cloudPlatformScope _requesterprojects locations operationsscanscanceldeletegetlistwaitvulnerabilitiesanalyzePackagesincludeOsvDatapackages resourceUritoJsonjwtsserializedPayloadserializedPayloadAsBytes signatures binaryVersion sourceVersion buildTypeexternalParametersinternalParametersresolvedDependenciesinTotoSlsaProvenanceV1intotoProvenanceintotoStatement provenanceprovenanceBytes buildOptionsbuilderVersionbuiltArtifactscommands createTimecreatorendTimeidlogsUri projectIdsourceProvenance startTime triggerId aliasContextrepoId revisionIdnonComplianceReasonnonCompliantFilesversionenvelope statementanalysisCompleted analysisErroranalysisStatusanalysisStatusError archiveTimecontinuousAnalysiscpefiles lastScanTimelastVulnerabilityUpdateTime sbomStatuspayloadpayloadAsBytes payloadTypefileHashfilePath layerDetails gerritProjecthostUri layerCountnameregistry repository baseImageschainIdcommanddiffIdindex configSource environment parametersbuildFinishedOnbuildInvocationIdbuildStartedOn completeness reproduciblebaseResourceUrldistance fingerprint layerInfo builderConfig materialsmetadatarecipeP_type predicate predicateTypesubjectslsaProvenanceslsaProvenanceZeroTwopackage nextPageToken unreachable occurrencescpeUripathemailkindurl attestationbuild compliance deployment discoverydsseAttestationimagenoteName remediation sbomReferencesecret updateTimeupgrade vulnerabilitydoneerrorresponse architecturebinarySourceInfodependencyChain fileLocation hashDigestlicenses maintaineros osVersion packageType patchedCveunusedaffectedCpeUriaffectedPackageaffectedVersioneffectiveSeverity fixAvailable fixedCpeUri fixedPackage fixedVersionlicenselocationbuilderDependenciesdetailsremediationTyperemediationUri projectRepoIduidcisaKevepssbuilder byproductsstatusesbuildDefinition runDetails buildConfig invocationadditionalContextsartifactStorageSourceUricontext fileHashes cloudRepogerritgitlabels distribution parsedVersion windowsUpdatecveimpacts justification relatedUris remediationsstatevulnerabilityId cvssScorecvssV2 cvssVersioncvssv3 extraDetailslongDescription packageIssue relatedUrlsriskseverityshortDescriptiontype vexAssessment categories descriptionidentity kbArticleIdslastPublishedTimestamp supportUrltitlekOnDemandScanningApiProjectsResourceProjectsLocationsResource#ProjectsLocationsOperationsResourceProjectsLocationsScansResource-ProjectsLocationsScansVulnerabilitiesResource AliasContextAnalysisCompletedAnalyzePackagesRequestV1ArtifactAttestationOccurrence BaseImageBinarySourceInfoBuildDefinition BuildMetadataBuildOccurrenceBuildProvenance BuilderConfig!CISAKnownExploitedVulnerabilitiesCVSSCategoryCloudRepoSourceContextCommand CompletenessComplianceOccurrenceComplianceVersionDSSEAttestationOccurrenceDeploymentOccurrenceDiscoveryOccurrenceEmptyEnvelopeEnvelopeSignatureExploitPredictionScoringSystemFile FileHashes FileLocation FingerprintGerritSourceContextGitSourceContextGrafeasV1BaseImageGrafeasV1FileLocationGrafeasV1LayerDetails)GrafeasV1SlsaProvenanceZeroTwoSlsaBuilder.GrafeasV1SlsaProvenanceZeroTwoSlsaCompleteness.GrafeasV1SlsaProvenanceZeroTwoSlsaConfigSource,GrafeasV1SlsaProvenanceZeroTwoSlsaInvocation*GrafeasV1SlsaProvenanceZeroTwoSlsaMaterial*GrafeasV1SlsaProvenanceZeroTwoSlsaMetadataHashIdentityImageOccurrenceInTotoProvenanceInTotoSlsaProvenanceV1InTotoStatement JustificationJwtLanguagePackageDependencyLayer LayerDetailsLicenseListOperationsResponseListVulnerabilitiesResponseV1Location MaintainerMaterialMetadataNonCompliantFile Occurrence Operation PackageData PackageIssuePackageOccurrencePackageVersion ProjectRepoIdProvenanceBuilderRecipe RelatedUrl RemediationRepoIdResourceDescriptorRisk RunDetailsSBOMReferenceOccurrence SBOMStatusSbomReferenceIntotoPayloadSbomReferenceIntotoPredicateSecretLocationSecretOccurrence SecretStatus Signature SlsaBuilderSlsaCompleteness SlsaMetadataSlsaProvenanceSlsaProvenanceV1SlsaProvenanceZeroTwo SlsaRecipeSource SourceContextStatusSubjectUpgradeDistributionUpgradeOccurrenceVersion VexAssessmentVulnerabilityOccurrence WindowsUpdateApiRequestErrorDetailedApiRequestError ApiRequesterClientStringrootUrl servicePathrequestHeaders$fieldsFutureListUri encodeFullrequest queryParamsfromJsonMapdynamicfilterpageSize pageTokenreturnPartialSuccessintbooltimeoutjsonencodebody $AliasContext$AnalysisCompleted DeprecatedincludeOsvDatapackagesmapvaluetoList resourceUri $Artifactbase64decode replaceAlljwtsserializedPayload signatures $BaseImage binaryVersion containsKey sourceVersionObject buildTypeexternalParametersinternalParametersresolvedDependencies$BuildMetadatainTotoSlsaProvenanceV1intotoProvenanceintotoStatement provenanceprovenanceBytes buildOptionsMapEntrykeybuilderVersionbuiltArtifactscommands createTimecreatorendTimeidlogsUri projectIdsourceProvenance startTime triggerId $Shared03"$CISAKnownExploitedVulnerabilities$CVSS $Category aliasContextrepoId revisionId$Command $CompletenessnonComplianceReasonnonCompliantFilesversion$ComplianceVersionenvelope statement$DeploymentOccurrenceanalysisCompleted analysisErroranalysisStatusanalysisStatusError archiveTimecontinuousAnalysiscpefiles lastScanTimelastVulnerabilityUpdateTime sbomStatus$Emptypayload payloadType$EnvelopeSignature$ExploitPredictionScoringSystem$FilefileHashfilePath layerDetails $Fingerprint gerritProjecthostUri$GitSourceContext layerCountnameregistry repository baseImageschainIdcommanddiffIdindex/$GrafeasV1SlsaProvenanceZeroTwoSlsaCompleteness/$GrafeasV1SlsaProvenanceZeroTwoSlsaConfigSource configSource environment parameters $MaterialbuildFinishedOnbuildInvocationIdbuildStartedOn completeness reproducible$Hash $IdentitybaseResourceUrldistance fingerprint layerInfo builderConfig materialsmetadatarecipeP_type predicate predicateTypesubjectslsaProvenanceslsaProvenanceZeroTwo$Justification$Jwtpackage$Layer$License nextPageToken operations unreachable occurrencescpeUripathemailkindurl$NonCompliantFile attestationbuild compliance deployment discoverydsseAttestationimagenoteName remediation sbomReferencesecret updateTimeupgrade vulnerabilitydoneerrorresponse architecturebinarySourceInfodependencyChain fileLocation hashDigestlicenses maintaineros osVersion packageType patchedCveunusedaffectedCpeUriaffectedPackageaffectedVersioneffectiveSeverity fixAvailable fixedCpeUri fixedPackage fixedVersionlicenselocation$ProjectRepoIdbuilderDependencies$Recipe $RelatedUrldetailsremediationTyperemediationUri projectRepoIduid$ResourceDescriptorcisaKevepssbuilder byproducts $SBOMStatus$SbomReferenceIntotoPredicate locationsstatuses $SecretStatus $SignaturebuildDefinition runDetails buildConfig invocation $SlsaRecipeadditionalContextsartifactStorageSourceUricontext fileHashes cloudRepogerritgitlabels $Status00$Subject$UpgradeDistribution distribution parsedVersion windowsUpdate$Versioncveimpacts justification relatedUris remediationsstatevulnerabilityIddouble cvssScorenumtoDoublecvssV2 cvssVersioncvssv3 extraDetailslongDescription packageIssue relatedUrlsriskseverityshortDescriptiontype vexAssessment categories descriptionidentity kbArticleIdslastPublishedTimestamp supportUrltitle6(~\BM ApiRequestErrorDetailedApiRequestErrorq:package:_discoveryapis_commons/_discoveryapis_commons.dart`svasyncv dart:async~convert dart:convertcore dart:corecommons:package:_discoveryapis_commons/_discoveryapis_commons.dart ,/http/package:http/http.dart7../shared.dartP../src/user_agent.dart!/kGHmЀ)[ʂ*`ał.2}U^_} 56Opq%A܇>?DUg}@A։׊Ft&OPJ/̎7=W]P`fݏAvő:AB‘БEIJrxÓZ`zߔ &q b&[bc˖ז\`a5;n͘ә.4X^šH؛ LM}[aΜԝV\ÝL1ˠeu{gɡ.Smz+gݤab̤Ӥ7>BC̥Ҧh Tڧ>\A+1;SmԬ ?FGŬӬLPRSz,-kîdEU[ְ:oڱ1q ;GUhGH!rԵ.4rxٶ߷*:@x~Ϸܷ3hθQ˺VWȺ3:>@Ab¼89ӽYhnڽ޽?@};JVɿ@ @I@Z@h@@@@@A%AIAsAAAAAAAABB=B>BuByBC CRCCD2DgDDDEEdEEF>FFFFG"G(G8GZGGGGH&H>H\H{HHHHII`IIIJ$J%JVJbJJJKKK-KtKKKL*L;LIL`LiLjLLLMM"M7MfMMMMMMMMN N$N*NyNOOWOxOyOOOP3PPPPQ'Q(QTQ`QQRR R4RnRRRSSSSCSqSSSSST T'T(T.T4TTUUUU UXUUVVV%V9VVVsVVVVVWWKWWWXEXYXXXY,Y=YKYbYkYlYYYZ3ZoZ|ZZZ[2[9[=[?[@[h[i[[[\ \&\u\\\\]]?]E]W]}]~]]^ ^Y^i^^^^^_(___e__`H``a3ahaaaaaabb"b(b)bTb`bbc cGcWckcccd:dJd^ddee%e9emeeeffHfQfRfffg)gQggggh!hBhmhthxhzh{hhhii iMiSiiiij7jVjWjrjjjjjk k(k)kdkjklll lYlqlrllllllmmm/mImJmzmmmmmn;nUnVnjnnnnnnno oo2oMoaouo{o|oooppfpppq&qdquqqqqr rJr[rirrrssHs{sstt;twtttu uuuDupuuuvv>v`vxvvvww@wMwrwwwxxx8xIxdxxxxxxxxyyoypyyyz>zzzzzzz{+{<{[{{{{{{{|||S|T||||}=}M}a}}}~~~Q~Z~[~~~ 2Klswyz(6\]3ef$*+[g ?} Tdx#ER-:jk Zr'Wx@4quwxA]&'Wy#dLkl'FG#X)=>!MNv*GUe|;e.AZWv> [i$X{&\Vp,9h?RiMnr1IJYNOAB XkOq/6:<=mWjEXq Dhlno Le"Z,P| /0cN|2Ias'u DMN#0U|/]^ .CDx$7LRS%^gh)6Wl_AhiQ,P|Ivw67w}F]^ !"S_/=T !Rz *E`y0op78… @AuêBĈļĽZōŎſP\Ɣ)9Mǃ^r{|ȭ+8]ɀɡɨɬɮɯ3stʗ +kˆˇ˶39:̀̌W͏$4H΃Ό΍ξ&VςϮϻ>cЈЏГЕЖнfjѩ #CDҕҢҨһ01y&';Uh~ԒԘԙE{՟FYr"Txע@_fjlm؆ؕصض>Dٕ=Cڒ 3K_rۃۉۊ۶"q܁ܕEfݰgwދޔޕ>^kߒ߱1w+CU[\%pC8f0xLcd1PQev ,\DTh+?"2Fx*34e Ikx8SZ^`aIk/;n W[]^1UVV\01fyz Xk ?r 2Tv1HOSUVo *+x<.45gs*hy "+,]2U\`bc>d67p|6t='8BHZno2`(Hd$89uv1\ef  P T V W u v      F ~      = >      2 M N [ u         R  7QGv7;23z!"_!EFv3IJ DJ] !d:?xLy()qc/5./Ief/0Z  ' : J Y h {      ! !!!'!(!N!Z!!" ""/"Y""""# #M####$*$W$$$$%%%p%%%&&U&e&y&&''$'8'b''''("(O((()%)5)I)))*)*x****+9+I+]+++,7,G,[,,--$-8-A-B-s---. .3.Y....//)/K/u///0070e0r000011.1Y1v111112252\2u2222222343J3\33344#4$4p444455a55566U666667L7x777788i899R999:7:h:i::::;;?;^;;;;<@>>;>P>m>t>x>z>{>>>>??B?C?T?u?v???@9@P@Q@@@A9AHAAAAAB.BCBIBBBBCCCWCCDCDSDwDxDDDEEE'E(EqEEEEEF F+FNFnFFGG$GBGnGGH:HHHHHHII/IFIGIwIIIIIIIJJ,JAJXJkJJJJJJJKKKK KGKSKKKLLYLjLxLLLM?MOMcMMMN&NdNuNNNNOOWOhOvOOOP#PqPPPPQQGQjQQQRR:RmRRSS*SdSSSST/TbTkTlTTTU+UKU}UUUV!VIVaVVVVW)WIWkWxWWWX X5XZX{XXXXYY)YLYmYYYYYYYZ'ZYZnZZZZ[[[8[>[N[n[o[[[[\ \ \X\\\\\]]D]b]]]]]^%^W^X^^^^^__!_'_p____``,`-`o`u`````aa:a;aLaeaaaaaabb'b=bCbDblbxbbc:cZcccddRdeddddeeMeeeffkf{ffffgg5gggggh'hQh}hhhi i4i_iiiij jEjhjojsjujvjjk,k9k?kwk}kkkll1lNlOlllmmm0mGmHmmmmnn"n#nLnRnonnnnnoo#o$oFoLo_osotoooooooppppBpNpppq qSqcqwqqqr(r9rGr^rrrss]smssssstt*tNtjttttuuu9uNuquuuuuuuuv8vvvww.wFwGwwwwwx!x8xexxxxxyy5y}yyyyzz)z*zDzzzzz{{{3{?{{{||!|/|F|o|}}}}C}}}}}}~~#~*~.~0~1~X~\~~~~~m<@r45\h=@p}$3h ,f*34e!"/hI[k)-/0CaIs+a+uBOjJ./pv$PQ @ 3h9c+MN 2U-._}~>Oc{8mM` :Z;V]acdDkl0~ 59;<m@-i^;}$8/K-n-l>DT|}BN{4ESj0>U^_BFHIx26 qaA't()t67)*YxyEq!"JV!Y/89j.Zg4;?ABYh ` ^<=gs2h{Kp -u…™¢£@`mÈç kįDEq}Ż4DXƌƯ ()ZnjǴHflrȽ7Qɇ?@Zpʄʖʫʿ L˖˪Q̪̾̚7͓̓ͧ>|΍Λβ%oϓϜϝ@hЎвп=\yрфцчѮѲ +,p6<ӉӹӺ>?ԎԨԩ/5ՃGxyք֡ h{׬  B؁د.BV٦ M`qڀډڊڻ7Yہێۿ8?CEF}܁Kpqݦ+,Uރބ3b߽߭)q)9M'Mm#%&oW$%qBCH (.|@F#$:Qc{ 76 Xh|3an  Vrs@ms $%r56FX~3U%:/EF~-@Vm}0cz)9M;LZq->Lc*LzDQd "MTXZ[9X^q "DgF&v^6V~IOb}~:U[kHVW#Ae   9 :         0 A ] t         6 < = p |    O _ s    ? O c  "e"3AX"0Go+pL\pyz;q'Qm;Tw 4Y|"$%q(>x56Rmn6K[abL]kXh|SHl   + L o   ! !"!)!-!//// On-Demand Scanning API - v1 /// /// A service to scan container images for vulnerabilities. /// /// For more information, see /// /// /// Create an instance of [OnDemandScanningApi] to access these resources: /// /// - [ProjectsResource] /// - [ProjectsLocationsResource] /// - [ProjectsLocationsOperationsResource] /// - [ProjectsLocationsScansResource] /// - [ProjectsLocationsScansVulnerabilitiesResource]_v} /6Oq=@ ̈,!.56BM^pdžCr/// See, edit, configure, and delete your Google Cloud data and see the email /// address for your Google Account.2%2AA>V邸+;/// A service to scan container images for vulnerabilities.CSTTi~sCCDو%WÊMʉ%ىlHH]kmRuvvRR[C(%C/// Starts asynchronous cancellation on a long-running operation. /// /// The server makes a best effort to cancel the operation, but success is not /// guaranteed. If the server doesn't support this method, it returns /// `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation /// or other methods to check whether the cancellation succeeded or whether /// the operation completed despite cancellation. On successful cancellation, /// the operation is not deleted; instead, it becomes an operation with an /// Operation.error value with a google.rpc.Status.code of `1`, corresponding /// to `Code.CANCELLED`. /// /// Request parameters: /// /// [name] - The name of the operation resource to be cancelled. /// Value must have pattern /// `^projects/\[^/\]+/locations/\[^/\]+/operations/\[^/\]+$`. /// /// [$fields] - Selector specifying which fields to include in a partial /// response. /// /// Completes with a [Empty]. /// /// Completes with a [commons.ApiRequestError] if the API endpoint returned an /// error. /// /// If the used [http.Client] completes with an error when making a REST call, /// this method will complete with the same error.ǕLL /// Deletes a long-running operation. /// /// This method indicates that the client is no longer interested in the /// operation result. It does not cancel the operation. If the server doesn't /// support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. /// /// Request parameters: /// /// [name] - The name of the operation resource to be deleted. /// Value must have pattern /// `^projects/\[^/\]+/locations/\[^/\]+/operations/\[^/\]+$`. /// /// [$fields] - Selector specifying which fields to include in a partial /// response. /// /// Completes with a [Empty]. /// /// Completes with a [commons.ApiRequestError] if the API endpoint returned an /// error. /// /// If the used [http.Client] completes with an error when making a REST call, /// this method will complete with the same error.ffryyccb/// Gets the latest state of a long-running operation. /// /// Clients can use this method to poll the operation result at intervals as /// recommended by the API service. /// /// Request parameters: /// /// [name] - The name of the operation resource. /// Value must have pattern /// `^projects/\[^/\]+/locations/\[^/\]+/operations/\[^/\]+$`. /// /// [$fields] - Selector specifying which fields to include in a partial /// response. /// /// Completes with a [Operation]. /// /// Completes with a [commons.ApiRequestError] if the API endpoint returned an /// error. /// /// If the used [http.Client] completes with an error when making a REST call, /// this method will complete with the same error.͡#22=WWd+ÅE/// Lists operations that match the specified filter in the request. /// /// If the server doesn't support this method, it returns `UNIMPLEMENTED`. /// /// Request parameters: /// /// [name] - The name of the operation's parent resource. /// Value must have pattern `^projects/\[^/\]+/locations/\[^/\]+$`. /// /// [filter] - The standard list filter. /// /// [pageSize] - The standard list page size. /// /// [pageToken] - The standard list page token. /// /// [returnPartialSuccess] - When set to `true`, operations that are reachable /// are returned as normal, and those that are unreachable are returned in the /// ListOperationsResponse.unreachable field. This can only be `true` when /// reading across collections. For example, when `parent` is set to /// `"projects/example/locations/-"`. This field is not supported by default /// and will result in an `UNIMPLEMENTED` error if set unless explicitly /// documented otherwise in service or product specific documentation. /// /// [$fields] - Selector specifying which fields to include in a partial /// response. /// /// Completes with a [ListOperationsResponse]. /// /// Completes with a [commons.ApiRequestError] if the API endpoint returned an /// error. /// /// If the used [http.Client] completes with an error when making a REST call, /// this method will complete with the same error.??KWWdqq~EE 5/// Waits until the specified long-running operation is done or reaches at /// most a specified timeout, returning the latest state. /// /// If the operation is already done, the latest state is immediately /// returned. If the timeout specified is greater than the default HTTP/RPC /// timeout, the HTTP/RPC timeout is used. If the server does not support this /// method, it returns `google.rpc.Code.UNIMPLEMENTED`. Note that this method /// is on a best-effort basis. It may return the latest state before the /// specified timeout (including immediately), meaning even an immediate /// response is no guarantee that the operation is done. /// /// Request parameters: /// /// [name] - The name of the operation resource to wait on. /// Value must have pattern /// `^projects/\[^/\]+/locations/\[^/\]+/operations/\[^/\]+$`. /// /// [timeout] - The maximum duration to wait before timing out. If left blank, /// the wait will be at most the time permitted by the underlying HTTP/RPC /// protocol. If RPC context deadline is also specified, the shorter one will /// be used. /// /// [$fields] - Selector specifying which fields to include in a partial /// response. /// /// Completes with a [Operation]. /// /// Completes with a [commons.ApiRequestError] if the API endpoint returned an /// error. /// /// If the used [http.Client] completes with an error when making a REST call, /// this method will complete with the same error.W/MNNc|q~//V|% ıޱ[/// Initiates an analysis of the provided packages. /// /// [request] - The metadata request object. /// /// Request parameters: /// /// [parent] - Required. The parent of the resource for which analysis is /// requested. Format: projects/\[project_name\]/locations/\[location\] /// Value must have pattern `^projects/\[^/\]+/locations/\[^/\]+$`. /// /// [$fields] - Selector specifying which fields to include in a partial /// response. /// /// Completes with a [Operation]. /// /// Completes with a [commons.ApiRequestError] if the API endpoint returned an /// error. /// /// If the used [http.Client] completes with an error when making a REST call, /// this method will complete with the same error.SSYJwxxJJe; %;Ҹ/// Lists vulnerabilities resulting from a successfully completed scan. /// /// Request parameters: /// /// [parent] - Required. The parent of the collection of Vulnerabilities being /// requested. Format: /// projects/\[project_name\]/locations/\[location\]/scans/\[scan_id\] /// Value must have pattern /// `^projects/\[^/\]+/locations/\[^/\]+/scans/\[^/\]+$`. /// /// [pageSize] - The number of vulnerabilities to retrieve. /// /// [pageToken] - The page token, resulting from a previous call to /// ListVulnerabilities. /// /// [$fields] - Selector specifying which fields to include in a partial /// response. /// /// Completes with a [ListVulnerabilitiesResponseV1]. /// /// Completes with a [commons.ApiRequestError] if the API endpoint returned an /// error. /// /// If the used [http.Client] completes with an error when making a REST call, /// this method will complete with the same error.WѾ b09::C0PT@l^sntǿ¿ƿտ׿@f@W@t@u@{@|@@@@@@@@@@@1ܽՁ$뀠/// Whether to include OSV data in the scan. /// /// For backwards compatibility reasons, this field can be neither removed nor /// renamed. /// /// Deprecated.5?5/// The packages to analyze.BkL/// The resource URI of the container image being scanned. /// /// Required.@@Ɓ-@99x/// AnalyzePackagesRequest is the request to analyze a list of packages and /// create Vulnerability Occurrences for it.IIII IIIIJJJIILJ'J<JEJFJFJO<J\J`LfJnJjJpJJJvJ}JqJwJJJJJJJKJKK"K#K)K*KFK5KcKMKaKHKNKfKjKkKqKK|KKKKKKKKKKKKKKLGKL8LULVL\L]J'J'AJ=FDMFЂ&/// One or more JWTs encoding a self-contained attestation. /// /// Each JWT encodes the payload that it verifies within the JWT itself. /// Verifier implementation SHOULD ignore the `serialized_payload` field when /// verifying these JWTs. If only JWTs are present on this /// AttestationOccurrence, then the `serialized_payload` SHOULD be left empty. /// Each JWT SHOULD encode a claim specific to the `resource_uri` of this /// Occurrence, but this is not validated by Grafeas metadata API /// implementations. The JWT itself is opaque to Grafeas.GGFGGZ/// The serialized payload that is verified by one or more `signatures`. /// /// Required.IHPIȁ%/// One or more signatures over `serialized_payload`. /// /// Verifier implementations should consider this attestation message verified /// if at least one `signature` verifies `serialized_payload`. See `Signature` /// in common.proto for more details on signature structure and verification.G\G\dGtGGGGGĀGLlLl%LB>B>UDm(/// Occurrence that represents a single "attestation". /// /// The authenticity of an attestation can be verified using the attached /// signature. If the verifier trusts the public key of the signer, then /// verifying the signature is sufficient to establish trust. In this /// circumstance, the authority to which this attestation is attached is /// primarily useful for lookup (how to find this attestation if you already /// know the authority and artifact to be verified) and intent (for which /// authority this attestation was intended to sign.PPPPQQQQPP;Q*Q:QCQDQDQMCQZQ^SQuQhQR,QwQ|Q}QQQQQQQRQQQQQQQQQR QQQRRRR.RIR<RzSRKRPRQR\RlR]R|RRRRRRRRRRRRRRRRRRRRSQ*Q*Q;OiN jOi@/// The binary package. /// /// This is significant when the source is different than the binary itself. /// Historically if they've differed, we've stored the name of the source and /// its version in the package/version fields, but we should also store the /// binary package info, as that's what's actually installed.PO{kPفA/// The source package. /// /// Similar to the above, this is significant when the source is different /// than the binary itself. Since the top-level package/version fields are /// based on an if/else, we need a separate field for both binary and source /// if we want to know definitively where the data is coming from.SSS8MMMVV"V)V)V.V=V=VBVZVZV_VwVwV|VVVVVVVV[VVYhVVVVVVVVVVWW!WWWWW#W(W)W4WIW5WuW^WsWYW_WxW|W}WWWWWWWWWWWXXQWWWWWWXXXXXX!X%X&X)XCX*X.X/X7X;X<XSXuXaXwXXX}XXxX~XXXXXXXYIXY:YWYXY^Y_VVVTTTTT*T쀔/// /// /// The values for Object must be JSON objects. It can consist of `num`, /// `String`, `bool` and `null` as well as `Map` and `List` values.UUUŀ/// /// /// The values for Object must be JSON objects. It can consist of `num`, /// `String`, `bool` and `null` as well as `Map` and `List` values.UU3UYnYnYSSISaaaaaaaaaaaaaab b baab+b:bCbDbDbMbZb^fNb~bhbccbbbbbbbbbbcUcbc bbc"c&c'c*cDc+c/c0c8c<c=ceccscdVccccccccccdHdccccddddd7dd"d#d+d/d0dXdudfde1dwd|d}ddddddde#dddddddddedddee e e3eKeAeyeeMeReSe^eke_e{eeeeeeeeeeeeeeeeeeeeeff f7f#f5ff$f:f>f?fEb+b+%b;\[%\/// In-Toto Slsa Provenance V1 represents a slsa provenance meeting the slsa /// spec, wrapped in an in-toto statement. /// /// This allows for direct jsonification of a to-spec in-toto slsa statement /// with a to-spec slsa provenance.]k\Ѐ]k~/// See InTotoStatement for the replacement. /// /// In-toto Provenance representation as defined in spec. /// /// Deprecated.^|] ^|/// In-toto Statement representation as defined in spec. /// /// The intoto_statement can contain any type of provenance. The serialized /// payload of the statement can be stored and signed in the Occurrence's /// envelope.^^F^(/// The actual provenance for the build.aw^ۂawz/// Serialized JSON representation of the provenance, used in generating the /// build signature in the corresponding build note. /// /// After verifying the signature, `provenance_bytes` can be unmarshalled and /// compared to the provenance to confirm that it is unchanged. A /// base64-encoded string representation of the provenance bytes is used for /// the signature in order to interoperate with openssl which expects this /// format for signature verification. The serialized form is captured both to /// avoid ambiguity in how the provenance is marshalled to json as well to /// prevent incompatibilities with future changes.fTfT#fx[i[i["/// Details of a build occurrence.nXng nnnnnsnnnnnnnn nnnnnn nnn nooooo oo"o"o'o6o6o;oQoQoVoeoeojnXnX"o~ooooooouooopooooooooopooopp p pp%p'p*pcp+pbp|pnpppp~pppppppppppppppppppppqqqrqqqqqqqqqqqqqqqqqqqqrgqrXrurvr|r}rrrrrrrrrrrrrrrrrrrrrrrrsss rssssss)s's7s0s5s+s1s:s>s?sEsWsPsjs^shsYs_smsqsrsxsssssssssssssstssssssttttttOt&t9t!t'tRtVtWtZttt[t_t`thtltmtttttttttttttttttttttuuo~o~o ii"i߀/// Special options applied to this build. /// /// This is a catch-all field where build providers can enter any desired /// additional details.jFidjFF/// Version string of the builder at the time this build was executed.jjY>j/// Output of the build.jjCj$/// Commands requested by the build.kjBk(/// Time at which the build was created.lk+l/// E-mail address of the user who initiated this build. /// /// Note that this was the user's e-mail address at the time the build was /// initiated; this address may not represent the same end-user for all time.lhl"Mlh6/// Time at which execution of the build was finished.lltKl5/// Unique identifier of the build. /// /// Required.m lOm 8/// URI where any logs for this provenance were written.m>m/m>/// ID of the project.mmLHm-/// Details of the Source input to the build.mmNm5/// Time at which execution of the build was started.nJmgnJN/// Trigger identifier if the build was triggered automatically; empty if not.uuu9h{h{i/// Provenance of a build. /// /// Contains all information needed to verify the full details about the build /// from source to completion.||| | |%|3|3 |8|@|@|E||J|V|l|u|v|v|N||~W|||}Y||||||||||}K}}}|}}}}} }:}!}%}&}.}2}3}[}o}i}~}q}v}w}}}}}}}~}}}}}}}}}}}}}}}}~~*~ ~@~1~>~,~2~C~G~H~N|V|V|m{{]H{+/// An alias, which may be a branch or tag.{{({/// The ID of the repo.{{,{/// A revision ID.~]~]~zzބ{B]/// A CloudRepoSourceContext denotes a particular revision in a Google Cloud /// Source Repo. h-AJKKTEae~o p b, *!/347Q8<=EIJr--SB R5.RhT7/// The OS and config version the benchmark was run on.U]]~/// An indication that the compliance checks in the associated ComplianceNote /// were not satisfied for particular resources or a specified reason. ;  C!%7/c9>?JUKemnv$  &56>cUaPVfjknost|~ y~b/// If doing something security critical, make sure to verify the signatures /// in this metadata.kk }/// Prefer to use a regular Occurrence, and populate the Envelope at the top /// level of the Occurrence. /// /// Deprecated. ..3KKPYY ^iin )G%9&IZ[czu{, "&'+:<?O,c.34?U@eklt -+045;XFv_tZ`y}~gXuv|}!6,d8=>IVJfpqy3 r_$ru/// Indicates any errors encountered during analysis of a resource. /// /// There could be 0 or more of these errors.[)@[/// The status of discovery for the resource. /// Possible string values are: /// - "ANALYSIS_STATUS_UNSPECIFIED" : Unknown. /// - "PENDING" : Resource is known but no action has been taken yet. /// - "SCANNING" : Resource is being analyzed. /// - "FINISHED_SUCCESS" : Analysis has finished successfully. /// - "COMPLETE" : Analysis has completed. /// - "FINISHED_FAILED" : Analysis has finished unsuccessfully, the analysis /// itself is in a bad state. /// - "FINISHED_UNSUPPORTED" : The resource is known not to be supported.1n1/// When an error is encountered this will contain a LocalizedMessage under /// details to show to the user. /// /// The LocalizedMessage is output only and populated by the API.Ia/// The time occurrences related to this discovery occurrence were archived. /// /// Output only.΁+/// Whether the resource is continuously analyzed. /// Possible string values are: /// - "CONTINUOUS_ANALYSIS_UNSPECIFIED" : Unknown. /// - "ACTIVE" : The resource is continuously analyzed. /// - "INACTIVE" : The resource is ignored for continuous analysis.8=8*/// The CPE of the resource being scanned.@Y@/// Files that make up the resource described by the occurrence.H,/// The last time this resource was scanned.0`05/// The last time vulnerability scan results changed.P>%/// The status of an SBOM generation. GL/// Provides information about the analysis status of a discovered resource.DLNN S\\annsDD<0 2(4VI:G5;LPQUdfiy 5(5JddxQQU DJJހ/// MUST match /// https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. /// /// An authenticated message of arbitrary type.  !#C6)4$*9=>BQSVf lP0/// Collection of file hashes. /// /// Required.z΂]/// Container message for hashes of byte content of files, used in source /// messages to verify integrity of source input to the build. 1.6*f8=>IXJhtu}>[[/// For jars that are contained inside .war files, this filepath can indicate /// the path to war file combined with the path to jar file.ugu!ooU8/// Indicates the location at which a package was found./66;MMRee jww|qDJ%M<K7=PTUXrY]^fjk3$1%6:;AH+/// An alias, which may be a branch or tag.΀/// The full project name within the host. /// /// Projects may be nested, so "project/subproject" is a valid project name. /// The "repo name" is the hostURI/project.@)/// The URI of a running Gerrit instance. 5 /// A revision (commit) ID.PPrt00i2/// A SourceContext referring to a Gerrit project.  (( -;;@fUgpqqz/d"7-M>K9?PTU[UUhS?B\CGHPTUl p7ì<įį/// /// /// The values for Object must be JSON objects. It can consist of `num`, /// `String`, `bool` and `null` as well as `Map` and `List` values.ŁĿŁ/// /// /// The values for Object must be JSON objects. It can consist of `num`, /// `String`, `bool` and `null` as well as `Map` and `List` values.~~-ȢAAl{3/// Identifies the event that kicked off the build.ˉ˳˺˺˿  %ˉˉ<foppyŎ̊Ή̣̪̼̥̫̔̾ ,F3D.4IMNTk_͛@mrs~͍͝2! B\Ptcr^dw{|΀<?BXMՇZ_`kylՉՔՕ՝մկյ !#D7)5$*:>?CRTWgֿԛԛTԫ2~2[/// This contains the base image URL for the derived image occurrence. /// /// Output only.Fn/// The number of layers by which this image differs from the associated image /// basis. /// /// Output only.#Z#;/// The fingerprint of the derived image. /// /// Required.3/// This contains layer-specific metadata, if populated it has length /// "distance" and is ordered with \[distance\] being the layer immediately /// following the base image and \[1\] being the final layer.vOѯ/// Details of the derived image portion of the DockerImage relationship. /// /// This image would be produced from a Dockerfile with FROM . 077<OOTcc hvv { hیۜۥۦۦۯzۼޑ܍  I7G28LPQTnUYZbfg܏ܦܝܨܼܮܺܩܯܿ %Q',-8C9S[\dݾ݈{݆v|݋ݏݐݓݭݔݘݙݡݥݦ ރu?4=/5BFGJdKOPX\]ޅیی۝ئ؈+ئ /// requiredظ5 /// The collection of artifacts that influenced the build including sources, /// dependencies, build tools, base images, and so on. /// /// This is considered to be incomplete unless metadata.completeness.materials /// is true. Unset or null is equivalent to empty./// Identifies the configuration used for the build. /// /// When combined with materials, this SHOULD fully describe the build, such /// that re-running this recipe results in bit-for-bit identical output (if /// the build is reproducible). requiredޗޗZ޻mms  //4GG Lm^t}~~P #~H:F5;KOPSmTXYaef&^^auv^/// InToto spec defined at /// https://github.com/in-toto/attestation/tree/main/spec#statementÁU%Sbii nzz SS&*0:4KAI<BNRSYqdxsy`R #$'A(,-59:b~p7) 9\G>^cdop0 @UNWvi]gX^lpqu &';[E[//// Always `https://in-toto.io/Statement/v0.1`.fW:/// `https://slsa.dev/provenance/v0.1` for SlsaProvenance.,G3G66'ZC/// Spec defined at /// https://github.com/in-toto/attestation/tree/main/spec#statement The /// serialized InTotoStatement will be stored as Envelope.payload. /// /// Envelope.payloadType is always "application/vnd.in-toto+json".  8(59JC]Q[LR`dek}v𭀭[qi/// Indicates a language package available between this package and the /// customer's resource artifact.|    ||n F2(4VI:G5;LPQUdfiy .",#156<NGaU_PVdhiozIQI./// The base images the layer is found within. X /// The layer chain ID (sha256 hash) of the layer in the container image. /// /// https://github.com/opencontainers/image-spec/blob/main/config.md#layer-chainidʀ/// The layer build command that was used to build the layer. /// /// This may not be found in all layers depending on how the container image /// is built.(X(B/// The diff ID (sha256 hash) of the layer in the container image.r3Dr2/// The index of the layer in the container image.ہw񷆝3/// Details about the layer a package was found in. !a7MVWW`<mq({ v 77NC&/// The standard List next-page token.-mJ/// A list of operations that matches the specified filter in the request..€/// Unordered list. /// /// Unreachable resources. Populated when the request sets /// `ListOperationsRequest.return_partial_success` and reads across /// collections. For example, when attempting to list all resources across all /// supported locations...1R7/// The response message for Operations.ListOperations. ""'F9V_``i%vz99yWssq/// A page token that can be used in a subsequent call to ListVulnerabilities /// to continue retrieving results.e@/// The list of Vulnerability Occurrences resulting from a scan.cc*d/// ListVulnerabilitiesResponse contains a single page of vulnerabilities /// resulting from a scan.qy{{   qq19 !$()/A:lCHIT^Unuv~O:sY/// The CPE URI in [CPE format](https://cpe.mitre.org/specification/) /// /// Deprecated. _ K/// The path from which we gathered that this package/version is installed.eVe?/// The version installed at this location. /// /// Deprecated.@-/// An occurrence of a particular package installation found within a system's /// filesystem. /// /// E.g., glibc was found in `/var/lib/dpkg/status`.;EGG LSS X^^ ciin;;9x/b  #'(.<9KCI>DNRSYxx  3&3hhт P X _ _ d y y ~          P P      O   &  A - ? ( . D H I O k Z  r  m s                     ,-5]L[GM`dehimnvz{     M ./// The timestamp of when the build completed.   ۀ/// Identifies the particular build invocation, which can be useful for /// finding associated logs or other ad-hoc analysis. /// /// The value SHOULD be globally unique, per in-toto Provenance spec. - J -,/// The timestamp of when the build started.  @w X/// Indicates that the builder claims certain fields in this message to be /// complete. ?  ?s/// If true, the builder claims that running the recipe on materials will /// produce bit-for-bit identical output. v v "/// Other properties of the build.      + +  0 > >  C N N  S ] ]  b l l  q                     !! ! !!*!4!=!>!>!G!T!X->!m!b!"'!o!t!u!!!!!!!"!!!!!!!!!"!!!!""")"<"7"e"">"C"D"O"W"P"g"v"w"""""""""""""""""""""#,########.#B#C#K##q#b#o#]#c#t#x#y#|##}#################$#$6$$ $$$$($$8$L$M$U$${$l$y$g$m$~$$$$$$$$$$$$$%%$$$$$$%%%%#%~%H%:%F%5%;%K%O%P%S%m%T%X%Y%a%e%f%%%%&q%%%%%%%%%&&c&-&&+&&&0&4&5&8&R&9&=&>&F&J&K&s&&&'0&&&&&&&&&&'"&&&&&&&&&'&&&'' ' '2'E'@'n''G'L'M'X'`'Y'p'''''''''''''''''''''('((((( (((((.(*(>(5(<(0(6(A(E(F(L(_(W(s(f(q(a(g(v(z({(((()A(((((((((()3((((()))))") ) )))))C)\)Q)s)c)q)^)d)v)z){))))))))))))))**))))))****'**P*>*N*9*?*S*W*X*[*u*\*`*a*i*m*n****+U**********+G++++++++++6++!+"+*+.+/+W+o+e++v++q+w+++++++,S++++++++++,E,,, +,,,,,,4,,, ,(,,,-,U,p,c,-0,r,w,x,,,,,,,-",,,,,,,,,-,,,-- - -2!*!*!5Q,/// Describes an attestation of an artifact.:!/// Describes a verifiable build.w$]w:/// Describes a compliance violation on a linked resource.\>/// The time this occurrence was created. /// /// Output only.9\99/// Describes the deployment of an artifact on a runtime.HN-/// Describes when a resource was discovered.d7/// Describes an attestation of an artifact using dsse.?C?./// https://github.com/secure-systems-lab/dsseLgN/// Describes how this resource derives from the basis in the associated note./// This explicitly denotes which of the occurrence details are specified. /// /// This field can be used as a filter in list requests. /// /// Output only. /// Possible string values are: /// - "NOTE_KIND_UNSPECIFIED" : Default value. This value is unused. /// - "VULNERABILITY" : The note and occurrence represent a package /// vulnerability. /// - "BUILD" : The note and occurrence assert build provenance. /// - "IMAGE" : This represents an image basis relationship. /// - "PACKAGE" : This represents a package installed via a package manager. /// - "DEPLOYMENT" : The note and occurrence track deployment events. /// - "DISCOVERY" : The note and occurrence track the initial discovery status /// of a resource. /// - "ATTESTATION" : This represents a logical "role" that can attest to /// artifacts. /// - "UPGRADE" : This represents an available package upgrade. /// - "COMPLIANCE" : This represents a Compliance Note /// - "DSSE_ATTESTATION" : This represents a DSSE attestation Note /// - "VULNERABILITY_ASSESSMENT" : This represents a Vulnerability Assessment. /// - "SBOM_REFERENCE" : This represents an SBOM Reference. /// - "SECRET" : This represents a secret.""{/// The name of the occurrence in the form of /// `projects/[PROJECT_ID]/occurrences/[OCCURRENCE_ID]`. /// /// Output only.+/// The analysis note associated with this occurrence, in the form of /// `projects/[PROVIDER_ID]/notes/[NOTE_ID]`. /// /// This field can be used as a filter in list requests. /// /// Required. Immutable.x`xC/// Describes the installation of a package on the linked resource.]B/// A description of actions that can be taken to remedy the note./// A URI that represents the resource for which the occurrence applies. /// /// For example, `https://gcr.io/project/image@sha256:123abc` for a Docker /// image. /// /// Required. Immutable.]4/// Describes a specific SBOM reference occurrences.]12]/// Describes a secret.haC/// The time this occurrence was last updated. /// /// Output only.&_&B/// Describes an available package upgrade on the linked resource.u2Pu'/// Describes a security vulnerability.-D-D-h33F/// An instance of an analysis type that has been found on a resource.:k:t:v:v :{:: ::: ::: ::: ::k:kL::::::o::=::;:;::; ; ;;;";;K;;$;);*;5;=;6;M;S;T;\;;};s;{;n;t;;;;;;;;;;;;;;<<%<)<*<2<6<7T7TQTETOT@TFTTTXTYT_K"K"HK.>>@>$/// The architecture of the package.?0>j?0:/// A bundle containing the binary and source information.?f?E.?f/// DEPRECATED@H?x@H/// The cpe_uri in [cpe format](https://cpe.mitre.org/specification/) in which /// the vulnerability may manifest. /// /// Examples include distro or storage location for vulnerable jar.Ap@S,Ap/// The dependency chain between this package and the user's artifact. /// /// List in order from the customer's package under review first, to the /// current package last. Inclusive of the original package and the current /// package.AAVA./// The path to the jar file / go binary file.BA߀B/// HashDigest stores the SHA512 hash digest of the jar file if the package is /// of type Maven. /// /// This field will be unset for non Maven packages.BBBDmBDm/// The list of licenses found that are related to a given package. /// /// Note that licenses may also be stored on the BinarySourceInfo. If there is /// no BinarySourceInfo (because there's no concept of source vs binary), then /// it will be stored here, while if there are BinarySourceInfos, it will be /// stored there, as one source can have multiple binaries with different /// licenses.DDz;D"/// The maintainer of the package.E#DkE#W/// The OS affected by a vulnerability Used to generate the cpe_uri for OS /// packagesEE*_EF/// The version of the OS Used to generate the cpe_uri for OS packagesEEIE2/// The package being analysed for vulnerabilitiesHE܂H/// The type of package: os, maven, go, etc. /// Possible string values are: /// - "PACKAGE_TYPE_UNSPECIFIED" /// - "OS" : Operating System /// - "MAVEN" : Java packages from Maven. /// - "GO" : Go third-party packages. /// - "GO_STDLIB" : Go toolchain + standard library packages. /// - "PYPI" : Python packages. /// - "NPM" : NPM packages. /// - "NUGET" : Nuget (C#/.NET) packages. /// - "RUBYGEMS" : Ruby packges (from RubyGems package manager). /// - "RUST" : Rust packages from Cargo (GitHub ecosystem is `RUST`). /// - "COMPOSER" : PHP packages from Composer package manager. /// - "SWIFT" : Swift packages from Swift Package Manager (SwiftPM).HHZH5/// CVEs that this package is no longer vulnerable toI H.I /// DEPRECATEDI>I1I>IIIDI-/// The version of the package being analysedTnTndT>{>{Y>a=aI aPaPaUaiaianaaaaaaaaaaaaaaaaabbbbb+b+b0a=a=bFbRb[b\b\bebrbvfbbbbbbbbbbbbbbbbbbbbbbcccFccccc&c8c'cHcOcPcXcccoccjcpccccccccccccccdcdccdd d dd*dd,dPdCd2dAd-d3dFdJdKdOd^d`dcddsdeeeee&ee>e-e<e(e.eAeEeFeJe`eUewegeuebeheze~eeeeeeeeeeeeeeef feeeeeef ffffyfCf2fAf-f3fFfJfKfNfhfOfSfTf\f`faffffffffffffbFbFbS ZZpZn/// The [CPE URI](https://cpe.mitre.org/specification/) this vulnerability was /// found in. /// /// Required.[][e[]B/// The package this vulnerability was found in. /// /// Required.[[q[v/// The version of the package that is installed on the resource affected by /// this vulnerability. /// /// Required.]\ ]݁/// The distro or language system assigned severity for this vulnerability /// when that is available and note provider assigned severity when it is not /// available. /// /// Output only. /// Possible string values are: /// - "SEVERITY_UNSPECIFIED" : Unknown. /// - "MINIMAL" : Minimal severity. /// - "LOW" : Low severity. /// - "MEDIUM" : Medium severity. /// - "HIGH" : High severity. /// - "CRITICAL" : Critical severity.^I]b^I1/// The location at which this package was found.^^Zc^E/// Whether a fix is available for this package. /// /// Output only._^€_/// The [CPE URI](https://cpe.mitre.org/specification/) this vulnerability was /// fixed in. /// /// It is possible for this to be different from the affected_cpe_uri.`_`{/// The package this vulnerability was fixed in. /// /// It is possible for this to be different from the affected_package.``/`߀/// The version of the package this vulnerability was fixed in. /// /// Setting this to VersionKind.MAXIMUM means no fix is yet available. /// /// Required.a-`Ha--/// The type of package (e.g. OS, MAVEN, GO).ffփfYY֐Z_/// A detail for a distro and package this vulnerability occurrence was found in /// and its associated fix (if one is available).ovoooooo ooo ooo ooo oooopp povovpp(p1p2p2p;pHpLspbpVpzpipxpdpjp}pppppppppppppppppqoppppppppqqqaq+qq)qq q.q2q3q6qPq7q;q<qDqHqIqqqqqqqqqqqqqqqqqqrEqr6rSrTrZr[rjrfrzrqrxrlrrr}rrrrrrrrrrrrrrrrssyrrrrrrss s ssks5s)s3s$s*s8s<s=s@sZsAsEsFsNsRsSs{pprp)l@jށnl@@/// The CPU architecture for which packages in this distribution channel were /// built. /// /// Architecture will be blank for language packages. /// /// Output only. /// Possible string values are: /// - "ARCHITECTURE_UNSPECIFIED" : Unknown architecture. /// - "X86" : X86 architecture. /// - "X64" : X64 architecture.m?lQm?/// The cpe_uri in [CPE format](https://cpe.mitre.org/specification/) denoting /// the package manager version distributing a package. /// /// The cpe_uri will be blank for language packages. /// /// Output only.mmJVmC/// Licenses that have been declared by the authors of the package.nm{nY/// All of the places within the filesystem versions of this package have been /// found.n~n%]n~E/// The name of the installed package. /// /// Required. Output only.onoy/// The type of package; whether native or non native (e.g., ruby gems, /// node.js packages, etc.). /// /// Output only.ojo&Koj4/// The version of the package. /// /// Output only.ss sjvjv"jK/// Details on how a particular software package was installed on a system.wIwWwYwY w^whwh wmwsws wxwIwI9wwwwww0wwxwwwwwwwwwwwwwwwwxxxx-x.x4x5xDx@xTxKxRxFxLxWx[x\xbxtxmxx{xxvx|xxxxwwwwudw7/// The licenses associated with this package. /// /// Note that this has to go on the PackageVersion level, because we can have /// cases with images with the same source having different licences. E.g. in /// Alpine, musl and musl-utils both have the same origin musl, but have /// different sets of licenses.w(ww(w=w0w=xxxuuuzzzzzzzzzz zzzE{{{"{#{#{,@{9{=}{Z{G{\{{z{b{x{]{c{}{{{{{{|-{||;|<|B|C|P|N|^|W|\|R|X|a|e|f|l|~|w||||||||||||||||||||||}|}{{{zezF2zezz|zzz+z}}}8z*z*z0  "G7BKLLU9bfwp~y&(23;eRcMShlmpquv~77CaJ/// Contains a comprehensive human-readable discussion of the remediation.遧z/// The type of remediation that can be applied. /// Possible string values are: /// - "REMEDIATION_TYPE_UNSPECIFIED" : No remediation type specified. /// - "MITIGATION" : A MITIGATION is available. /// - "NO_FIX_PLANNED" : No fix is planned. /// - "NONE_AVAILABLE" : Not available. /// - "VENDOR_FIX" : A vendor fix is available. /// - "WORKAROUND" : A workaround is available.R5/// Contains the URL where to obtain the remediation.9sM/// Specifies details on how to handle (and presumably, fix) a vulnerability.'.&*0A4rCHITdUt   !'2y5Qy2/// A combination of a project ID and a repo name.E2/// A server-assigned, globally unique identifier.66Z*)/// A unique identifier for a Cloud Repo.   C >?Gj^hY_mqruvz{w  i3*1%+6:;>X?CDLPQy1h/// CISA maintains the authoritative source of vulnerabilities that have been /// exploited in the wild.̀/// The Exploit Prediction Scoring System (EPSS) estimates the likelihood /// (probability) that a software vulnerability will be exploited in the wild."" (  ;Z*#U,12=G>Whiq  $&)9 !)M@K;APTUXrY]^fjk낶XEXc) 006Sjll qzzSSKE 56>aU_PVdhilmqrz~,.1AB%c%=/// The actual payload that contains the SBOM reference data.1/// The kind of payload that SbomReferenceIntotoPayload takes. /// /// Since it's in the intoto format, this value is expected to be /// 'application/vnd.in-toto+json'.DOD$/// The signatures over the payload. M/// The occurrence representing an SBOM reference as applied to a specific /// resource. /// /// The occurrence follows the DSSE specification. See /// https://github.com/secure-systems-lab/dsse/blob/master/envelope.md for more /// details.!;BB GSSXggl !!qPD*6+Fbck}  *#,K>2<-3AEFJY[^nqWE//// Identifier for the schema of the Statement.""\/// Additional parameters of the Predicate. /// /// Includes the actual data about the SBOM.n0Kn./// URI identifying the type of the Predicate.z/// Set of software artifacts that the attestation applies to. /// /// Each element represents a single software artifact.  U/NN8/// The actual payload that contains the SBOM Reference data. /// /// The payload follows the intoto statement specification. See /// https://github.com/in-toto/attestation/blob/main/spec/v1.0/statement.md for /// more details.n|~~nn$#%&.VET@FY]^a{bfgost]J]$/// The secret is found from a file.T /// The location of the secret.   =(122;<HL[ZVjah\bmqrxQB_`fgzr|}<-JKQRE)  %/// Type of secret. /// /// Required. /// Possible string values are: /// - "SECRET_KIND_UNSPECIFIED" : Unspecified /// - "SECRET_KIND_UNKNOWN" : The secret kind is unknown. /// - "SECRET_KIND_GCP_SERVICE_ACCOUNT_KEY" : A Google Cloud service account /// key per: /// https://cloud.google.com/iam/docs/creating-managing-service-account-keys /// - "SECRET_KIND_GCP_API_KEY" : A Google Cloud API key per: /// https://cloud.google.com/docs/authentication/api-keys /// - "SECRET_KIND_GCP_OAUTH2_CLIENT_CREDENTIALS" : A Google Cloud OAuth2 /// client credentials per: /// https://developers.google.com/identity/protocols/oauth2 /// - "SECRET_KIND_GCP_OAUTH2_ACCESS_TOKEN" : A Google Cloud OAuth2 access /// token per: https://cloud.google.com/docs/authentication/token-types#access /// - "SECRET_KIND_ANTHROPIC_ADMIN_API_KEY" : An Anthropic Admin API key. /// - "SECRET_KIND_ANTHROPIC_API_KEY" : An Anthropic API key. /// - "SECRET_KIND_AZURE_ACCESS_TOKEN" : An Azure access token. /// - "SECRET_KIND_AZURE_IDENTITY_TOKEN" : An Azure Identity Platform ID /// token. /// - "SECRET_KIND_DOCKER_HUB_PERSONAL_ACCESS_TOKEN" : A Docker Hub personal /// access token. /// - "SECRET_KIND_GITHUB_APP_REFRESH_TOKEN" : A GitHub App refresh token. /// - "SECRET_KIND_GITHUB_APP_SERVER_TO_SERVER_TOKEN" : A GitHub App /// server-to-server token. /// - "SECRET_KIND_GITHUB_APP_USER_TO_SERVER_TOKEN" : A GitHub App /// user-to-server token. /// - "SECRET_KIND_GITHUB_CLASSIC_PERSONAL_ACCESS_TOKEN" : A GitHub personal /// access token (classic). /// - "SECRET_KIND_GITHUB_FINE_GRAINED_PERSONAL_ACCESS_TOKEN" : A GitHub /// fine-grained personal access token. /// - "SECRET_KIND_GITHUB_OAUTH_TOKEN" : A GitHub OAuth token. /// - "SECRET_KIND_HUGGINGFACE_API_KEY" : A Hugging Face API key. /// - "SECRET_KIND_OPENAI_API_KEY" : An OpenAI API key. /// - "SECRET_KIND_PERPLEXITY_API_KEY" : A Perplexity API key. /// - "SECRET_KIND_STRIPE_SECRET_KEY" : A Stripe secret key. /// - "SECRET_KIND_STRIPE_RESTRICTED_KEY" : A Stripe restricted key. /// - "SECRET_KIND_STRIPE_WEBHOOK_SECRET" : A Stripe webhook secret.qhq=/// Locations where the secret is detected. /// /// Optional.S+/// Status of the secret. /// /// Optional.aa<< s0/// The occurrence provides details of a secret. $09::COPT5m^tou5)e7<=HWIgwx  #'(,$$1%M%./// The timestamp of when the build completed.9/// Identifies the particular build invocation, which can be useful for /// finding associated logs or other ad-hoc analysis. /// /// The value SHOULD be globally unique, per in-toto Provenance spec.h,Jh,/// The timestamp of when the build started.{{X/// Indicates that the builder claims certain fields in this message to be /// complete.~~s/// If true, the builder claims that running the recipe on materials will /// produce bit-for-bit identical output.;;_"/// Other properties of the build.  #-- 2K?MVWW`zmqŸ{* ,C:EfYKWFL\`aetvy+#W-23>I?Yefn‘"#+ƒMBK=CPTUXrY]^fjk“??bNw[#w /// required2 /// The collection of artifacts that influenced the build including sources, /// dependencies, build tools, base images, and so on. /// /// This is considered to be incomplete unless metadata.completeness.materials /// is true. Unset or null is equivalent to empty.ԁ/// Identifies the configuration used for the build. /// /// When combined with materials, this SHOULD fully describe the build, such /// that re-running this recipe results in bit-for-bit identical output (if /// the build is reproducible). required¥¥BBBH  116  :GW`aajCw{%ŔŅPŖśŜŧŹŨB  1%)*Rj`Ƙlqr}Ɗ~ƚƤƥƭ ƿGGX ++Oĵ/// Keep in sync with schema at /// https://github.com/slsa-framework/slsa/blob/main/docs/provenance/schema/v1/provenance.proto /// Builder renamed to ProvenanceBuilder because of Java conflicts.BW^^cttyʈʈ ʍʚʚʟʯʯʴ BBϙ)Xˢ+01<J=o_mZ`rvwz˔{ˀˈˌˍˤ˻˲˽̶ FGǪrfpaguyz}̗~̸̂̃̋̏̐͟,-5͑[LYGM^bcf̀gkltxy͡͸ͯͺͻΙΊΧΨήίκϋ#}G:E5;JNORlSWX`deύۄ*h*/// /// /// The values for Object must be JSON objects. It can consist of `num`, /// `String`, `bool` and `null` as well as `Map` and `List` values.F9F~S2~ɷɉ8ɷ@5 45ϟϟ}N?/// See full explanation of fields at slsa.dev/provenance/v0.2.{ցֈֈ֍֥֥֪ {{u `چ:(<fYBW=C\`aetvy׉@(pSnNTswx~ؐ؉ػ:ؘؒؗأحؤؽ,<TJbٞwhuciz~قٜكهؤِٕٟٝ١٤}ٴnӥҁ6ӥ/// If provided, some of the source code used for the build may be found in /// these locations, in the case where the source repository had multiple /// remotes or submodules. /// /// This list will not include the context specified in the context field.$Ӽ$V/// If provided, the input binary artifacts for the build came from this /// location.ԟAeԟL/// If provided, the source code used for the build came from this location.lԫl/// Hash(es) of the build source, which can be used to verify that the /// original source integrity was maintained in the build. /// /// The keys to this map are file paths used as build source and the values /// contain the hash values for those files. If the build source came in a /// single package such as a gzipped tarfile (.tar.gz), the FileHash will be /// for the single path to that file.ڌڌڰ,,vC/// Source describes the location of the source used for the build.ކޓޕޕޚޥޥ ު޲޲޷޼޼ ކކD~ ?%1&AWX`߻߅w߃rx߈ߌߍߐߪߑߕߖߞߢߣ  'I>G9?LPQTnUYZbfgE7  & G[U]ncl^dquvyz~΃&eneJ/// A SourceContext referring to a revision in a Google Cloud Source Repo.ݽsPݽ2/// A SourceContext referring to a Gerrit project.&a&I/// A SourceContext referring to any third party Git repo (e.g., GitHub).{.S{&/// Labels with user defined metadata.*FF/// A SourceContext is a reference to a tree of files. /// /// A SourceContext together with a path point to a unique revision of a single /// file or directory.&7>>CUU Zggl&&rn ,-5]L[GM`dehimnvz{"$+,4]K[FL`dehimnvz{tf0.378;U<@AIMNv꜂罀襀/// Metadata about the upgrade for available for the specific operating system /// for the resource_url. /// /// This allows efficient filtering, as well as making it easier to use the /// occurrence.dI/// Required for non-Windows OS. /// /// The package this Upgrade is for.g/// Required for non-Windows OS. /// /// The version of the package in a machine + human readable form.yV/// Required for Windows OS. /// /// Represents the metadata about the Windows update.툁~CC私]/// An Upgrade Occurrence represents that a specific resource_url could install /// a specific upgrade. /// /// This presence is supplied via local sources (i.e. it is present in the /// mirror and the running system has noticed its availability). For Windows, /// both distribution and windows_update contain information for the Windows /// update.  11 6DDIZZ_qq v倷 .!$()-<>AaB`opvwE7  & G]Uqdo_etxyXIfgmnyJ;XY_`pkwrx=*/// Holds the MITRE standard Common Vulnerabilities and Exposures (CVE) /// tracking number for the vulnerability. /// /// Deprecated: Use vulnerability_id instead to denote CVEs.'`/// Contains information about the impact of this vulnerability, this will /// change with time.&񰀃&b/// Justification provides the justification when the state of the assessment /// if NOT_AFFECTED.8/// The VulnerabilityAssessment note from which this VexAssessment was /// generated. /// /// This will be of the form: `projects/[PROJECT_ID]/notes/[NOTE_ID]`.qqZ/// Holds a list of references associated with this vulnerability item and /// assessment.tM/// Specifies details on how to handle (and presumably, fix) a vulnerability.>I>"/// Provides the state of this Vulnerability assessment. /// Possible string values are: /// - "STATE_UNSPECIFIED" : No state is specified. /// - "AFFECTED" : This product is known to be affected by this vulnerability. /// - "NOT_AFFECTED" : This product is known to be not affected by this /// vulnerability. /// - "FIXED" : This product contains a fix for this vulnerability. /// - "UNDER_INVESTIGATION" : It is not known yet whether these versions are /// or are not affected by the vulnerability. However, it is still under /// investigation.Hu/// The vulnerability identifier for this Assessment. /// /// Will hold one of common identifiers e.g. CVE, GHSA etc.vssl/// VexAssessment provides all publisher provided Vex information that is /// related to this vulnerability.           # 4 4  9 E E J a a f x x }                       " " '  ہ` ? V _ ` ` i v zv                     k           ] '  %   * . / 2 L 3 7 8 @ D E m  {             [           M         " < # ' ( 0 4 5 ] | k    ~                   9*T@R;AW[\bym{|?0MNTUk`msnt.<=CDSO{UZ[fmg} !"(C3_J]EKbfgm|x~hZ$" '+,/I045=ABj ? ?9 W/// The CVSS score of this vulnerability. /// /// CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 /// indicates high severity. /// /// Output only.;,/// The cvss v2 score for the vulnerability.΀/// CVSS version used to populate cvss_score and severity. /// /// Output only. /// Possible string values are: /// - "CVSS_VERSION_UNSPECIFIED" /// - "CVSS_VERSION_2" /// - "CVSS_VERSION_3";,/// The cvss v3 score for the vulnerability.e/// The distro assigned severity for this vulnerability when it is available, /// otherwise this is the note provider assigned severity. /// /// When there are multiple PackageIssues for this vulnerability, they can /// have different effective severities because some might be provided by the /// distro while others are provided by the language ecosystem for a language /// pack. For this reason, it is advised to use the effective severity on the /// PackageIssue level. In the case where multiple PackageIssues have /// differing effective severities, this field should be the highest severity /// for any of the PackageIssues. /// Possible string values are: /// - "SEVERITY_UNSPECIFIED" : Unknown. /// - "MINIMAL" : Minimal severity. /// - "LOW" : Low severity. /// - "MEDIUM" : Medium severity. /// - "HIGH" : High severity. /// - "CRITICAL" : Critical severity.Z>/// Occurrence-specific extra details about the vulnerability.oyo[/// Whether at least one of the affected packages has a fix available. /// /// Output only.iF/// A detailed description of this vulnerability. /// /// Output only.v/// The set of affected locations and their fixes (if available) within the /// associated resource. /// /// Required.eX/// Indicates that the builder claims certain fields in this message to be /// complete.݀B\/// Describes the CIS benchmark version that is applicable to a given OS and os /// version.xxzD/// The period during which some deployable was active in a runtime.H90/// A generic empty message that you can re-use to avoid defining duplicated /// empty messages in your APIs. /// /// A typical example is to use it as the request or the response type of an API /// method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns /// (google.protobuf.Empty); }==/EmmIuhD/// A set of properties that uniquely identify a given Docker image.ƀ7h/// A GitSourceContext denotes a particular revision in a third party Git /// repository (e.g., GitHub).8/// Identifies the entity that executed the recipe, which is trusted to have /// correctly performed the operation and populated this provenance.ppX/// Indicates that the builder claims certain fields in this message to be /// complete.88ڀ/// Describes where the config file that kicked off the build came from. /// /// This is effectively a pointer to the source where buildConfig came from.ɯɯ;/// The collection of artifacts that influenced the build including sources, /// dependencies, build tools, base images, and so on.ЖЖ<&/// Container message for hash values.F(/// The unique identifier of the update.aab/// Justification provides the justification when the state of the assessment if /// NOT_AFFECTED.^^W?/// Layer holds metadata specific to a layer of a Docker image.VV4w/// License information. W W _: /// Details about files that caused a compliance check to fail. /// /// display_command is a single command that can be used to display a list of /// non compliant files. When there is no such command, we can also iterate a /// list of non compliant file using 'path'.yyz |/// Selects a repo using a Google Cloud Platform project ID (e.g., /// winged-cargo-31) and a repo name within that project.~1~1~/// Steps taken to build the artifact. /// /// For a TaskRun, typically each container corresponds to one step in the /// recipe.~~O-/// Metadata for any related URL information.1G3%/// The status of an SBOM generation.dd:/// A predicate which describes the SBOM being referenced.IIT./// The status of the secret with a timestamp.gG/// Verifiers (e.g. Kritis implementations) MUST verify signatures with respect /// to the trust anchors defined in policy (e.g. a Kritis policy). /// /// Typically this means that the verifier has been configured with a map from /// `public_key_id` to public key material (and any required parameters, e.g. /// signing algorithm). In particular, verification implementations MUST NOT /// treat the signature `public_key_id` as anything more than a key lookup hint. /// The `public_key_id` DOES NOT validate or authenticate a public key; it only /// provides a mechanism for quickly selecting a public key ALREADY CONFIGURED /// on the verifier through a trusted channel. Verification implementations MUST /// reject signatures in any of the following circumstances: * The /// `public_key_id` is not recognized by the verifier. * The public key that /// `public_key_id` refers to does not verify the signature with respect to the /// payload. The `signature` contents SHOULD NOT be "attached" (where the /// payload is included with the serialized `signature` bytes). Verifiers MUST /// ignore any "attached" payload and only verify signatures with respect to /// explicitly provided payload (e.g. a `payload` field on the proto message /// that holds this Signature, or the canonical serialization of the proto /// message that holds this signature). ))X/// Indicates that the builder claims certain fields in this message to be /// complete.чч/// Steps taken to build the artifact. /// /// For a TaskRun, typically each container corresponds to one step in the /// recipe.&&/// The `Status` type defines a logical error model that is suitable for /// different programming environments, including REST APIs and RPC APIs. /// /// It is used by [gRPC](https://github.com/grpc). Each `Status` message /// contains three pieces of data: error code, error message, and error details. /// You can find out more about this error model and how to work with it in the /// [API Design Guide](https://cloud.google.com/apis/design/errors).%%/// The Upgrade Distribution represents metadata about the Upgrade for each /// operating system (CPE). /// /// Some distributions have additional metadata around updates, classifying them /// into various categories and severities.  g^K/// Version contains structured information about the version of a package.kGHmЀ)[ʂ*`ał.2}U^_} 56Opq%A܇>?DUg}@A։׊Ft&OPJ/̎7=W]P`fݏAvő:AB‘БEIJrxÓZ`zߔ &q b&[bc˖ז\`a5;n͘ә.4X^šH؛ LM}[aΜԝV\ÝL1ˠeu{gɡ.Smz+gݤab̤Ӥ7>BC̥Ҧh Tڧ>\A+1;SmԬ ?FGŬӬLPRSz,-kîdEU[ְ:oڱ1q ;GUhGH!rԵ.4rxٶ߷*:@x~Ϸܷ3hθQ˺VWȺ3:>@Ab¼89ӽYhnڽ޽?@};JVɿ@ @I@Z@h@@@@@A%AIAsAAAAAAAABB=B>BuByBC CRCCD2DgDDDEEdEEF>FFFFG"G(G8GZGGGGH&H>H\H{HHHHII`IIIJ$J%JVJbJJJKKK-KtKKKL*L;LIL`LiLjLLLMM"M7MfMMMMMMMMN N$N*NyNOOWOxOyOOOP3PPPPQ'Q(QTQ`QQRR R4RnRRRSSSSCSqSSSSST T'T(T.T4TTUUUU UXUUVVV%V9VVVsVVVVVWWKWWWXEXYXXXY,Y=YKYbYkYlYYYZ3ZoZ|ZZZ[2[9[=[?[@[h[i[[[\ \&\u\\\\]]?]E]W]}]~]]^ ^Y^i^^^^^_(___e__`H``a3ahaaaaaabb"b(b)bTb`bbc cGcWckcccd:dJd^ddee%e9emeeeffHfQfRfffg)gQggggh!hBhmhthxhzh{hhhii iMiSiiiij7jVjWjrjjjjjk k(k)kdkjklll lYlqlrllllllmmm/mImJmzmmmmmn;nUnVnjnnnnnnno oo2oMoaouo{o|oooppfpppq&qdquqqqqr rJr[rirrrssHs{sstt;twtttu uuuDupuuuvv>v`vxvvvww@wMwrwwwxxx8xIxdxxxxxxxxyyoypyyyz>zzzzzzz{+{<{[{{{{{{{|||S|T||||}=}M}a}}}~~~Q~Z~[~~~ 2Klswyz(6\]3ef$*+[g ?} Tdx#ER-:jk Zr'Wx@4quwxA]&'Wy#dLkl'FG#X)=>!MNv*GUe|;e.AZWv> [i$X{&\Vp,9h?RiMnr1IJYNOAB XkOq/6:<=mWjEXq Dhlno Le"Z,P| /0cN|2Ias'u DMN#0U|/]^ .CDx$7LRS%^gh)6Wl_AhiQ,P|Ivw67w}F]^ !"S_/=T !Rz *E`y0op78… @AuêBĈļĽZōŎſP\Ɣ)9Mǃ^r{|ȭ+8]ɀɡɨɬɮɯ3stʗ +kˆˇ˶39:̀̌W͏$4H΃Ό΍ξ&VςϮϻ>cЈЏГЕЖнfjѩ #CDҕҢҨһ01y&';Uh~ԒԘԙE{՟FYr"Txע@_fjlm؆ؕصض>Dٕ=Cڒ 3K_rۃۉۊ۶"q܁ܕEfݰgwދޔޕ>^kߒ߱1w+CU[\%pC8f0xLcd1PQev ,\DTh+?"2Fx*34e Ikx8SZ^`aIk/;n W[]^1UVV\01fyz Xk ?r 2Tv1HOSUVo *+x<.45gs*hy "+,]2U\`bc>d67p|6t='8BHZno2`(Hd$89uv1\ef  P T V W u v      F ~      = >      2 M N [ u         R  7QGv7;23z!"_!EFv3IJ DJ] !d:?xLy()qc/5./Ief/0Z  ' : J Y h {      ! !!!'!(!N!Z!!" ""/"Y""""# #M####$*$W$$$$%%%p%%%&&U&e&y&&''$'8'b''''("(O((()%)5)I)))*)*x****+9+I+]+++,7,G,[,,--$-8-A-B-s---. .3.Y....//)/K/u///0070e0r000011.1Y1v111112252\2u2222222343J3\33344#4$4p444455a55566U666667L7x777788i899R999:7:h:i::::;;?;^;;;;<@>>;>P>m>t>x>z>{>>>>??B?C?T?u?v???@9@P@Q@@@A9AHAAAAAB.BCBIBBBBCCCWCCDCDSDwDxDDDEEE'E(EqEEEEEF F+FNFnFFGG$GBGnGGH:HHHHHHII/IFIGIwIIIIIIIJJ,JAJXJkJJJJJJJKKKK KGKSKKKLLYLjLxLLLM?MOMcMMMN&NdNuNNNNOOWOhOvOOOP#PqPPPPQQGQjQQQRR:RmRRSS*SdSSSST/TbTkTlTTTU+UKU}UUUV!VIVaVVVVW)WIWkWxWWWX X5XZX{XXXXYY)YLYmYYYYYYYZ'ZYZnZZZZ[[[8[>[N[n[o[[[[\ \ \X\\\\\]]D]b]]]]]^%^W^X^^^^^__!_'_p____``,`-`o`u`````aa:a;aLaeaaaaaabb'b=bCbDblbxbbc:cZcccddRdeddddeeMeeeffkf{ffffgg5gggggh'hQh}hhhi i4i_iiiij jEjhjojsjujvjjk,k9k?kwk}kkkll1lNlOlllmmm0mGmHmmmmnn"n#nLnRnonnnnnoo#o$oFoLo_osotoooooooppppBpNpppq qSqcqwqqqr(r9rGr^rrrss]smssssstt*tNtjttttuuu9uNuquuuuuuuuv8vvvww.wFwGwwwwwx!x8xexxxxxyy5y}yyyyzz)z*zDzzzzz{{{3{?{{{||!|/|F|o|}}}}C}}}}}}~~#~*~.~0~1~X~\~~~~~m<@r45\h=@p}$3h ,f*34e!"/hI[k)-/0CaIs+a+uBOjJ./pv$PQ @ 3h9c+MN 2U-._}~>Oc{8mM` :Z;V]acdDkl0~ 59;<m@-i^;}$8/K-n-l>DT|}BN{4ESj0>U^_BFHIx26 qaA't()t67)*YxyEq!"JV!Y/89j.Zg4;?ABYh ` ^<=gs2h{Kp -u…™¢£@`mÈç kįDEq}Ż4DXƌƯ ()ZnjǴHflrȽ7Qɇ?@Zpʄʖʫʿ L˖˪Q̪̾̚7͓̓ͧ>|΍Λβ%oϓϜϝ@hЎвп=\yрфцчѮѲ +,p6<ӉӹӺ>?ԎԨԩ/5ՃGxyք֡ h{׬  B؁د.BV٦ M`qڀډڊڻ7Yہێۿ8?CEF}܁Kpqݦ+,Uރބ3b߽߭)q)9M'Mm#%&oW$%qBCH (.|@F#$:Qc{ 76 Xh|3an  Vrs@ms $%r56FX~3U%:/EF~-@Vm}0cz)9M;LZq->Lc*LzDQd "MTXZ[9X^q "DgF&v^6V~IOb}~:U[kHVW#Ae   9 :         0 A ] t         6 < = p |    O _ s    ? O c  "e"3AX"0Go+pL\pyz;q'Qm;Tw 4Y|"$%q(>x56Rmn6K[abL]kXh|SHl   + L o   ! !"!)!-!/=OnDemandScanningApiProjectsResourceProjectsLocationsResource#ProjectsLocationsOperationsResourceProjectsLocationsScansResource-ProjectsLocationsScansVulnerabilitiesResourceAnalyzePackagesRequestV1AttestationOccurrenceBinarySourceInfoBuildDefinitionBuildOccurrenceBuildProvenanceCloudRepoSourceContextComplianceOccurrenceDSSEAttestationOccurrenceDiscoveryOccurrenceEnvelope FileHashes FileLocationGerritSourceContextGrafeasV1BaseImageGrafeasV1FileLocationGrafeasV1LayerDetails,GrafeasV1SlsaProvenanceZeroTwoSlsaInvocation*GrafeasV1SlsaProvenanceZeroTwoSlsaMetadataImageOccurrenceInTotoProvenanceInTotoSlsaProvenanceV1InTotoStatementLanguagePackageDependency LayerDetailsListOperationsResponseListVulnerabilitiesResponseV1Location MaintainerMetadata Occurrence Operation PackageData PackageIssuePackageOccurrencePackageVersionProvenanceBuilder RemediationRepoIdRisk RunDetailsSBOMReferenceOccurrenceSbomReferenceIntotoPayloadSecretLocationSecretOccurrence SlsaMetadataSlsaProvenanceSlsaProvenanceV1SlsaProvenanceZeroTwoSource SourceContextUpgradeOccurrence VexAssessmentVulnerabilityOccurrence WindowsUpdateݭ