fix: include the compliance protos (#134)

* fix: Modify the bazel.BUILD file by hand to include the compliance protos which are not autogenerated

PiperOrigin-RevId: 420306668

Source-Link: googleapis/googleapis@9a8910e

Source-Link: googleapis/googleapis-gen@24c9bfc
Copy-Tag: eyJwIjoiLmdpdGh1Yi8uT3dsQm90LnlhbWwiLCJoIjoiMjRjOWJmYzRkNTlmNTBhNDllMjJhNjA3MGQxYzIyOWY1MjNkZWZkYyJ9

* 🦉 Updates from OwlBot

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

grafeas/grafeas/__init__.py

@@ -31,6 +31,7 @@
 from grafeas.grafeas_v1.types.compliance import ComplianceOccurrence
 from grafeas.grafeas_v1.types.compliance import ComplianceVersion
 from grafeas.grafeas_v1.types.compliance import NonCompliantFile
+from grafeas.grafeas_v1.types.cvss import CVSS
 from grafeas.grafeas_v1.types.cvss import CVSSv3
 from grafeas.grafeas_v1.types.deployment import DeploymentNote
 from grafeas.grafeas_v1.types.deployment import DeploymentOccurrence
@@ -89,14 +90,14 @@
 from grafeas.grafeas_v1.types.provenance import RepoId
 from grafeas.grafeas_v1.types.provenance import Source
 from grafeas.grafeas_v1.types.provenance import SourceContext
+from grafeas.grafeas_v1.types.severity import Severity
 from grafeas.grafeas_v1.types.slsa_provenance import SlsaProvenance
 from grafeas.grafeas_v1.types.upgrade import UpgradeDistribution
 from grafeas.grafeas_v1.types.upgrade import UpgradeNote
 from grafeas.grafeas_v1.types.upgrade import UpgradeOccurrence
 from grafeas.grafeas_v1.types.upgrade import WindowsUpdate
 from grafeas.grafeas_v1.types.vulnerability import VulnerabilityNote
 from grafeas.grafeas_v1.types.vulnerability import VulnerabilityOccurrence
-from grafeas.grafeas_v1.types.vulnerability import Severity
 
 __all__ = (
     "GrafeasClient",
@@ -115,6 +116,7 @@
     "ComplianceOccurrence",
     "ComplianceVersion",
     "NonCompliantFile",
+    "CVSS",
     "CVSSv3",
     "DeploymentNote",
     "DeploymentOccurrence",
@@ -173,12 +175,12 @@
     "RepoId",
     "Source",
     "SourceContext",
+    "Severity",
     "SlsaProvenance",
     "UpgradeDistribution",
     "UpgradeNote",
     "UpgradeOccurrence",
     "WindowsUpdate",
     "VulnerabilityNote",
     "VulnerabilityOccurrence",
-    "Severity",
 )

grafeas/grafeas_v1/__init__.py

@@ -31,6 +31,7 @@
 from .types.compliance import ComplianceOccurrence
 from .types.compliance import ComplianceVersion
 from .types.compliance import NonCompliantFile
+from .types.cvss import CVSS
 from .types.cvss import CVSSv3
 from .types.deployment import DeploymentNote
 from .types.deployment import DeploymentOccurrence
@@ -89,14 +90,14 @@
 from .types.provenance import RepoId
 from .types.provenance import Source
 from .types.provenance import SourceContext
+from .types.severity import Severity
 from .types.slsa_provenance import SlsaProvenance
 from .types.upgrade import UpgradeDistribution
 from .types.upgrade import UpgradeNote
 from .types.upgrade import UpgradeOccurrence
 from .types.upgrade import WindowsUpdate
 from .types.vulnerability import VulnerabilityNote
 from .types.vulnerability import VulnerabilityOccurrence
-from .types.vulnerability import Severity
 
 __all__ = (
     "GrafeasAsyncClient",
@@ -113,6 +114,7 @@
     "BuildOccurrence",
     "BuildProvenance",
     "BuilderConfig",
+    "CVSS",
     "CVSSv3",
     "CloudRepoSourceContext",
     "Command",

grafeas/grafeas_v1/types/__init__.py

@@ -35,7 +35,10 @@
     ComplianceVersion,
     NonCompliantFile,
 )
-from .cvss import CVSSv3
+from .cvss import (
+    CVSS,
+    CVSSv3,
+)
 from .deployment import (
     DeploymentNote,
     DeploymentOccurrence,
@@ -121,7 +124,6 @@
 from .vulnerability import (
     VulnerabilityNote,
     VulnerabilityOccurrence,
-    Severity,
 )
 
 __all__ = (
@@ -139,6 +141,7 @@
     "ComplianceOccurrence",
     "ComplianceVersion",
     "NonCompliantFile",
+    "CVSS",
     "CVSSv3",
     "DeploymentNote",
     "DeploymentOccurrence",
@@ -197,12 +200,12 @@
     "RepoId",
     "Source",
     "SourceContext",
+    "Severity",
     "SlsaProvenance",
     "UpgradeDistribution",
     "UpgradeNote",
     "UpgradeOccurrence",
     "WindowsUpdate",
     "VulnerabilityNote",
     "VulnerabilityOccurrence",
-    "Severity",
 )

grafeas/grafeas_v1/types/compliance.py

@@ -15,7 +15,7 @@
 #
 import proto  # type: ignore
 
-from grafeas.grafeas_v1.types import vulnerability
+from grafeas.grafeas_v1.types import severity as g_severity
 
 
 __protobuf__ = proto.module(
@@ -68,7 +68,7 @@ class CisBenchmark(proto.Message):
         """
 
         profile_level = proto.Field(proto.INT32, number=1,)
-        severity = proto.Field(proto.ENUM, number=2, enum=vulnerability.Severity,)
+        severity = proto.Field(proto.ENUM, number=2, enum=g_severity.Severity,)
 
     title = proto.Field(proto.STRING, number=1,)
     description = proto.Field(proto.STRING, number=2,)

grafeas/grafeas_v1/types/cvss.py

@@ -16,7 +16,7 @@
 import proto  # type: ignore
 
 
-__protobuf__ = proto.module(package="grafeas.v1", manifest={"CVSSv3",},)
+__protobuf__ = proto.module(package="grafeas.v1", manifest={"CVSSv3", "CVSS",},)
 
 
 class CVSSv3(proto.Message):
@@ -106,4 +106,104 @@ class Impact(proto.Enum):
     availability_impact = proto.Field(proto.ENUM, number=12, enum=Impact,)
 
 
+class CVSS(proto.Message):
+    r"""Common Vulnerability Scoring System.
+    For details, see https://www.first.org/cvss/specification-
+    document This is a message we will try to use for storing
+    multiple versions of CVSS. The intention is that as new versions
+    of CVSS scores get added, we will be able to modify this message
+    rather than adding new protos for each new version of the score.
+
+    Attributes:
+        base_score (float):
+            The base score is a function of the base
+            metric scores.
+        exploitability_score (float):
+
+        impact_score (float):
+
+        attack_vector (grafeas.grafeas_v1.types.CVSS.AttackVector):
+            Base Metrics
+            Represents the intrinsic characteristics of a
+            vulnerability that are constant over time and
+            across user environments.
+        attack_complexity (grafeas.grafeas_v1.types.CVSS.AttackComplexity):
+
+        authentication (grafeas.grafeas_v1.types.CVSS.Authentication):
+
+        privileges_required (grafeas.grafeas_v1.types.CVSS.PrivilegesRequired):
+
+        user_interaction (grafeas.grafeas_v1.types.CVSS.UserInteraction):
+
+        scope (grafeas.grafeas_v1.types.CVSS.Scope):
+
+        confidentiality_impact (grafeas.grafeas_v1.types.CVSS.Impact):
+
+        integrity_impact (grafeas.grafeas_v1.types.CVSS.Impact):
+
+        availability_impact (grafeas.grafeas_v1.types.CVSS.Impact):
+
+    """
+
+    class AttackVector(proto.Enum):
+        r""""""
+        ATTACK_VECTOR_UNSPECIFIED = 0
+        ATTACK_VECTOR_NETWORK = 1
+        ATTACK_VECTOR_ADJACENT = 2
+        ATTACK_VECTOR_LOCAL = 3
+        ATTACK_VECTOR_PHYSICAL = 4
+
+    class AttackComplexity(proto.Enum):
+        r""""""
+        ATTACK_COMPLEXITY_UNSPECIFIED = 0
+        ATTACK_COMPLEXITY_LOW = 1
+        ATTACK_COMPLEXITY_HIGH = 2
+
+    class Authentication(proto.Enum):
+        r""""""
+        AUTHENTICATION_UNSPECIFIED = 0
+        AUTHENTICATION_MULTIPLE = 1
+        AUTHENTICATION_SINGLE = 2
+        AUTHENTICATION_NONE = 3
+
+    class PrivilegesRequired(proto.Enum):
+        r""""""
+        PRIVILEGES_REQUIRED_UNSPECIFIED = 0
+        PRIVILEGES_REQUIRED_NONE = 1
+        PRIVILEGES_REQUIRED_LOW = 2
+        PRIVILEGES_REQUIRED_HIGH = 3
+
+    class UserInteraction(proto.Enum):
+        r""""""
+        USER_INTERACTION_UNSPECIFIED = 0
+        USER_INTERACTION_NONE = 1
+        USER_INTERACTION_REQUIRED = 2
+
+    class Scope(proto.Enum):
+        r""""""
+        SCOPE_UNSPECIFIED = 0
+        SCOPE_UNCHANGED = 1
+        SCOPE_CHANGED = 2
+
+    class Impact(proto.Enum):
+        r""""""
+        IMPACT_UNSPECIFIED = 0
+        IMPACT_HIGH = 1
+        IMPACT_LOW = 2
+        IMPACT_NONE = 3
+
+    base_score = proto.Field(proto.FLOAT, number=1,)
+    exploitability_score = proto.Field(proto.FLOAT, number=2,)
+    impact_score = proto.Field(proto.FLOAT, number=3,)
+    attack_vector = proto.Field(proto.ENUM, number=4, enum=AttackVector,)
+    attack_complexity = proto.Field(proto.ENUM, number=5, enum=AttackComplexity,)
+    authentication = proto.Field(proto.ENUM, number=6, enum=Authentication,)
+    privileges_required = proto.Field(proto.ENUM, number=7, enum=PrivilegesRequired,)
+    user_interaction = proto.Field(proto.ENUM, number=8, enum=UserInteraction,)
+    scope = proto.Field(proto.ENUM, number=9, enum=Scope,)
+    confidentiality_impact = proto.Field(proto.ENUM, number=10, enum=Impact,)
+    integrity_impact = proto.Field(proto.ENUM, number=11, enum=Impact,)
+    availability_impact = proto.Field(proto.ENUM, number=12, enum=Impact,)
+
+
 __all__ = tuple(sorted(__protobuf__.manifest))

grafeas/grafeas_v1/types/discovery.py

@@ -58,6 +58,9 @@ class DiscoveryOccurrence(proto.Message):
             The CPE of the resource being scanned.
         last_scan_time (google.protobuf.timestamp_pb2.Timestamp):
             The last time this resource was scanned.
+        archive_time (google.protobuf.timestamp_pb2.Timestamp):
+            The time occurrences related to this
+            discovery occurrence were archived.
     """
 
     class ContinuousAnalysis(proto.Enum):
@@ -86,6 +89,9 @@ class AnalysisStatus(proto.Enum):
     last_scan_time = proto.Field(
         proto.MESSAGE, number=5, message=timestamp_pb2.Timestamp,
     )
+    archive_time = proto.Field(
+        proto.MESSAGE, number=6, message=timestamp_pb2.Timestamp,
+    )
 
 
 __all__ = tuple(sorted(__protobuf__.manifest))

grafeas/grafeas_v1/types/severity.py

@@ -0,0 +1,32 @@
+# -*- coding: utf-8 -*-
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+import proto  # type: ignore
+
+
+__protobuf__ = proto.module(package="grafeas.v1", manifest={"Severity",},)
+
+
+class Severity(proto.Enum):
+    r"""Note provider assigned severity/impact ranking."""
+    SEVERITY_UNSPECIFIED = 0
+    MINIMAL = 1
+    LOW = 2
+    MEDIUM = 3
+    HIGH = 4
+    CRITICAL = 5
+
+
+__all__ = tuple(sorted(__protobuf__.manifest))

grafeas/grafeas_v1/types/vulnerability.py

@@ -19,24 +19,14 @@
 from grafeas.grafeas_v1.types import common
 from grafeas.grafeas_v1.types import cvss
 from grafeas.grafeas_v1.types import package
+from grafeas.grafeas_v1.types import severity as g_severity
 
 
 __protobuf__ = proto.module(
-    package="grafeas.v1",
-    manifest={"Severity", "VulnerabilityNote", "VulnerabilityOccurrence",},
+    package="grafeas.v1", manifest={"VulnerabilityNote", "VulnerabilityOccurrence",},
 )
 
 
-class Severity(proto.Enum):
-    r"""Note provider assigned severity/impact ranking."""
-    SEVERITY_UNSPECIFIED = 0
-    MINIMAL = 1
-    LOW = 2
-    MEDIUM = 3
-    HIGH = 4
-    CRITICAL = 5
-
-
 class VulnerabilityNote(proto.Message):
     r"""A security vulnerability that can be found in resources.
 
@@ -204,7 +194,7 @@ class KnowledgeBase(proto.Message):
         )
 
     cvss_score = proto.Field(proto.FLOAT, number=1,)
-    severity = proto.Field(proto.ENUM, number=2, enum="Severity",)
+    severity = proto.Field(proto.ENUM, number=2, enum=g_severity.Severity,)
     details = proto.RepeatedField(proto.MESSAGE, number=3, message=Detail,)
     cvss_v3 = proto.Field(proto.MESSAGE, number=4, message=cvss.CVSSv3,)
     windows_details = proto.RepeatedField(
@@ -231,7 +221,7 @@ class VulnerabilityOccurrence(proto.Message):
             vulnerability. CVSS score is on a scale of 0 -
             10 where 0 indicates low severity and 10
             indicates high severity.
-        cvssv3 (grafeas.grafeas_v1.types.VulnerabilityOccurrence.CVSSV3):
+        cvssv3 (grafeas.grafeas_v1.types.CVSS):
             The cvss v3 score for the vulnerability.
         package_issue (Sequence[grafeas.grafeas_v1.types.VulnerabilityOccurrence.PackageIssue]):
             Required. The set of affected locations and
@@ -265,21 +255,6 @@ class VulnerabilityOccurrence(proto.Message):
             affected packages has a fix available.
     """
 
-    class CVSSV3(proto.Message):
-        r"""The CVSS v3 score for this vulnerability.
-
-        Attributes:
-            base_score (float):
-                The base score for for this vulnerability
-                according to cvss v3.
-            severity (grafeas.grafeas_v1.types.Severity):
-                The severity rating assigned to this
-                vulnerability by vulnerability provider.
-        """
-
-        base_score = proto.Field(proto.FLOAT, number=1,)
-        severity = proto.Field(proto.ENUM, number=2, enum="Severity",)
-
     class PackageIssue(proto.Message):
         r"""A detail for a distro and package this vulnerability
         occurrence was found in and its associated fix (if one is
@@ -331,19 +306,21 @@ class PackageIssue(proto.Message):
         fixed_version = proto.Field(proto.MESSAGE, number=6, message=package.Version,)
         fix_available = proto.Field(proto.BOOL, number=7,)
         package_type = proto.Field(proto.STRING, number=8,)
-        effective_severity = proto.Field(proto.ENUM, number=9, enum="Severity",)
+        effective_severity = proto.Field(
+            proto.ENUM, number=9, enum=g_severity.Severity,
+        )
 
     type_ = proto.Field(proto.STRING, number=1,)
-    severity = proto.Field(proto.ENUM, number=2, enum="Severity",)
+    severity = proto.Field(proto.ENUM, number=2, enum=g_severity.Severity,)
     cvss_score = proto.Field(proto.FLOAT, number=3,)
-    cvssv3 = proto.Field(proto.MESSAGE, number=10, message=CVSSV3,)
+    cvssv3 = proto.Field(proto.MESSAGE, number=10, message=cvss.CVSS,)
     package_issue = proto.RepeatedField(proto.MESSAGE, number=4, message=PackageIssue,)
     short_description = proto.Field(proto.STRING, number=5,)
     long_description = proto.Field(proto.STRING, number=6,)
     related_urls = proto.RepeatedField(
         proto.MESSAGE, number=7, message=common.RelatedUrl,
     )
-    effective_severity = proto.Field(proto.ENUM, number=8, enum="Severity",)
+    effective_severity = proto.Field(proto.ENUM, number=8, enum=g_severity.Severity,)
     fix_available = proto.Field(proto.BOOL, number=9,)