1;
138+
139+
// Comments
140+
string comments = 2;
141+
}
142+
143+
// Digest information.
144+
message Digest {
145+
// `SHA1`, `SHA512` etc.
146+
string algo = 1;
147+
148+
// Value of the digest.
149+
bytes digest_bytes = 2;
150+
}

‎grafeas/v1/compliance.proto‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,9 @@ message ComplianceVersion {
5252
// The CPE URI (https://cpe.mitre.org/specification/) this benchmark is
5353
// applicable to.
5454
string cpe_uri = 1;
55+
// The name of the document that defines this benchmark, e.g. "CIS
56+
// Container-Optimized OS".
57+
string benchmark_document = 3;
5558
// The version of the benchmark. This is set to the version of the OS-specific
5659
// CIS document the benchmark is defined in.
5760
string version = 2;

‎grafeas/v1/cvss.proto‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ package grafeas.v1;
1919
option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
2020
option java_multiple_files = true;
2121
option java_package = "io.grafeas.v1";
22-
option java_outer_classname = "CvssProto";
2322
option objc_class_prefix = "GRA";
23+
option java_outer_classname = "CVSSProto";
2424

2525
// Common Vulnerability Scoring System version 3.
2626
// For details, see https://www.first.org/cvss/specification-document
@@ -87,10 +87,8 @@ message CVSSv3 {
8787

8888
// Common Vulnerability Scoring System.
8989
// For details, see https://www.first.org/cvss/specification-document
90-
// This is a message we will try to use for storing multiple versions of
91-
// CVSS. The intention is that as new versions of CVSS scores get added, we
92-
// will be able to modify this message rather than adding new protos for each
93-
// new version of the score.
90+
// This is a message we will try to use for storing various versions of CVSS
91+
// rather than making a separate proto for storing a specific version.
9492
message CVSS {
9593
// The base score is a function of the base metric scores.
9694
float base_score = 1;

‎grafeas/v1/dsse_attestation.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,4 +49,4 @@ message DSSEAttestationOccurrence {
4949
oneof decoded_payload {
5050
InTotoStatement statement = 2;
5151
}
52-
}
52+
}

‎grafeas/v1/intoto_statement.proto‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package grafeas.v1;
1818

1919
import "grafeas/v1/intoto_provenance.proto";
2020
import "grafeas/v1/slsa_provenance.proto";
21+
import "grafeas/v1/slsa_provenance_zero_two.proto";
2122

2223
option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
2324
option java_multiple_files = true;
@@ -38,6 +39,7 @@ message InTotoStatement {
3839
oneof predicate {
3940
InTotoProvenance provenance = 4;
4041
SlsaProvenance slsa_provenance = 5;
42+
SlsaProvenanceZeroTwo slsa_provenance_zero_two = 6;
4143
}
4244
}
4345
message Subject {

‎grafeas/v1/package.proto‎

Lines changed: 72 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ syntax = "proto3";
1616

1717
package grafeas.v1;
1818

19+
import "google/api/field_behavior.proto";
20+
import "grafeas/v1/common.proto";
21+
1922
option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
2023
option java_multiple_files = true;
2124
option java_package = "io.grafeas.v1";
@@ -34,9 +37,9 @@ enum Architecture {
3437
// This represents a particular channel of distribution for a given package.
3538
// E.g., Debian's jessie-backports dpkg mirror.
3639
message Distribution {
37-
// Required. The cpe_uri in [CPE format](https://cpe.mitre.org/specification/)
40+
// The cpe_uri in [CPE format](https://cpe.mitre.org/specification/)
3841
// denoting the package manager version distributing a package.
39-
string cpe_uri = 1;
42+
string cpe_uri = 1 [(google.api.field_behavior) = REQUIRED];
4043

4144
// The CPU architecture for which packages in this distribution channel were
4245
// built.
@@ -58,36 +61,93 @@ message Distribution {
5861
// An occurrence of a particular package installation found within a system's
5962
// filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
6063
message Location {
61-
// Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
62-
// denoting the package manager version distributing a package.
64+
// Deprecated.
65+
// The CPE URI in [CPE format](https://cpe.mitre.org/specification/)
6366
string cpe_uri = 1;
6467

68+
// Deprecated.
6569
// The version installed at this location.
6670
Version version = 2;
6771

6872
// The path from which we gathered that this package/version is installed.
6973
string path = 3;
7074
}
7175

72-
// This represents a particular package that is distributed over various
73-
// channels. E.g., glibc (aka libc6) is distributed by many, at various
74-
// versions.
76+
// PackageNote represents a particular package version.
7577
message PackageNote {
76-
// Required. Immutable. The name of the package.
77-
string name = 1;
78+
// The name of the package.
79+
string name = 1 [
80+
(google.api.field_behavior) = REQUIRED,
81+
(google.api.field_behavior) = IMMUTABLE
82+
];
7883

84+
// Deprecated.
7985
// The various channels by which a package is distributed.
8086
repeated Distribution distribution = 10;
87+
88+
// The type of package; whether native or non native (e.g., ruby gems,
89+
// node.js packages, etc.).
90+
string package_type = 11;
91+
92+
// The cpe_uri in [CPE format](https://cpe.mitre.org/specification/)
93+
// denoting the package manager version distributing a package.
94+
// The cpe_uri will be blank for language packages.
95+
string cpe_uri = 12;
96+
97+
// The CPU architecture for which packages in this distribution channel were
98+
// built. Architecture will be blank for language packages.
99+
Architecture architecture = 13;
100+
101+
// The version of the package.
102+
Version version = 14;
103+
104+
// A freeform text denoting the maintainer of this package.
105+
string maintainer = 15;
106+
107+
// The homepage for this package.
108+
string url = 16;
109+
110+
// The description of this package.
111+
string description = 17;
112+
113+
// Licenses that have been declared by the authors of the package.
114+
License license = 18;
115+
116+
// Hash value, typically a file digest, that allows unique
117+
// identification a specific package.
118+
repeated Digest digest = 19;
81119
}
82120

83121
// Details on how a particular software package was installed on a system.
84122
message PackageOccurrence {
85-
// Output only. The name of the installed package.
86-
string name = 1;
123+
// The name of the installed package.
124+
string name = 1 [
125+
(google.api.field_behavior) = REQUIRED,
126+
(google.api.field_behavior) = OUTPUT_ONLY
127+
];
87128

88-
// Required. All of the places within the filesystem versions of this package
129+
// All of the places within the filesystem versions of this package
89130
// have been found.
90131
repeated Location location = 2;
132+
133+
// The type of package; whether native or non native (e.g., ruby gems,
134+
// node.js packages, etc.).
135+
string package_type = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
136+
137+
// The cpe_uri in [CPE format](https://cpe.mitre.org/specification/)
138+
// denoting the package manager version distributing a package.
139+
// The cpe_uri will be blank for language packages.
140+
string cpe_uri = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
141+
142+
// The CPU architecture for which packages in this distribution channel were
143+
// built. Architecture will be blank for language packages.
144+
Architecture architecture = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
145+
146+
// Licenses that have been declared by the authors of the package.
147+
License license = 6;
148+
149+
// The version of the package.
150+
Version version = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
91151
}
92152

93153
// Version contains structured information about the version of a package.

‎grafeas/v1/slsa_provenance.proto‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
2323
option java_multiple_files = true;
2424
option java_package = "io.grafeas.v1";
2525
option objc_class_prefix = "GRA";
26+
option java_outer_classname = "SlsaProvenanceProto";
2627

2728
message SlsaProvenance {
2829
// Steps taken to build the artifact.
@@ -111,4 +112,4 @@ message SlsaProvenance {
111112
// incomplete unless metadata.completeness.materials is true. Unset or null is
112113
// equivalent to empty.
113114
repeated Material materials = 4;
114-
}
115+
}

‎grafeas/v1/slsa_provenance_zero_two.proto‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
// Copyright 2021 The Grafeas Authors. All rights reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package grafeas.v1;
18+
19+
import "google/protobuf/struct.proto";
20+
import "google/protobuf/timestamp.proto";
21+
22+
option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
23+
option java_multiple_files = true;
24+
option java_package = "io.grafeas.v1";
25+
option objc_class_prefix = "GRA";
26+
option java_outer_classname = "SlsaProvenanceZeroTwoProto";
27+
28+
message SlsaProvenanceZeroTwo {
29+
// See full explanation of fields at slsa.dev/provenance/v0.2.
30+
31+
// Identifies the entity that executed the recipe, which is trusted to have
32+
// correctly performed the operation and populated this provenance.
33+
message SlsaBuilder {
34+
string id = 1;
35+
}
36+
37+
// The collection of artifacts that influenced the build including sources,
38+
// dependencies, build tools, base images, and so on.
39+
message SlsaMaterial {
40+
string uri = 1;
41+
map<string, string> digest = 2;
42+
}
43+
44+
// Identifies the event that kicked off the build.
45+
message SlsaInvocation {
46+
SlsaConfigSource config_source = 1;
47+
google.protobuf.Struct parameters = 2;
48+
google.protobuf.Struct environment = 3;
49+
}
50+
51+
// Describes where the config file that kicked off the build came from.
52+
// This is effectively a pointer to the source where buildConfig came from.
53+
message SlsaConfigSource {
54+
string uri = 1;
55+
map<string, string> digest = 2;
56+
string entry_point = 3;
57+
}
58+
59+
// Other properties of the build.
60+
message SlsaMetadata {
61+
string build_invocation_id = 1;
62+
google.protobuf.Timestamp build_started_on = 2;
63+
google.protobuf.Timestamp build_finished_on = 3;
64+
SlsaCompleteness completeness = 4;
65+
bool reproducible = 5;
66+
}
67+
68+
// Indicates that the builder claims certain fields in this message to be
69+
// complete.
70+
message SlsaCompleteness {
71+
bool parameters = 1;
72+
bool environment = 2;
73+
bool materials = 3;
74+
}
75+
76+
SlsaBuilder builder = 1;
77+
string build_type = 2;
78+
SlsaInvocation invocation = 3;
79+
google.protobuf.Struct build_config = 4;
80+
SlsaMetadata metadata = 5;
81+
repeated SlsaMaterial materials = 6;
82+
}

0 commit comments

Comments
 (0)