diff --git a/protos/grafeas/v1/attestation.proto b/protos/grafeas/v1/attestation.proto index 61423d3..f2854fe 100644 --- a/protos/grafeas/v1/attestation.proto +++ b/protos/grafeas/v1/attestation.proto @@ -53,6 +53,13 @@ message AttestationNote { Hint hint = 1; } +message Jwt { + // The compact encoding of a JWS, which is always three base64 encoded strings + // joined by periods. For details, see: + // https://tools.ietf.org/html/rfc7515.html#section-3.1 + string compact_jwt = 1; +} + // Occurrence that represents a single "attestation". The authenticity of an // attestation can be verified using the attached signature. If the verifier // trusts the public key of the signer, then verifying the signature is @@ -70,4 +77,14 @@ message AttestationOccurrence { // `signature` verifies `serialized_payload`. See `Signature` in common.proto // for more details on signature structure and verification. repeated Signature signatures = 2; + // One or more JWTs encoding a self-contained attestation. + // Each JWT encodes the payload that it verifies within the JWT itself. + // Verifier implementation SHOULD ignore the `serialized_payload` field + // when verifying these JWTs. + // If only JWTs are present on this AttestationOccurrence, then the + // `serialized_payload` SHOULD be left empty. + // Each JWT SHOULD encode a claim specific to the `resource_uri` of this + // Occurrence, but this is not validated by Grafeas metadata API + // implementations. The JWT itself is opaque to Grafeas. + repeated Jwt jwts = 3; } diff --git a/protos/grafeas/v1/build.proto b/protos/grafeas/v1/build.proto index c0e9c75..172637f 100644 --- a/protos/grafeas/v1/build.proto +++ b/protos/grafeas/v1/build.proto @@ -16,6 +16,8 @@ syntax = "proto3"; package grafeas.v1; +import "grafeas/v1/intoto_provenance.proto"; +import "grafeas/v1/intoto_statement.proto"; import "grafeas/v1/provenance.proto"; option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas"; @@ -32,7 +34,7 @@ message BuildNote { // Details of a build occurrence. message BuildOccurrence { - // Required. The actual provenance for the build. + // The actual provenance for the build. grafeas.v1.BuildProvenance provenance = 1; // Serialized JSON representation of the provenance, used in generating the @@ -47,4 +49,14 @@ message BuildOccurrence { // provenance is marshalled to json as well to prevent incompatibilities with // future changes. string provenance_bytes = 2; + + // Deprecated. See InTotoStatement for the replacement. + // In-toto Provenance representation as defined in spec. + InTotoProvenance intoto_provenance = 3; + + // In-toto Statement representation as defined in spec. + // The intoto_statement can contain any type of provenance. The serialized + // payload of the statement can be stored and signed in the Occurrence's + // envelope. + InTotoStatement intoto_statement = 4; } diff --git a/protos/grafeas/v1/common.proto b/protos/grafeas/v1/common.proto index db780bb..29a6663 100644 --- a/protos/grafeas/v1/common.proto +++ b/protos/grafeas/v1/common.proto @@ -23,7 +23,7 @@ option objc_class_prefix = "GRA"; // Kind represents the kinds of notes supported. enum NoteKind { - // Unknown. + // Default value. This value is unused. NOTE_KIND_UNSPECIFIED = 0; // The note and occurrence represent a package vulnerability. VULNERABILITY = 1; @@ -41,6 +41,10 @@ enum NoteKind { ATTESTATION = 7; // This represents an available package upgrade. UPGRADE = 8; + // This represents a Compliance Note + COMPLIANCE = 9; + // This represents a DSSE attestation Note + DSSE_ATTESTATION = 10; } // Metadata for any related URL information. @@ -84,7 +88,7 @@ message Signature { // The identifier for the public key that verifies this signature. // * The `public_key_id` is required. - // * The `public_key_id` MUST be an RFC3986 conformant URI. + // * The `public_key_id` SHOULD be an RFC3986 conformant URI. // * When possible, the `public_key_id` SHOULD be an immutable reference, // such as a cryptographic digest. // @@ -101,3 +105,17 @@ message Signature { // * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5" string public_key_id = 2; } + +// MUST match +// https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An +// authenticated message of arbitrary type. +message Envelope { + bytes payload = 1; + string payload_type = 2; + repeated EnvelopeSignature signatures = 3; +} + +message EnvelopeSignature { + bytes sig = 1; + string keyid = 2; +} diff --git a/protos/grafeas/v1/compliance.proto b/protos/grafeas/v1/compliance.proto new file mode 100644 index 0000000..1d41db2 --- /dev/null +++ b/protos/grafeas/v1/compliance.proto @@ -0,0 +1,79 @@ +// Copyright 2021 The Grafeas Authors. All rights reserved. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package grafeas.v1; + +import "grafeas/v1/vulnerability.proto"; + +option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas"; +option java_multiple_files = true; +option java_package = "io.grafeas.v1"; +option objc_class_prefix = "GRA"; + +message ComplianceNote { + // The title that identifies this compliance check. + string title = 1; + // A description about this compliance check. + string description = 2; + // The OS and config versions the benchmark applies to. + repeated grafeas.v1.ComplianceVersion version = 3; + // A rationale for the existence of this compliance check. + string rationale = 4; + // A description of remediation steps if the compliance check fails. + string remediation = 5; + // A compliance check that is a CIS benchmark. + message CisBenchmark { + int32 profile_level = 1; + grafeas.v1.Severity severity = 2; + } + oneof compliance_type { + CisBenchmark cis_benchmark = 6; + } + // Serialized scan instructions with a predefined format. + bytes scan_instructions = 7; +} + +// Describes the CIS benchmark version that is applicable to a given OS and +// os version. +message ComplianceVersion { + // The CPE URI (https://cpe.mitre.org/specification/) this benchmark is + // applicable to. + string cpe_uri = 1; + // The version of the benchmark. This is set to the version of the OS-specific + // CIS document the benchmark is defined in. + string version = 2; +} + +// An indication that the compliance checks in the associated ComplianceNote +// were not satisfied for particular resources or a specified reason. +message ComplianceOccurrence { + repeated NonCompliantFile non_compliant_files = 2; + string non_compliance_reason = 3; +} + +// Details about files that caused a compliance check to fail. +message NonCompliantFile { + // display_command is a single command that can be used to display a list of + // non compliant files. When there is no such command, we can also iterate a + // list of non compliant file using 'path'. + + // Empty if `display_command` is set. + string path = 1; + // Command to display the non-compliant files. + string display_command = 2; + // Explains why a file is non compliant for a CIS check. + string reason = 3; +} diff --git a/protos/grafeas/v1/dsse_attestation.proto b/protos/grafeas/v1/dsse_attestation.proto new file mode 100644 index 0000000..0264ab9 --- /dev/null +++ b/protos/grafeas/v1/dsse_attestation.proto @@ -0,0 +1,52 @@ +// Copyright 2021 The Grafeas Authors. All rights reserved. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +syntax = "proto3"; + +package grafeas.v1; + +import "grafeas/v1/common.proto"; +import "grafeas/v1/intoto_statement.proto"; + +option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas"; +option java_multiple_files = true; +option java_package = "io.grafeas.v1"; +option objc_class_prefix = "GRA"; + +message DSSEAttestationNote { + // This submessage provides human-readable hints about the purpose of the + // authority. Because the name of a note acts as its resource reference, it is + // important to disambiguate the canonical name of the Note (which might be a + // UUID for security purposes) from "readable" names more suitable for debug + // output. Note that these hints should not be used to look up authorities in + // security sensitive contexts, such as when looking up attestations to + // verify. + message DSSEHint { + // Required. The human readable name of this attestation authority, for + // example "cloudbuild-prod". + string human_readable_name = 1; + } + // DSSEHint hints at the purpose of the attestation authority. + DSSEHint hint = 1; +} + +// Deprecated. Prefer to use a regular Occurrence, and populate the +// Envelope at the top level of the Occurrence. +message DSSEAttestationOccurrence { + // If doing something security critical, make sure to verify the signatures in + // this metadata. + Envelope envelope = 1; + oneof decoded_payload { + InTotoStatement statement = 2; + } +} \ No newline at end of file diff --git a/protos/grafeas/v1/grafeas.proto b/protos/grafeas/v1/grafeas.proto index 57b2fc2..5665fe3 100644 --- a/protos/grafeas/v1/grafeas.proto +++ b/protos/grafeas/v1/grafeas.proto @@ -26,8 +26,10 @@ import "google/protobuf/timestamp.proto"; import "grafeas/v1/attestation.proto"; import "grafeas/v1/build.proto"; import "grafeas/v1/common.proto"; +import "grafeas/v1/compliance.proto"; import "grafeas/v1/deployment.proto"; import "grafeas/v1/discovery.proto"; +import "grafeas/v1/dsse_attestation.proto"; import "grafeas/v1/image.proto"; import "grafeas/v1/package.proto"; import "grafeas/v1/upgrade.proto"; @@ -242,7 +244,14 @@ message Occurrence { grafeas.v1.AttestationOccurrence attestation = 14; // Describes an available package upgrade on the linked resource. grafeas.v1.UpgradeOccurrence upgrade = 15; + // Describes a compliance violation on a linked resource. + grafeas.v1.ComplianceOccurrence compliance = 16; + // Describes an attestation of an artifact using dsse. + grafeas.v1.DSSEAttestationOccurrence dsse_attestation = 17; } + + // https://github.com/secure-systems-lab/dsse + grafeas.v1.Envelope envelope = 18; } // A type of analysis that can be done for a resource. @@ -301,6 +310,10 @@ message Note { grafeas.v1.AttestationNote attestation = 16; // A note describing available package upgrades. grafeas.v1.UpgradeNote upgrade = 17; + // A note describing a compliance check. + grafeas.v1.ComplianceNote compliance = 18; + // A note describing a dsse attestation note. + grafeas.v1.DSSEAttestationNote dsse_attestation = 19; } } diff --git a/protos/grafeas/v1/intoto_provenance.proto b/protos/grafeas/v1/intoto_provenance.proto new file mode 100644 index 0000000..f2e6c37 --- /dev/null +++ b/protos/grafeas/v1/intoto_provenance.proto @@ -0,0 +1,112 @@ +// Copyright 2021 The Grafeas Authors. All rights reserved. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package grafeas.v1; + +import "google/protobuf/any.proto"; +import "google/protobuf/timestamp.proto"; + +option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas"; +option java_multiple_files = true; +option java_package = "io.grafeas.v1"; +option objc_class_prefix = "GRA"; + +// Spec defined at +// https://github.com/in-toto/attestation/blob/main/spec/predicates/provenance.md + +// Steps taken to build the artifact. +// For a TaskRun, typically each container corresponds to one step in the +// recipe. +message Recipe { + // URI indicating what type of recipe was performed. It determines the meaning + // of recipe.entryPoint, recipe.arguments, recipe.environment, and materials. + string type = 1; + // Index in materials containing the recipe steps that are not implied by + // recipe.type. For example, if the recipe type were "make", then this would + // point to the source containing the Makefile, not the make program itself. + // Set to -1 if the recipe doesn't come from a material, as zero is default + // unset value for int64. + int64 defined_in_material = 2; + // String identifying the entry point into the build. + // This is often a path to a configuration file and/or a target label within + // that file. The syntax and meaning are defined by recipe.type. For example, + // if the recipe type were "make", then this would reference the directory in + // which to run make as well as which target to use. + string entry_point = 3; + // Collection of all external inputs that influenced the build on top of + // recipe.definedInMaterial and recipe.entryPoint. For example, if the recipe + // type were "make", then this might be the flags passed to make aside from + // the target, which is captured in recipe.entryPoint. Since the arguments + // field can greatly vary in structure, depending on the builder and recipe + // type, this is of form "Any". + repeated google.protobuf.Any arguments = 4; + // Any other builder-controlled inputs necessary for correctly evaluating the + // recipe. Usually only needed for reproducing the build but not evaluated as + // part of policy. Since the environment field can greatly vary in structure, + // depending on the builder and recipe type, this is of form "Any". + repeated google.protobuf.Any environment = 5; +} + +// Indicates that the builder claims certain fields in this message to be +// complete. +message Completeness { + // If true, the builder claims that recipe.arguments is complete, meaning that + // all external inputs are properly captured in the recipe. + bool arguments = 1; + // If true, the builder claims that recipe.environment is claimed to be + // complete. + bool environment = 2; + // If true, the builder claims that materials are complete, usually through + // some controls to prevent network access. Sometimes called "hermetic". + bool materials = 3; +} + +// Other properties of the build. +message Metadata { + // Identifies the particular build invocation, which can be useful for finding + // associated logs or other ad-hoc analysis. The value SHOULD be globally + // unique, per in-toto Provenance spec. + string build_invocation_id = 1; + // The timestamp of when the build started. + google.protobuf.Timestamp build_started_on = 2; + // The timestamp of when the build completed. + google.protobuf.Timestamp build_finished_on = 3; + // Indicates that the builder claims certain fields in this message to be + // complete. + Completeness completeness = 4; + // If true, the builder claims that running the recipe on materials will + // produce bit-for-bit identical output. + bool reproducible = 5; +} + +message BuilderConfig { + string id = 1; +} + +message InTotoProvenance { + BuilderConfig builder_config = 1; // required + // Identifies the configuration used for the build. + // When combined with materials, this SHOULD fully describe the build, + // such that re-running this recipe results in bit-for-bit identical output + // (if the build is reproducible). + Recipe recipe = 2; // required + Metadata metadata = 3; + // The collection of artifacts that influenced the build including sources, + // dependencies, build tools, base images, and so on. This is considered to be + // incomplete unless metadata.completeness.materials is true. Unset or null is + // equivalent to empty. + repeated string materials = 4; +} diff --git a/protos/grafeas/v1/intoto_statement.proto b/protos/grafeas/v1/intoto_statement.proto new file mode 100644 index 0000000..4399627 --- /dev/null +++ b/protos/grafeas/v1/intoto_statement.proto @@ -0,0 +1,49 @@ +// Copyright 2021 The Grafeas Authors. All rights reserved. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package grafeas.v1; + +import "grafeas/v1/intoto_provenance.proto"; +import "grafeas/v1/slsa_provenance.proto"; + +option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas"; +option java_multiple_files = true; +option java_package = "io.grafeas.v1"; +option objc_class_prefix = "GRA"; + +// Spec defined at +// https://github.com/in-toto/attestation/tree/main/spec#statement The +// serialized InTotoStatement will be stored as Envelope.payload. +// Envelope.payloadType is always "application/vnd.in-toto+json". +message InTotoStatement { + // Always `https://in-toto.io/Statement/v0.1`. + string type = 1 [json_name = "_type"]; + repeated Subject subject = 2; + // `https://slsa.dev/provenance/v0.1` for SlsaProvenance. + string predicate_type = 3; + oneof predicate { + InTotoProvenance provenance = 4; + SlsaProvenance slsa_provenance = 5; + } +} +message Subject { + string name = 1; + // `"": ""` + // Algorithms can be e.g. sha256, sha512 + // See + // https://github.com/in-toto/attestation/blob/main/spec/field_types.md#DigestSet + map digest = 2; +} diff --git a/protos/grafeas/v1/package.proto b/protos/grafeas/v1/package.proto index b04686d..078c88c 100644 --- a/protos/grafeas/v1/package.proto +++ b/protos/grafeas/v1/package.proto @@ -102,6 +102,14 @@ message Version { // The iteration of the package build from the above version. string revision = 3; + // Whether this version is specifying part of an inclusive range. Grafeas + // does not have the capability to specify version ranges; instead we have + // fields that specify start version and end versions. At times this is + // insufficient - we also need to specify whether the version is included in + // the range or is excluded from the range. This boolean is expected to be set + // to true when the version is included in a range. + bool inclusive = 6; + // Whether this is an ordinary package version or a sentinel MIN/MAX version. enum VersionKind { // Unknown. @@ -112,7 +120,7 @@ message Version { MINIMUM = 2; // A special version representing positive infinity. MAXIMUM = 3; - }; + } // Required. Distinguishes between sentinel MIN/MAX versions and normal // versions. diff --git a/protos/grafeas/v1/slsa_provenance.proto b/protos/grafeas/v1/slsa_provenance.proto new file mode 100644 index 0000000..b585f0b --- /dev/null +++ b/protos/grafeas/v1/slsa_provenance.proto @@ -0,0 +1,114 @@ +// Copyright 2021 The Grafeas Authors. All rights reserved. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package grafeas.v1; + +import "google/protobuf/any.proto"; +import "google/protobuf/timestamp.proto"; + +option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas"; +option java_multiple_files = true; +option java_package = "io.grafeas.v1"; +option objc_class_prefix = "GRA"; + +message SlsaProvenance { + // Steps taken to build the artifact. + // For a TaskRun, typically each container corresponds to one step in the + // recipe. + message SlsaRecipe { + // URI indicating what type of recipe was performed. It determines the + // meaning of recipe.entryPoint, recipe.arguments, recipe.environment, and + // materials. + string type = 1; + // Index in materials containing the recipe steps that are not implied by + // recipe.type. For example, if the recipe type were "make", then this would + // point to the source containing the Makefile, not the make program itself. + // Set to -1 if the recipe doesn't come from a material, as zero is default + // unset value for int64. + int64 defined_in_material = 2; + // String identifying the entry point into the build. + // This is often a path to a configuration file and/or a target label within + // that file. The syntax and meaning are defined by recipe.type. For + // example, if the recipe type were "make", then this would reference the + // directory in which to run make as well as which target to use. + string entry_point = 3; + // Collection of all external inputs that influenced the build on top of + // recipe.definedInMaterial and recipe.entryPoint. For example, if the + // recipe type were "make", then this might be the flags passed to make + // aside from the target, which is captured in recipe.entryPoint. Depending + // on the recipe Type, the structure may be different. + google.protobuf.Any arguments = 4; + // Any other builder-controlled inputs necessary for correctly evaluating + // the recipe. Usually only needed for reproducing the build but not + // evaluated as part of policy. Depending on the recipe Type, the structure + // may be different. + google.protobuf.Any environment = 5; + } + + // Indicates that the builder claims certain fields in this message to be + // complete. + message SlsaCompleteness { + // If true, the builder claims that recipe.arguments is complete, meaning + // that all external inputs are properly captured in the recipe. + bool arguments = 1; + // If true, the builder claims that recipe.environment is claimed to be + // complete. + bool environment = 2; + // If true, the builder claims that materials are complete, usually through + // some controls to prevent network access. Sometimes called "hermetic". + bool materials = 3; + } + + // Other properties of the build. + message SlsaMetadata { + // Identifies the particular build invocation, which can be useful for + // finding associated logs or other ad-hoc analysis. The value SHOULD be + // globally unique, per in-toto Provenance spec. + string build_invocation_id = 1; + // The timestamp of when the build started. + google.protobuf.Timestamp build_started_on = 2; + // The timestamp of when the build completed. + google.protobuf.Timestamp build_finished_on = 3; + // Indicates that the builder claims certain fields in this message to be + // complete. + SlsaCompleteness completeness = 4; + // If true, the builder claims that running the recipe on materials will + // produce bit-for-bit identical output. + bool reproducible = 5; + } + + message SlsaBuilder { + string id = 1; + } + + message Material { + string uri = 1; + map digest = 2; + } + + SlsaBuilder builder = 1; // required + // Identifies the configuration used for the build. + // When combined with materials, this SHOULD fully describe the build, + // such that re-running this recipe results in bit-for-bit identical output + // (if the build is reproducible). + SlsaRecipe recipe = 2; // required + SlsaMetadata metadata = 3; + // The collection of artifacts that influenced the build including sources, + // dependencies, build tools, base images, and so on. This is considered to be + // incomplete unless metadata.completeness.materials is true. Unset or null is + // equivalent to empty. + repeated Material materials = 4; +} \ No newline at end of file diff --git a/protos/grafeas/v1/vulnerability.proto b/protos/grafeas/v1/vulnerability.proto index 6c94cdf..476d320 100644 --- a/protos/grafeas/v1/vulnerability.proto +++ b/protos/grafeas/v1/vulnerability.proto @@ -16,6 +16,7 @@ syntax = "proto3"; package grafeas.v1; +import "google/api/field_behavior.proto"; import "google/protobuf/timestamp.proto"; import "grafeas/v1/common.proto"; import "grafeas/v1/cvss.proto"; @@ -115,6 +116,12 @@ message VulnerabilityNote { // upstream timestamp from the underlying information source - e.g. Ubuntu // security tracker. google.protobuf.Timestamp source_update_time = 12; + + // The source from which the information in this Detail was obtained. + string source = 13; + + // The name of the vendor of the product. + string vendor = 14; } // The full description of the CVSSv3 for this vulnerability. @@ -172,6 +179,18 @@ message VulnerabilityOccurrence { // severity. float cvss_score = 3; + // The CVSS v3 score for this vulnerability. + message CVSSV3 { + // The base score for for this vulnerability according to cvss v3. + float base_score = 1; + // The severity rating assigned to this vulnerability by vulnerability + // provider. + Severity severity = 2; + } + + // The cvss v3 score for the vulnerability. + CVSSV3 cvssv3 = 10; + // Required. The set of affected locations and their fixes (if available) // within the associated resource. repeated PackageIssue package_issue = 4; @@ -205,6 +224,14 @@ message VulnerabilityOccurrence { // Output only. Whether a fix is available for this package. bool fix_available = 7; + + // The type of package (e.g. OS, MAVEN, GO). + string package_type = 8; + + // The distro or language system assigned severity for this vulnerability + // when that is available and note provider assigned severity when it is not + // available. + Severity effective_severity = 9 [(google.api.field_behavior) = OUTPUT_ONLY]; } // Output only. A one sentence description of this vulnerability. @@ -218,6 +245,14 @@ message VulnerabilityOccurrence { // The distro assigned severity for this vulnerability when it is available, // otherwise this is the note provider assigned severity. + // + // When there are multiple PackageIssues for this vulnerability, they can have + // different effective severities because some might be provided by the distro + // while others are provided by the language ecosystem for a language pack. + // For this reason, it is advised to use the effective severity on the + // PackageIssue level. In the case where multiple PackageIssues have differing + // effective severities, this field should be the highest severity for any of + // the PackageIssues. Severity effective_severity = 8; // Output only. Whether at least one of the affected packages has a fix diff --git a/protos/protos.d.ts b/protos/protos.d.ts index 430ad70..b7c521b 100644 --- a/protos/protos.d.ts +++ b/protos/protos.d.ts @@ -8380,6 +8380,96 @@ export namespace grafeas { } } + /** Properties of a Jwt. */ + interface IJwt { + + /** Jwt compactJwt */ + compactJwt?: (string|null); + } + + /** Represents a Jwt. */ + class Jwt implements IJwt { + + /** + * Constructs a new Jwt. + * @param [properties] Properties to set + */ + constructor(properties?: grafeas.v1.IJwt); + + /** Jwt compactJwt. */ + public compactJwt: string; + + /** + * Creates a new Jwt instance using the specified properties. + * @param [properties] Properties to set + * @returns Jwt instance + */ + public static create(properties?: grafeas.v1.IJwt): grafeas.v1.Jwt; + + /** + * Encodes the specified Jwt message. Does not implicitly {@link grafeas.v1.Jwt.verify|verify} messages. + * @param message Jwt message or plain object to encode + * @param [writer] Writer to encode to + * @returns Writer + */ + public static encode(message: grafeas.v1.IJwt, writer?: $protobuf.Writer): $protobuf.Writer; + + /** + * Encodes the specified Jwt message, length delimited. Does not implicitly {@link grafeas.v1.Jwt.verify|verify} messages. + * @param message Jwt message or plain object to encode + * @param [writer] Writer to encode to + * @returns Writer + */ + public static encodeDelimited(message: grafeas.v1.IJwt, writer?: $protobuf.Writer): $protobuf.Writer; + + /** + * Decodes a Jwt message from the specified reader or buffer. + * @param reader Reader or buffer to decode from + * @param [length] Message length if known beforehand + * @returns Jwt + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + public static decode(reader: ($protobuf.Reader|Uint8Array), length?: number): grafeas.v1.Jwt; + + /** + * Decodes a Jwt message from the specified reader or buffer, length delimited. + * @param reader Reader or buffer to decode from + * @returns Jwt + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + public static decodeDelimited(reader: ($protobuf.Reader|Uint8Array)): grafeas.v1.Jwt; + + /** + * Verifies a Jwt message. + * @param message Plain object to verify + * @returns `null` if valid, otherwise the reason why it is not + */ + public static verify(message: { [k: string]: any }): (string|null); + + /** + * Creates a Jwt message from a plain object. Also converts values to their respective internal types. + * @param object Plain object + * @returns Jwt + */ + public static fromObject(object: { [k: string]: any }): grafeas.v1.Jwt; + + /** + * Creates a plain object from a Jwt message. Also converts values to other types if specified. + * @param message Jwt + * @param [options] Conversion options + * @returns Plain object + */ + public static toObject(message: grafeas.v1.Jwt, options?: $protobuf.IConversionOptions): { [k: string]: any }; + + /** + * Converts this Jwt to JSON. + * @returns JSON object + */ + public toJSON(): { [k: string]: any }; + } + /** Properties of an AttestationOccurrence. */ interface IAttestationOccurrence { @@ -8388,6 +8478,9 @@ export namespace grafeas { /** AttestationOccurrence signatures */ signatures?: (grafeas.v1.ISignature[]|null); + + /** AttestationOccurrence jwts */ + jwts?: (grafeas.v1.IJwt[]|null); } /** Represents an AttestationOccurrence. */ @@ -8405,6 +8498,9 @@ export namespace grafeas { /** AttestationOccurrence signatures. */ public signatures: grafeas.v1.ISignature[]; + /** AttestationOccurrence jwts. */ + public jwts: grafeas.v1.IJwt[]; + /** * Creates a new AttestationOccurrence instance using the specified properties. * @param [properties] Properties to set @@ -8486,7 +8582,9 @@ export namespace grafeas { DEPLOYMENT = 5, DISCOVERY = 6, ATTESTATION = 7, - UPGRADE = 8 + UPGRADE = 8, + COMPLIANCE = 9, + DSSE_ATTESTATION = 10 } /** Properties of a RelatedUrl. */ @@ -8680,5 +8778,203 @@ export namespace grafeas { */ public toJSON(): { [k: string]: any }; } + + /** Properties of an Envelope. */ + interface IEnvelope { + + /** Envelope payload */ + payload?: (Uint8Array|string|null); + + /** Envelope payloadType */ + payloadType?: (string|null); + + /** Envelope signatures */ + signatures?: (grafeas.v1.IEnvelopeSignature[]|null); + } + + /** Represents an Envelope. */ + class Envelope implements IEnvelope { + + /** + * Constructs a new Envelope. + * @param [properties] Properties to set + */ + constructor(properties?: grafeas.v1.IEnvelope); + + /** Envelope payload. */ + public payload: (Uint8Array|string); + + /** Envelope payloadType. */ + public payloadType: string; + + /** Envelope signatures. */ + public signatures: grafeas.v1.IEnvelopeSignature[]; + + /** + * Creates a new Envelope instance using the specified properties. + * @param [properties] Properties to set + * @returns Envelope instance + */ + public static create(properties?: grafeas.v1.IEnvelope): grafeas.v1.Envelope; + + /** + * Encodes the specified Envelope message. Does not implicitly {@link grafeas.v1.Envelope.verify|verify} messages. + * @param message Envelope message or plain object to encode + * @param [writer] Writer to encode to + * @returns Writer + */ + public static encode(message: grafeas.v1.IEnvelope, writer?: $protobuf.Writer): $protobuf.Writer; + + /** + * Encodes the specified Envelope message, length delimited. Does not implicitly {@link grafeas.v1.Envelope.verify|verify} messages. + * @param message Envelope message or plain object to encode + * @param [writer] Writer to encode to + * @returns Writer + */ + public static encodeDelimited(message: grafeas.v1.IEnvelope, writer?: $protobuf.Writer): $protobuf.Writer; + + /** + * Decodes an Envelope message from the specified reader or buffer. + * @param reader Reader or buffer to decode from + * @param [length] Message length if known beforehand + * @returns Envelope + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + public static decode(reader: ($protobuf.Reader|Uint8Array), length?: number): grafeas.v1.Envelope; + + /** + * Decodes an Envelope message from the specified reader or buffer, length delimited. + * @param reader Reader or buffer to decode from + * @returns Envelope + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + public static decodeDelimited(reader: ($protobuf.Reader|Uint8Array)): grafeas.v1.Envelope; + + /** + * Verifies an Envelope message. + * @param message Plain object to verify + * @returns `null` if valid, otherwise the reason why it is not + */ + public static verify(message: { [k: string]: any }): (string|null); + + /** + * Creates an Envelope message from a plain object. Also converts values to their respective internal types. + * @param object Plain object + * @returns Envelope + */ + public static fromObject(object: { [k: string]: any }): grafeas.v1.Envelope; + + /** + * Creates a plain object from an Envelope message. Also converts values to other types if specified. + * @param message Envelope + * @param [options] Conversion options + * @returns Plain object + */ + public static toObject(message: grafeas.v1.Envelope, options?: $protobuf.IConversionOptions): { [k: string]: any }; + + /** + * Converts this Envelope to JSON. + * @returns JSON object + */ + public toJSON(): { [k: string]: any }; + } + + /** Properties of an EnvelopeSignature. */ + interface IEnvelopeSignature { + + /** EnvelopeSignature sig */ + sig?: (Uint8Array|string|null); + + /** EnvelopeSignature keyid */ + keyid?: (string|null); + } + + /** Represents an EnvelopeSignature. */ + class EnvelopeSignature implements IEnvelopeSignature { + + /** + * Constructs a new EnvelopeSignature. + * @param [properties] Properties to set + */ + constructor(properties?: grafeas.v1.IEnvelopeSignature); + + /** EnvelopeSignature sig. */ + public sig: (Uint8Array|string); + + /** EnvelopeSignature keyid. */ + public keyid: string; + + /** + * Creates a new EnvelopeSignature instance using the specified properties. + * @param [properties] Properties to set + * @returns EnvelopeSignature instance + */ + public static create(properties?: grafeas.v1.IEnvelopeSignature): grafeas.v1.EnvelopeSignature; + + /** + * Encodes the specified EnvelopeSignature message. Does not implicitly {@link grafeas.v1.EnvelopeSignature.verify|verify} messages. + * @param message EnvelopeSignature message or plain object to encode + * @param [writer] Writer to encode to + * @returns Writer + */ + public static encode(message: grafeas.v1.IEnvelopeSignature, writer?: $protobuf.Writer): $protobuf.Writer; + + /** + * Encodes the specified EnvelopeSignature message, length delimited. Does not implicitly {@link grafeas.v1.EnvelopeSignature.verify|verify} messages. + * @param message EnvelopeSignature message or plain object to encode + * @param [writer] Writer to encode to + * @returns Writer + */ + public static encodeDelimited(message: grafeas.v1.IEnvelopeSignature, writer?: $protobuf.Writer): $protobuf.Writer; + + /** + * Decodes an EnvelopeSignature message from the specified reader or buffer. + * @param reader Reader or buffer to decode from + * @param [length] Message length if known beforehand + * @returns EnvelopeSignature + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + public static decode(reader: ($protobuf.Reader|Uint8Array), length?: number): grafeas.v1.EnvelopeSignature; + + /** + * Decodes an EnvelopeSignature message from the specified reader or buffer, length delimited. + * @param reader Reader or buffer to decode from + * @returns EnvelopeSignature + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + public static decodeDelimited(reader: ($protobuf.Reader|Uint8Array)): grafeas.v1.EnvelopeSignature; + + /** + * Verifies an EnvelopeSignature message. + * @param message Plain object to verify + * @returns `null` if valid, otherwise the reason why it is not + */ + public static verify(message: { [k: string]: any }): (string|null); + + /** + * Creates an EnvelopeSignature message from a plain object. Also converts values to their respective internal types. + * @param object Plain object + * @returns EnvelopeSignature + */ + public static fromObject(object: { [k: string]: any }): grafeas.v1.EnvelopeSignature; + + /** + * Creates a plain object from an EnvelopeSignature message. Also converts values to other types if specified. + * @param message EnvelopeSignature + * @param [options] Conversion options + * @returns Plain object + */ + public static toObject(message: grafeas.v1.EnvelopeSignature, options?: $protobuf.IConversionOptions): { [k: string]: any }; + + /** + * Converts this EnvelopeSignature to JSON. + * @returns JSON object + */ + public toJSON(): { [k: string]: any }; + } } } diff --git a/protos/protos.js b/protos/protos.js index cf2bbb2..efc662c 100644 --- a/protos/protos.js +++ b/protos/protos.js @@ -21177,6 +21177,193 @@ return AttestationNote; })(); + v1.Jwt = (function() { + + /** + * Properties of a Jwt. + * @memberof grafeas.v1 + * @interface IJwt + * @property {string|null} [compactJwt] Jwt compactJwt + */ + + /** + * Constructs a new Jwt. + * @memberof grafeas.v1 + * @classdesc Represents a Jwt. + * @implements IJwt + * @constructor + * @param {grafeas.v1.IJwt=} [properties] Properties to set + */ + function Jwt(properties) { + if (properties) + for (var keys = Object.keys(properties), i = 0; i < keys.length; ++i) + if (properties[keys[i]] != null) + this[keys[i]] = properties[keys[i]]; + } + + /** + * Jwt compactJwt. + * @member {string} compactJwt + * @memberof grafeas.v1.Jwt + * @instance + */ + Jwt.prototype.compactJwt = ""; + + /** + * Creates a new Jwt instance using the specified properties. + * @function create + * @memberof grafeas.v1.Jwt + * @static + * @param {grafeas.v1.IJwt=} [properties] Properties to set + * @returns {grafeas.v1.Jwt} Jwt instance + */ + Jwt.create = function create(properties) { + return new Jwt(properties); + }; + + /** + * Encodes the specified Jwt message. Does not implicitly {@link grafeas.v1.Jwt.verify|verify} messages. + * @function encode + * @memberof grafeas.v1.Jwt + * @static + * @param {grafeas.v1.IJwt} message Jwt message or plain object to encode + * @param {$protobuf.Writer} [writer] Writer to encode to + * @returns {$protobuf.Writer} Writer + */ + Jwt.encode = function encode(message, writer) { + if (!writer) + writer = $Writer.create(); + if (message.compactJwt != null && Object.hasOwnProperty.call(message, "compactJwt")) + writer.uint32(/* id 1, wireType 2 =*/10).string(message.compactJwt); + return writer; + }; + + /** + * Encodes the specified Jwt message, length delimited. Does not implicitly {@link grafeas.v1.Jwt.verify|verify} messages. + * @function encodeDelimited + * @memberof grafeas.v1.Jwt + * @static + * @param {grafeas.v1.IJwt} message Jwt message or plain object to encode + * @param {$protobuf.Writer} [writer] Writer to encode to + * @returns {$protobuf.Writer} Writer + */ + Jwt.encodeDelimited = function encodeDelimited(message, writer) { + return this.encode(message, writer).ldelim(); + }; + + /** + * Decodes a Jwt message from the specified reader or buffer. + * @function decode + * @memberof grafeas.v1.Jwt + * @static + * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from + * @param {number} [length] Message length if known beforehand + * @returns {grafeas.v1.Jwt} Jwt + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + Jwt.decode = function decode(reader, length) { + if (!(reader instanceof $Reader)) + reader = $Reader.create(reader); + var end = length === undefined ? reader.len : reader.pos + length, message = new $root.grafeas.v1.Jwt(); + while (reader.pos < end) { + var tag = reader.uint32(); + switch (tag >>> 3) { + case 1: + message.compactJwt = reader.string(); + break; + default: + reader.skipType(tag & 7); + break; + } + } + return message; + }; + + /** + * Decodes a Jwt message from the specified reader or buffer, length delimited. + * @function decodeDelimited + * @memberof grafeas.v1.Jwt + * @static + * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from + * @returns {grafeas.v1.Jwt} Jwt + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + Jwt.decodeDelimited = function decodeDelimited(reader) { + if (!(reader instanceof $Reader)) + reader = new $Reader(reader); + return this.decode(reader, reader.uint32()); + }; + + /** + * Verifies a Jwt message. + * @function verify + * @memberof grafeas.v1.Jwt + * @static + * @param {Object.} message Plain object to verify + * @returns {string|null} `null` if valid, otherwise the reason why it is not + */ + Jwt.verify = function verify(message) { + if (typeof message !== "object" || message === null) + return "object expected"; + if (message.compactJwt != null && message.hasOwnProperty("compactJwt")) + if (!$util.isString(message.compactJwt)) + return "compactJwt: string expected"; + return null; + }; + + /** + * Creates a Jwt message from a plain object. Also converts values to their respective internal types. + * @function fromObject + * @memberof grafeas.v1.Jwt + * @static + * @param {Object.} object Plain object + * @returns {grafeas.v1.Jwt} Jwt + */ + Jwt.fromObject = function fromObject(object) { + if (object instanceof $root.grafeas.v1.Jwt) + return object; + var message = new $root.grafeas.v1.Jwt(); + if (object.compactJwt != null) + message.compactJwt = String(object.compactJwt); + return message; + }; + + /** + * Creates a plain object from a Jwt message. Also converts values to other types if specified. + * @function toObject + * @memberof grafeas.v1.Jwt + * @static + * @param {grafeas.v1.Jwt} message Jwt + * @param {$protobuf.IConversionOptions} [options] Conversion options + * @returns {Object.} Plain object + */ + Jwt.toObject = function toObject(message, options) { + if (!options) + options = {}; + var object = {}; + if (options.defaults) + object.compactJwt = ""; + if (message.compactJwt != null && message.hasOwnProperty("compactJwt")) + object.compactJwt = message.compactJwt; + return object; + }; + + /** + * Converts this Jwt to JSON. + * @function toJSON + * @memberof grafeas.v1.Jwt + * @instance + * @returns {Object.} JSON object + */ + Jwt.prototype.toJSON = function toJSON() { + return this.constructor.toObject(this, $protobuf.util.toJSONOptions); + }; + + return Jwt; + })(); + v1.AttestationOccurrence = (function() { /** @@ -21185,6 +21372,7 @@ * @interface IAttestationOccurrence * @property {Uint8Array|null} [serializedPayload] AttestationOccurrence serializedPayload * @property {Array.|null} [signatures] AttestationOccurrence signatures + * @property {Array.|null} [jwts] AttestationOccurrence jwts */ /** @@ -21197,6 +21385,7 @@ */ function AttestationOccurrence(properties) { this.signatures = []; + this.jwts = []; if (properties) for (var keys = Object.keys(properties), i = 0; i < keys.length; ++i) if (properties[keys[i]] != null) @@ -21219,6 +21408,14 @@ */ AttestationOccurrence.prototype.signatures = $util.emptyArray; + /** + * AttestationOccurrence jwts. + * @member {Array.} jwts + * @memberof grafeas.v1.AttestationOccurrence + * @instance + */ + AttestationOccurrence.prototype.jwts = $util.emptyArray; + /** * Creates a new AttestationOccurrence instance using the specified properties. * @function create @@ -21248,6 +21445,9 @@ if (message.signatures != null && message.signatures.length) for (var i = 0; i < message.signatures.length; ++i) $root.grafeas.v1.Signature.encode(message.signatures[i], writer.uint32(/* id 2, wireType 2 =*/18).fork()).ldelim(); + if (message.jwts != null && message.jwts.length) + for (var i = 0; i < message.jwts.length; ++i) + $root.grafeas.v1.Jwt.encode(message.jwts[i], writer.uint32(/* id 3, wireType 2 =*/26).fork()).ldelim(); return writer; }; @@ -21290,6 +21490,11 @@ message.signatures = []; message.signatures.push($root.grafeas.v1.Signature.decode(reader, reader.uint32())); break; + case 3: + if (!(message.jwts && message.jwts.length)) + message.jwts = []; + message.jwts.push($root.grafeas.v1.Jwt.decode(reader, reader.uint32())); + break; default: reader.skipType(tag & 7); break; @@ -21337,6 +21542,15 @@ return "signatures." + error; } } + if (message.jwts != null && message.hasOwnProperty("jwts")) { + if (!Array.isArray(message.jwts)) + return "jwts: array expected"; + for (var i = 0; i < message.jwts.length; ++i) { + var error = $root.grafeas.v1.Jwt.verify(message.jwts[i]); + if (error) + return "jwts." + error; + } + } return null; }; @@ -21367,6 +21581,16 @@ message.signatures[i] = $root.grafeas.v1.Signature.fromObject(object.signatures[i]); } } + if (object.jwts) { + if (!Array.isArray(object.jwts)) + throw TypeError(".grafeas.v1.AttestationOccurrence.jwts: array expected"); + message.jwts = []; + for (var i = 0; i < object.jwts.length; ++i) { + if (typeof object.jwts[i] !== "object") + throw TypeError(".grafeas.v1.AttestationOccurrence.jwts: object expected"); + message.jwts[i] = $root.grafeas.v1.Jwt.fromObject(object.jwts[i]); + } + } return message; }; @@ -21383,8 +21607,10 @@ if (!options) options = {}; var object = {}; - if (options.arrays || options.defaults) + if (options.arrays || options.defaults) { object.signatures = []; + object.jwts = []; + } if (options.defaults) if (options.bytes === String) object.serializedPayload = ""; @@ -21400,6 +21626,11 @@ for (var j = 0; j < message.signatures.length; ++j) object.signatures[j] = $root.grafeas.v1.Signature.toObject(message.signatures[j], options); } + if (message.jwts && message.jwts.length) { + object.jwts = []; + for (var j = 0; j < message.jwts.length; ++j) + object.jwts[j] = $root.grafeas.v1.Jwt.toObject(message.jwts[j], options); + } return object; }; @@ -21430,6 +21661,8 @@ * @property {number} DISCOVERY=6 DISCOVERY value * @property {number} ATTESTATION=7 ATTESTATION value * @property {number} UPGRADE=8 UPGRADE value + * @property {number} COMPLIANCE=9 COMPLIANCE value + * @property {number} DSSE_ATTESTATION=10 DSSE_ATTESTATION value */ v1.NoteKind = (function() { var valuesById = {}, values = Object.create(valuesById); @@ -21442,6 +21675,8 @@ values[valuesById[6] = "DISCOVERY"] = 6; values[valuesById[7] = "ATTESTATION"] = 7; values[valuesById[8] = "UPGRADE"] = 8; + values[valuesById[9] = "COMPLIANCE"] = 9; + values[valuesById[10] = "DSSE_ATTESTATION"] = 10; return values; })(); @@ -21874,6 +22109,488 @@ return Signature; })(); + v1.Envelope = (function() { + + /** + * Properties of an Envelope. + * @memberof grafeas.v1 + * @interface IEnvelope + * @property {Uint8Array|null} [payload] Envelope payload + * @property {string|null} [payloadType] Envelope payloadType + * @property {Array.|null} [signatures] Envelope signatures + */ + + /** + * Constructs a new Envelope. + * @memberof grafeas.v1 + * @classdesc Represents an Envelope. + * @implements IEnvelope + * @constructor + * @param {grafeas.v1.IEnvelope=} [properties] Properties to set + */ + function Envelope(properties) { + this.signatures = []; + if (properties) + for (var keys = Object.keys(properties), i = 0; i < keys.length; ++i) + if (properties[keys[i]] != null) + this[keys[i]] = properties[keys[i]]; + } + + /** + * Envelope payload. + * @member {Uint8Array} payload + * @memberof grafeas.v1.Envelope + * @instance + */ + Envelope.prototype.payload = $util.newBuffer([]); + + /** + * Envelope payloadType. + * @member {string} payloadType + * @memberof grafeas.v1.Envelope + * @instance + */ + Envelope.prototype.payloadType = ""; + + /** + * Envelope signatures. + * @member {Array.} signatures + * @memberof grafeas.v1.Envelope + * @instance + */ + Envelope.prototype.signatures = $util.emptyArray; + + /** + * Creates a new Envelope instance using the specified properties. + * @function create + * @memberof grafeas.v1.Envelope + * @static + * @param {grafeas.v1.IEnvelope=} [properties] Properties to set + * @returns {grafeas.v1.Envelope} Envelope instance + */ + Envelope.create = function create(properties) { + return new Envelope(properties); + }; + + /** + * Encodes the specified Envelope message. Does not implicitly {@link grafeas.v1.Envelope.verify|verify} messages. + * @function encode + * @memberof grafeas.v1.Envelope + * @static + * @param {grafeas.v1.IEnvelope} message Envelope message or plain object to encode + * @param {$protobuf.Writer} [writer] Writer to encode to + * @returns {$protobuf.Writer} Writer + */ + Envelope.encode = function encode(message, writer) { + if (!writer) + writer = $Writer.create(); + if (message.payload != null && Object.hasOwnProperty.call(message, "payload")) + writer.uint32(/* id 1, wireType 2 =*/10).bytes(message.payload); + if (message.payloadType != null && Object.hasOwnProperty.call(message, "payloadType")) + writer.uint32(/* id 2, wireType 2 =*/18).string(message.payloadType); + if (message.signatures != null && message.signatures.length) + for (var i = 0; i < message.signatures.length; ++i) + $root.grafeas.v1.EnvelopeSignature.encode(message.signatures[i], writer.uint32(/* id 3, wireType 2 =*/26).fork()).ldelim(); + return writer; + }; + + /** + * Encodes the specified Envelope message, length delimited. Does not implicitly {@link grafeas.v1.Envelope.verify|verify} messages. + * @function encodeDelimited + * @memberof grafeas.v1.Envelope + * @static + * @param {grafeas.v1.IEnvelope} message Envelope message or plain object to encode + * @param {$protobuf.Writer} [writer] Writer to encode to + * @returns {$protobuf.Writer} Writer + */ + Envelope.encodeDelimited = function encodeDelimited(message, writer) { + return this.encode(message, writer).ldelim(); + }; + + /** + * Decodes an Envelope message from the specified reader or buffer. + * @function decode + * @memberof grafeas.v1.Envelope + * @static + * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from + * @param {number} [length] Message length if known beforehand + * @returns {grafeas.v1.Envelope} Envelope + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + Envelope.decode = function decode(reader, length) { + if (!(reader instanceof $Reader)) + reader = $Reader.create(reader); + var end = length === undefined ? reader.len : reader.pos + length, message = new $root.grafeas.v1.Envelope(); + while (reader.pos < end) { + var tag = reader.uint32(); + switch (tag >>> 3) { + case 1: + message.payload = reader.bytes(); + break; + case 2: + message.payloadType = reader.string(); + break; + case 3: + if (!(message.signatures && message.signatures.length)) + message.signatures = []; + message.signatures.push($root.grafeas.v1.EnvelopeSignature.decode(reader, reader.uint32())); + break; + default: + reader.skipType(tag & 7); + break; + } + } + return message; + }; + + /** + * Decodes an Envelope message from the specified reader or buffer, length delimited. + * @function decodeDelimited + * @memberof grafeas.v1.Envelope + * @static + * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from + * @returns {grafeas.v1.Envelope} Envelope + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + Envelope.decodeDelimited = function decodeDelimited(reader) { + if (!(reader instanceof $Reader)) + reader = new $Reader(reader); + return this.decode(reader, reader.uint32()); + }; + + /** + * Verifies an Envelope message. + * @function verify + * @memberof grafeas.v1.Envelope + * @static + * @param {Object.} message Plain object to verify + * @returns {string|null} `null` if valid, otherwise the reason why it is not + */ + Envelope.verify = function verify(message) { + if (typeof message !== "object" || message === null) + return "object expected"; + if (message.payload != null && message.hasOwnProperty("payload")) + if (!(message.payload && typeof message.payload.length === "number" || $util.isString(message.payload))) + return "payload: buffer expected"; + if (message.payloadType != null && message.hasOwnProperty("payloadType")) + if (!$util.isString(message.payloadType)) + return "payloadType: string expected"; + if (message.signatures != null && message.hasOwnProperty("signatures")) { + if (!Array.isArray(message.signatures)) + return "signatures: array expected"; + for (var i = 0; i < message.signatures.length; ++i) { + var error = $root.grafeas.v1.EnvelopeSignature.verify(message.signatures[i]); + if (error) + return "signatures." + error; + } + } + return null; + }; + + /** + * Creates an Envelope message from a plain object. Also converts values to their respective internal types. + * @function fromObject + * @memberof grafeas.v1.Envelope + * @static + * @param {Object.} object Plain object + * @returns {grafeas.v1.Envelope} Envelope + */ + Envelope.fromObject = function fromObject(object) { + if (object instanceof $root.grafeas.v1.Envelope) + return object; + var message = new $root.grafeas.v1.Envelope(); + if (object.payload != null) + if (typeof object.payload === "string") + $util.base64.decode(object.payload, message.payload = $util.newBuffer($util.base64.length(object.payload)), 0); + else if (object.payload.length) + message.payload = object.payload; + if (object.payloadType != null) + message.payloadType = String(object.payloadType); + if (object.signatures) { + if (!Array.isArray(object.signatures)) + throw TypeError(".grafeas.v1.Envelope.signatures: array expected"); + message.signatures = []; + for (var i = 0; i < object.signatures.length; ++i) { + if (typeof object.signatures[i] !== "object") + throw TypeError(".grafeas.v1.Envelope.signatures: object expected"); + message.signatures[i] = $root.grafeas.v1.EnvelopeSignature.fromObject(object.signatures[i]); + } + } + return message; + }; + + /** + * Creates a plain object from an Envelope message. Also converts values to other types if specified. + * @function toObject + * @memberof grafeas.v1.Envelope + * @static + * @param {grafeas.v1.Envelope} message Envelope + * @param {$protobuf.IConversionOptions} [options] Conversion options + * @returns {Object.} Plain object + */ + Envelope.toObject = function toObject(message, options) { + if (!options) + options = {}; + var object = {}; + if (options.arrays || options.defaults) + object.signatures = []; + if (options.defaults) { + if (options.bytes === String) + object.payload = ""; + else { + object.payload = []; + if (options.bytes !== Array) + object.payload = $util.newBuffer(object.payload); + } + object.payloadType = ""; + } + if (message.payload != null && message.hasOwnProperty("payload")) + object.payload = options.bytes === String ? $util.base64.encode(message.payload, 0, message.payload.length) : options.bytes === Array ? Array.prototype.slice.call(message.payload) : message.payload; + if (message.payloadType != null && message.hasOwnProperty("payloadType")) + object.payloadType = message.payloadType; + if (message.signatures && message.signatures.length) { + object.signatures = []; + for (var j = 0; j < message.signatures.length; ++j) + object.signatures[j] = $root.grafeas.v1.EnvelopeSignature.toObject(message.signatures[j], options); + } + return object; + }; + + /** + * Converts this Envelope to JSON. + * @function toJSON + * @memberof grafeas.v1.Envelope + * @instance + * @returns {Object.} JSON object + */ + Envelope.prototype.toJSON = function toJSON() { + return this.constructor.toObject(this, $protobuf.util.toJSONOptions); + }; + + return Envelope; + })(); + + v1.EnvelopeSignature = (function() { + + /** + * Properties of an EnvelopeSignature. + * @memberof grafeas.v1 + * @interface IEnvelopeSignature + * @property {Uint8Array|null} [sig] EnvelopeSignature sig + * @property {string|null} [keyid] EnvelopeSignature keyid + */ + + /** + * Constructs a new EnvelopeSignature. + * @memberof grafeas.v1 + * @classdesc Represents an EnvelopeSignature. + * @implements IEnvelopeSignature + * @constructor + * @param {grafeas.v1.IEnvelopeSignature=} [properties] Properties to set + */ + function EnvelopeSignature(properties) { + if (properties) + for (var keys = Object.keys(properties), i = 0; i < keys.length; ++i) + if (properties[keys[i]] != null) + this[keys[i]] = properties[keys[i]]; + } + + /** + * EnvelopeSignature sig. + * @member {Uint8Array} sig + * @memberof grafeas.v1.EnvelopeSignature + * @instance + */ + EnvelopeSignature.prototype.sig = $util.newBuffer([]); + + /** + * EnvelopeSignature keyid. + * @member {string} keyid + * @memberof grafeas.v1.EnvelopeSignature + * @instance + */ + EnvelopeSignature.prototype.keyid = ""; + + /** + * Creates a new EnvelopeSignature instance using the specified properties. + * @function create + * @memberof grafeas.v1.EnvelopeSignature + * @static + * @param {grafeas.v1.IEnvelopeSignature=} [properties] Properties to set + * @returns {grafeas.v1.EnvelopeSignature} EnvelopeSignature instance + */ + EnvelopeSignature.create = function create(properties) { + return new EnvelopeSignature(properties); + }; + + /** + * Encodes the specified EnvelopeSignature message. Does not implicitly {@link grafeas.v1.EnvelopeSignature.verify|verify} messages. + * @function encode + * @memberof grafeas.v1.EnvelopeSignature + * @static + * @param {grafeas.v1.IEnvelopeSignature} message EnvelopeSignature message or plain object to encode + * @param {$protobuf.Writer} [writer] Writer to encode to + * @returns {$protobuf.Writer} Writer + */ + EnvelopeSignature.encode = function encode(message, writer) { + if (!writer) + writer = $Writer.create(); + if (message.sig != null && Object.hasOwnProperty.call(message, "sig")) + writer.uint32(/* id 1, wireType 2 =*/10).bytes(message.sig); + if (message.keyid != null && Object.hasOwnProperty.call(message, "keyid")) + writer.uint32(/* id 2, wireType 2 =*/18).string(message.keyid); + return writer; + }; + + /** + * Encodes the specified EnvelopeSignature message, length delimited. Does not implicitly {@link grafeas.v1.EnvelopeSignature.verify|verify} messages. + * @function encodeDelimited + * @memberof grafeas.v1.EnvelopeSignature + * @static + * @param {grafeas.v1.IEnvelopeSignature} message EnvelopeSignature message or plain object to encode + * @param {$protobuf.Writer} [writer] Writer to encode to + * @returns {$protobuf.Writer} Writer + */ + EnvelopeSignature.encodeDelimited = function encodeDelimited(message, writer) { + return this.encode(message, writer).ldelim(); + }; + + /** + * Decodes an EnvelopeSignature message from the specified reader or buffer. + * @function decode + * @memberof grafeas.v1.EnvelopeSignature + * @static + * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from + * @param {number} [length] Message length if known beforehand + * @returns {grafeas.v1.EnvelopeSignature} EnvelopeSignature + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + EnvelopeSignature.decode = function decode(reader, length) { + if (!(reader instanceof $Reader)) + reader = $Reader.create(reader); + var end = length === undefined ? reader.len : reader.pos + length, message = new $root.grafeas.v1.EnvelopeSignature(); + while (reader.pos < end) { + var tag = reader.uint32(); + switch (tag >>> 3) { + case 1: + message.sig = reader.bytes(); + break; + case 2: + message.keyid = reader.string(); + break; + default: + reader.skipType(tag & 7); + break; + } + } + return message; + }; + + /** + * Decodes an EnvelopeSignature message from the specified reader or buffer, length delimited. + * @function decodeDelimited + * @memberof grafeas.v1.EnvelopeSignature + * @static + * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from + * @returns {grafeas.v1.EnvelopeSignature} EnvelopeSignature + * @throws {Error} If the payload is not a reader or valid buffer + * @throws {$protobuf.util.ProtocolError} If required fields are missing + */ + EnvelopeSignature.decodeDelimited = function decodeDelimited(reader) { + if (!(reader instanceof $Reader)) + reader = new $Reader(reader); + return this.decode(reader, reader.uint32()); + }; + + /** + * Verifies an EnvelopeSignature message. + * @function verify + * @memberof grafeas.v1.EnvelopeSignature + * @static + * @param {Object.} message Plain object to verify + * @returns {string|null} `null` if valid, otherwise the reason why it is not + */ + EnvelopeSignature.verify = function verify(message) { + if (typeof message !== "object" || message === null) + return "object expected"; + if (message.sig != null && message.hasOwnProperty("sig")) + if (!(message.sig && typeof message.sig.length === "number" || $util.isString(message.sig))) + return "sig: buffer expected"; + if (message.keyid != null && message.hasOwnProperty("keyid")) + if (!$util.isString(message.keyid)) + return "keyid: string expected"; + return null; + }; + + /** + * Creates an EnvelopeSignature message from a plain object. Also converts values to their respective internal types. + * @function fromObject + * @memberof grafeas.v1.EnvelopeSignature + * @static + * @param {Object.} object Plain object + * @returns {grafeas.v1.EnvelopeSignature} EnvelopeSignature + */ + EnvelopeSignature.fromObject = function fromObject(object) { + if (object instanceof $root.grafeas.v1.EnvelopeSignature) + return object; + var message = new $root.grafeas.v1.EnvelopeSignature(); + if (object.sig != null) + if (typeof object.sig === "string") + $util.base64.decode(object.sig, message.sig = $util.newBuffer($util.base64.length(object.sig)), 0); + else if (object.sig.length) + message.sig = object.sig; + if (object.keyid != null) + message.keyid = String(object.keyid); + return message; + }; + + /** + * Creates a plain object from an EnvelopeSignature message. Also converts values to other types if specified. + * @function toObject + * @memberof grafeas.v1.EnvelopeSignature + * @static + * @param {grafeas.v1.EnvelopeSignature} message EnvelopeSignature + * @param {$protobuf.IConversionOptions} [options] Conversion options + * @returns {Object.} Plain object + */ + EnvelopeSignature.toObject = function toObject(message, options) { + if (!options) + options = {}; + var object = {}; + if (options.defaults) { + if (options.bytes === String) + object.sig = ""; + else { + object.sig = []; + if (options.bytes !== Array) + object.sig = $util.newBuffer(object.sig); + } + object.keyid = ""; + } + if (message.sig != null && message.hasOwnProperty("sig")) + object.sig = options.bytes === String ? $util.base64.encode(message.sig, 0, message.sig.length) : options.bytes === Array ? Array.prototype.slice.call(message.sig) : message.sig; + if (message.keyid != null && message.hasOwnProperty("keyid")) + object.keyid = message.keyid; + return object; + }; + + /** + * Converts this EnvelopeSignature to JSON. + * @function toJSON + * @memberof grafeas.v1.EnvelopeSignature + * @instance + * @returns {Object.} JSON object + */ + EnvelopeSignature.prototype.toJSON = function toJSON() { + return this.constructor.toObject(this, $protobuf.util.toJSONOptions); + }; + + return EnvelopeSignature; + })(); + return v1; })(); diff --git a/protos/protos.json b/protos/protos.json index 8aa7f68..dcae1ef 100644 --- a/protos/protos.json +++ b/protos/protos.json @@ -2440,6 +2440,14 @@ } } }, + "Jwt": { + "fields": { + "compactJwt": { + "type": "string", + "id": 1 + } + } + }, "AttestationOccurrence": { "fields": { "serializedPayload": { @@ -2450,6 +2458,11 @@ "rule": "repeated", "type": "Signature", "id": 2 + }, + "jwts": { + "rule": "repeated", + "type": "Jwt", + "id": 3 } } }, @@ -2463,7 +2476,9 @@ "DEPLOYMENT": 5, "DISCOVERY": 6, "ATTESTATION": 7, - "UPGRADE": 8 + "UPGRADE": 8, + "COMPLIANCE": 9, + "DSSE_ATTESTATION": 10 } }, "RelatedUrl": { @@ -2489,6 +2504,35 @@ "id": 2 } } + }, + "Envelope": { + "fields": { + "payload": { + "type": "bytes", + "id": 1 + }, + "payloadType": { + "type": "string", + "id": 2 + }, + "signatures": { + "rule": "repeated", + "type": "EnvelopeSignature", + "id": 3 + } + } + }, + "EnvelopeSignature": { + "fields": { + "sig": { + "type": "bytes", + "id": 1 + }, + "keyid": { + "type": "string", + "id": 2 + } + } } } }