> ## Documentation Index > Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt > Use this file to discover all available pages before exploring further. ## Submitting Feedback If you encounter incorrect, outdated, or confusing documentation on this page, submit feedback: POST https://docs.endorlabs.com/feedback ```json { "path": "/api-reference/packageversionservice/listpackageversions", "feedback": "Description of the issue" } ``` Only submit feedback when you have something specific and actionable to report. # ListPackageVersions > Lists all the package versions in a given namespace. ## OpenAPI ````yaml /api-reference/openapi.v3.json get /v1/namespaces/{tenant_meta.namespace}/package-versions openapi: 3.0.3 info: description: Integrate your application with Endor Labs using the REST API. title: Endor Labs REST API Reference version: '1.0' servers: - url: https://api.endorlabs.com/ security: [] tags: - name: AISastCustomerContextService - name: APIKeyService - name: APIKeyValidatorService - name: ArtifactSignatureService - name: AuditLogService - name: AuthenticationLogService - name: AuthenticationService - name: AuthorizationPolicyService - name: BatchFileSegmentsService - name: BatchNotificationService - name: CallGraphDataService - name: CodeOwnersService - name: DependencyMetadataService - name: EndorIgnoreEntryService - name: ExporterService - name: FindingLogService - name: FindingService - name: HuggingFaceModelService - name: HuggingFaceOrganizationService - name: IPAddressPolicyService - name: IdentityProviderService - name: InstallationService - name: InvitationService - name: LicenseDependencyService - name: LicenseNoticesReportService - name: LicenseSummaryService - name: LinterResultService - name: MalwareService - name: MetricService - name: NamespaceService - name: NotificationService - name: NotificationTargetService - name: OnPremSchedulerService - name: PRCommentConfigService - name: PackageFirewallLogService - name: PackageLicenseOverrideService - name: PackageLicenseQueryService - name: PackageLicenseService - name: PackageManagerService - name: PackageVersionService - name: PluginBinaryService - name: PolicyService - name: PolicyTemplateService - name: ProjectService - name: ProvisioningResultService - name: QueryMalwareService - name: QueryService - name: QuerySimilarPackagesService - name: QueryVulnerabilityService - name: RegistryIngestionCheckpointService - name: RepositoryService - name: RepositoryVersionService - name: RuleSetImportService - name: SBOMExportService - name: SBOMImportService - name: SCMCredentialService - name: SavedQueryService - name: ScanLogRequestService - name: ScanProfileService - name: ScanResultService - name: ScanWorkflowResultService - name: ScanWorkflowService - name: SecretRuleService - name: SemgrepRuleService - name: SystemConfigService - name: TenantService - name: VEXExportService - name: VectorStoreService - name: VersionUpgradeService - name: VulnerabilityService paths: /v1/namespaces/{tenant_meta.namespace}/package-versions: get: tags: - PackageVersionService summary: ListPackageVersions description: Lists all the package versions in a given namespace. operationId: PackageVersionService_ListPackageVersions parameters: - description: >- Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". in: path name: tenant_meta.namespace required: true schema: type: string x-endor-name: Namespace - description: >- String of conditions to filter resources by. Filters may include any attribute along with the following operators: "==", "!=", ">", ">=", "<", "<=", "Contains", "In", "Matches", and "Exists". The logical operators "And" and "Or" are also supported. Expressions may be combined and grouped with parentheses. Examples: "spec.value == 5", "spec.value in ["a", "b", "c"]", "(meta.name == "xyz" and "spec.value in ["a","b"]) or (spec.value == "c")". in: query name: list_parameters.filter schema: type: string - description: |- Set the page token to start from. Use page tokens to page through list results or list specific pages. in: query name: list_parameters.page_token schema: format: int32 type: integer - description: |- Set the page size to limit the number of results returned. Default: 100. Max: 500. in: query name: list_parameters.page_size schema: format: int32 type: integer - description: >- Action to be executed with a request. Not supported for all endpoints. in: query name: list_parameters.action schema: type: string - description: List of fields to return (all fields are returned by default). in: query name: list_parameters.mask schema: type: string - description: Get data from any child namespaces as well. in: query name: list_parameters.traverse schema: type: boolean - description: Field to sort objects by, for example, meta.name. in: query name: list_parameters.sort.path schema: type: string - description: 'Sort order. Default: ASC.' in: query name: list_parameters.sort.order schema: default: SORT_ENTRY_ORDER_UNSPECIFIED enum: - SORT_ENTRY_ORDER_UNSPECIFIED - SORT_ENTRY_ORDER_ASC - SORT_ENTRY_ORDER_DESC type: string - description: |- Return the number of objects matching the given list parameters. If count is set to true, the response is a CountResponse. Can be used together with filter and traverse. in: query name: list_parameters.count schema: type: boolean - description: |- Group the objects based on this field. If there are multiple fields then the objects are grouped based on the uniqueness of all fields. Supports composite paths. Supports arrays and maps. in: query name: list_parameters.group.aggregation_paths schema: type: string - description: |- Return the UUID of each object in each group as specified by aggregation_paths. in: query name: list_parameters.group.show_aggregation_uuids schema: type: boolean - description: |- List of fields for which we want the unique count. Supports arrays and maps. in: query name: list_parameters.group.unique_count_paths schema: type: string - description: |- List of fields for which we want the unique values. Supports arrays and maps. in: query name: list_parameters.group.unique_value_paths schema: type: string - description: Only return objects from PR scans that match this context id. in: query name: list_parameters.ci_run_uuid schema: type: string - description: Page ID to retrieve. in: query name: list_parameters.page_id schema: type: string - description: |- Group the objects based on this time field, for example, meta.create_time. in: query name: list_parameters.group_by_time.aggregation_paths schema: type: string - description: Return the UUIDs of the objects in each group. in: query name: list_parameters.group_by_time.show_aggregation_uuids schema: type: boolean - description: Interval unit by which the objects should be grouped. in: query name: list_parameters.group_by_time.interval schema: default: GROUP_BY_TIME_INTERVAL_UNSPECIFIED enum: - GROUP_BY_TIME_INTERVAL_UNSPECIFIED - GROUP_BY_TIME_INTERVAL_YEAR - GROUP_BY_TIME_INTERVAL_QUARTER - GROUP_BY_TIME_INTERVAL_MONTH - GROUP_BY_TIME_INTERVAL_WEEK - GROUP_BY_TIME_INTERVAL_DAY - GROUP_BY_TIME_INTERVAL_HOUR - GROUP_BY_TIME_INTERVAL_MINUTE - GROUP_BY_TIME_INTERVAL_SECOND type: string - description: |- Size of the time interval to group the objects by, for example, to group objects by 2-week intervals, set interval to GROUP_BY_TIME_INTERVAL_WEEK and group_size to 2. in: query name: list_parameters.group_by_time.group_size schema: format: int32 type: integer - description: |- Beginning of the time period to group objects. Defaults to the beginning of time. in: query name: list_parameters.group_by_time.start_time schema: format: date-time type: string - description: |- End of the time period to group objects. Defaults to the current time. in: query name: list_parameters.group_by_time.end_time schema: format: date-time type: string - description: >- The mode determines how the matching objects are counted in the produced time-series. Values allowed are: count (default) : is the number of items matching in every interval. sum: is the total number of items matching since the beginning of the aggregation time. in: query name: list_parameters.group_by_time.mode schema: type: string - description: >- The aggregation_field is a field on the matched objects that we want to perform some operation in each interval (example : min, max, avg) in: query name: list_parameters.group_by_time.aggregation_value_field schema: type: string - description: |- The aggreation_operator is the operator that we should use for the aggregation. Allowed values are: min, max, sum, avg in: query name: list_parameters.group_by_time.aggregation_operator schema: type: string - description: |- If true, the results will not be paginated and only the first page will be returned. The order of the results is not guaranteed. in: query name: list_parameters.disable_pagination schema: type: boolean responses: '200': content: application/json: schema: $ref: '#/components/schemas/v1ListPackageVersionsResponse' description: A successful response. default: content: application/json: schema: $ref: '#/components/schemas/googlerpcStatus' description: An unexpected error response. components: schemas: v1ListPackageVersionsResponse: description: Response to the request to list package versions. properties: count_response: $ref: '#/components/schemas/v1CountResponse' group_response: $ref: '#/components/schemas/v1GroupResponse' list: $ref: '#/components/schemas/v1ListPackageVersionsResponseList' type: object googlerpcStatus: description: >- The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). properties: code: description: |- The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. format: int32 type: integer details: description: >- A list of messages that carry the error details. There is a common set of message types for APIs to use. items: $ref: '#/components/schemas/googleprotobufAny' type: array message: description: >- A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. type: string type: object v1CountResponse: description: Response to a list count request. properties: count: description: Number of objects matching the given list parameters. format: int32 type: integer type: object v1GroupResponse: description: Response to a list group request. properties: groups: additionalProperties: $ref: '#/components/schemas/GroupResponseGroupData' description: |- Map indexed by values of the fields specified in aggregation_paths, for example, {"[{"key":"meta.kind","value":"Project"}]": { "aggregation_count": { "count": 1649 } } }. type: object type: object v1ListPackageVersionsResponseList: properties: objects: items: $ref: '#/components/schemas/v1PackageVersion' type: array response: $ref: '#/components/schemas/v1ListResponse' type: object googleprotobufAny: additionalProperties: {} description: >- `Any` contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message. Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type. Example 1: Pack and unpack a message in C++. Foo foo = ...; Any any; any.PackFrom(foo); ... if (any.UnpackTo(&foo)) { ... } Example 2: Pack and unpack a message in Java. Foo foo = ...; Any any = Any.pack(foo); ... if (any.is(Foo.class)) { foo = any.unpack(Foo.class); } // or ... if (any.isSameTypeAs(Foo.getDefaultInstance())) { foo = any.unpack(Foo.getDefaultInstance()); } Example 3: Pack and unpack a message in Python. foo = Foo(...) any = Any() any.Pack(foo) ... if any.Is(Foo.DESCRIPTOR): any.Unpack(foo) ... Example 4: Pack and unpack a message in Go foo := &pb.Foo{...} any, err := anypb.New(foo) if err != nil { ... } ... foo := &pb.Foo{} if err := any.UnmarshalTo(foo); err != nil { ... } The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z". JSON ==== The JSON representation of an `Any` value uses the regular representation of the deserialized, embedded message, with an additional field `@type` which contains the type URL. Example: package google.profile; message Person { string first_name = 1; string last_name = 2; } { "@type": "type.googleapis.com/google.profile.Person", "firstName": , "lastName": } If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field `value` which holds the custom JSON in addition to the `@type` field. Example (for message [google.protobuf.Duration][]): { "@type": "type.googleapis.com/google.protobuf.Duration", "value": "1.212s" } properties: '@type': description: >- A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one "/" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading "." is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics. type: string type: object GroupResponseGroupData: description: Information about objects matching the given key. properties: aggregation_count: $ref: '#/components/schemas/v1CountResponse' aggregation_uuids: description: |- List of UUIDs of the objects in the group. Only populated if show_aggregation_uuids is set. items: type: string type: array aggregation_value: $ref: '#/components/schemas/v1GroupAggregationValueResponse' unique_counts: additionalProperties: $ref: '#/components/schemas/v1CountResponse' description: |- Map of counts for the given unique_count_paths fields. Only populated if unique_count_paths is set. type: object unique_values: additionalProperties: items: type: object type: array description: |- Map of values for the given unique_value_paths fields. Only populated if unique_value_paths is set. type: object type: object v1PackageVersion: description: PackageVersion represents a version of a package. properties: context: $ref: '#/components/schemas/v1Context' meta: $ref: '#/components/schemas/v1Meta' processing_status: $ref: '#/components/schemas/v1ProcessingStatus' spec: $ref: '#/components/schemas/v1PackageVersionSpec' tenant_meta: $ref: '#/components/schemas/v1TenantMeta' uuid: description: The UUID of the package version resource. readOnly: true type: string required: - meta - spec - context type: object v1ListResponse: description: Response to a list request. properties: next_page_id: description: The UUID of last message retrieved. type: string next_page_token: description: >- Pagination token that can be used to retrieve the next page of results. format: int32 type: integer type: object v1GroupAggregationValueResponse: description: |- GroupAggregationValueResponse returns the value of the aggregation if requested. properties: value: format: float type: number type: object v1Context: description: Contexts keep objects from different scans separated. properties: id: description: The context ID, such as a pull request ID or branch reference. type: string tags: description: |- A list of tags applied to a context. Used primarily for CI and SBOM contexts. items: type: string type: array type: $ref: '#/components/schemas/ContextContextType' will_be_deleted_at: description: |- Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. format: date-time readOnly: true type: string required: - type - id type: object v1Meta: description: Common fields for all Endor Labs resources. properties: annotations: additionalProperties: type: string description: >- Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. type: object create_time: description: |- Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. format: date-time readOnly: true type: string created_by: description: |- Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. readOnly: true type: string description: description: Resource description. Must be less than 1024 bytes. type: string index_data: $ref: '#/components/schemas/v1IndexData' kind: description: >- Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). readOnly: true type: string name: description: Resource name. Must be 63 characters or less. type: string parent_kind: description: Parent object resource kind, for example, Project. type: string parent_uuid: description: Parent object UUID. type: string references: additionalProperties: $ref: '#/components/schemas/googleprotobufAny' description: Map of objects referenced in a query API. readOnly: true type: object tags: description: >- List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. items: type: string type: array update_time: description: |- Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. format: date-time readOnly: true type: string updated_by: description: >- Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. readOnly: true type: string upsert_time: description: |- Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. format: date-time readOnly: true type: string version: description: Message version. readOnly: true type: string required: - name type: object v1ProcessingStatus: properties: analytic_time: description: |- Last time a project was analyzed. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. format: date-time type: string disable_automated_scan: description: >- This is a private package and it must not be scanned by the background scheduler. It will be scanned by an endorctl client instead. Default: false. type: boolean metadata: $ref: '#/components/schemas/v1ProcessingStatusMetadata' queue_time: description: |- Last time a project was queued. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. format: date-time type: string scan_state: $ref: '#/components/schemas/v1ScanState' scan_time: description: |- Last time a project was ingested. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt format: date-time type: string type: object v1PackageVersionSpec: properties: bazel_metadata: $ref: '#/components/schemas/v1BazelMetadata' call_graph_available: description: >- Set to true if a call graph was successfully created by the latest scan. type: boolean code_owners: $ref: '#/components/schemas/v1CodeOwnerData' container_metadata: $ref: '#/components/schemas/v1ContainerMetadata' ecosystem: $ref: '#/components/schemas/v1Ecosystem' internal_reference_key: description: >- Unique key for the package generated by Endor Labs to simplify lookups. readOnly: true type: string language: $ref: '#/components/schemas/v1Language' package_name: description: |- The name of the package of this package version. It is calculated automatically from the package version name. readOnly: true type: string precomputed_call_graph_state: $ref: '#/components/schemas/v1PrecomputedState' project_uuid: description: The UUID of the project to which this package version belongs. type: string relative_path: description: |- Relative path of the package from where the package was discovered relative to the workspace root. type: string release_timestamp: description: |- The release timestamp corresponding to the time a particular package version was released. format: date-time type: string resolution_errors: $ref: '#/components/schemas/PackageVersionResolutionErrors' resolved_dependencies: $ref: '#/components/schemas/v1Bom' source_code_reference: $ref: '#/components/schemas/PackageVersionSourceCodeReference' unresolved_dependencies: description: >- The exact dependency declarations in the package manager descriptor file. In Golang, this represents the list of dependencies in the go.mod. In Java/Maven, this represents the list of dependencies in the pom.xml. items: $ref: '#/components/schemas/v1PackageVersionDependency' type: array required: - project_uuid type: object v1TenantMeta: description: Tenant related data for the tenant containing the resource. properties: namespace: description: >- Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". type: string required: - namespace type: object ContextContextType: default: CONTEXT_TYPE_UNSPECIFIED description: |2- - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. enum: - CONTEXT_TYPE_UNSPECIFIED - CONTEXT_TYPE_MAIN - CONTEXT_TYPE_EXTERNAL - CONTEXT_TYPE_CI_RUN - CONTEXT_TYPE_SBOM - CONTEXT_TYPE_REF type: string v1IndexData: description: |- IndexData is used to index the resource for search. It's an internal object. properties: data: items: type: string readOnly: true type: array search_score: description: >- search_score is the score of the resource for search. Internal use only. format: float readOnly: true type: number tenant: readOnly: true type: string will_be_deleted_at: description: Time that the resource will be deleted. format: date-time readOnly: true type: string type: object v1ProcessingStatusMetadata: properties: full_history_scan_time: format: date-time title: Last time a project was scanned with deep secrets scanning type: string type: object v1ScanState: default: SCAN_STATE_UNSPECIFIED description: |- Scan state for a project or package version. - SCAN_STATE_NOT_PROCESSED: Object has not been processed by the system yet. Set when the project or package is created for the first time. A new project or package version is automatically placed in this state. - SCAN_STATE_IDLE: Object has been scanned at least once. - SCAN_STATE_INGESTING: Object is being scanned. - SCAN_STATE_ANALYTIC: Object is being analyzed. - SCAN_STATE_UNREACHABLE: Object cannot be ingested because it is not reachable from the scheduler. - SCAN_STATE_REQUEST_FULL_RESCAN: Object is marked for a complete rescan. This only applies to OSS projects. - SCAN_STATE_REQUEST_INCREMENTAL_RESCAN: Object is marked for an incremental rescan, where only new packages discovered in the scan are added. Indicates that this project should be rescanned with a higher priority. Often because it is used by a customer and we need any new packages to be discovered and scanned with higher priority. If the project is put in this state, we will scan any new packages at high priority but we will not re-scan older packages. - SCAN_STATE_QUEUED: Object is queued to be scanned. - SCAN_STATE_QUARANTINED: Scan scheduling was unsuccessful due to a system errors. Object is quarantined from additional scheduling. Potentially object is an orphan or similar situations. enum: - SCAN_STATE_UNSPECIFIED - SCAN_STATE_NOT_PROCESSED - SCAN_STATE_IDLE - SCAN_STATE_INGESTING - SCAN_STATE_ANALYTIC - SCAN_STATE_UNREACHABLE - SCAN_STATE_REQUEST_FULL_RESCAN - SCAN_STATE_REQUEST_INCREMENTAL_RESCAN - SCAN_STATE_QUEUED - SCAN_STATE_QUARANTINED type: string v1BazelMetadata: description: BazelMetadata contains the Bazel metadata. properties: build_path: description: The build path. type: string type: object v1CodeOwnerData: description: Code owner information for a file path or pattern. properties: labels: description: List of labels. items: type: string type: array owners: description: List of code owners. items: type: string type: array type: object v1ContainerMetadata: description: ContainerMetadata is the metadata of a container image. properties: architecture: $ref: '#/components/schemas/v1ContainerArchitecture' base_image: $ref: '#/components/schemas/v1ContainerBaseImage' chain_id: description: Chain ID for the image's layers. type: string command: description: List of container command arguments. items: type: string type: array digest: description: The SHA256 digest of the container image. type: string distribution: description: The OS distribution of the base image. type: string entrypoint: description: List of container entrypoint arguments. items: type: string type: array environment: description: List of container environment variables. items: type: string type: array exposed_ports: description: List of container exposed ports. items: type: string type: array labels: additionalProperties: type: string description: Map of container labels. type: object layers: description: >- The list of layers of the container in the order they are applied to assemble the container image. The layers are the SHA256 digest of the container image layers. The list is equivalent to the output of `docker inspect --format='{{.RootFS.Layers}}' `. items: $ref: '#/components/schemas/v1ContainerLayer' type: array profile_details: $ref: '#/components/schemas/v1ContainerProfileDetails' profile_error: $ref: '#/components/schemas/v1ContainerProfileError' profiled: description: True if the container image has been profiled. type: boolean repo_digest: description: >- The repo digest of the container image (e.g., "your-image-name@sha256:..."). type: string used_as_base: $ref: '#/components/schemas/v1ContainerAsBase' version: description: The version of the OS distribution of the base image. type: string working_directory: description: The working directory of the container. type: string type: object v1Ecosystem: default: ECOSYSTEM_UNSPECIFIED description: >2- - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. enum: - ECOSYSTEM_UNSPECIFIED - ECOSYSTEM_GO - ECOSYSTEM_MAVEN - ECOSYSTEM_PYPI - ECOSYSTEM_CARGO - ECOSYSTEM_NPM - ECOSYSTEM_GEM - ECOSYSTEM_NUGET - ECOSYSTEM_PACKAGIST - ECOSYSTEM_SBOM - ECOSYSTEM_RPM - ECOSYSTEM_DEBIAN - ECOSYSTEM_GITHUB_ACTION - ECOSYSTEM_COCOAPOD - ECOSYSTEM_APK - ECOSYSTEM_CONTAINER - ECOSYSTEM_HUGGING_FACE - ECOSYSTEM_C - ECOSYSTEM_GIT - ECOSYSTEM_AI_MODEL - ECOSYSTEM_SWIFT - ECOSYSTEM_CONAN type: string v1Language: default: LANGUAGE_UNSPECIFIED enum: - LANGUAGE_UNSPECIFIED - LANGUAGE_GO - LANGUAGE_JAVA - LANGUAGE_SCALA - LANGUAGE_PYTHON - LANGUAGE_RUST - LANGUAGE_JS - LANGUAGE_RUBY - LANGUAGE_CSHARP - LANGUAGE_PHP - LANGUAGE_TYPESCRIPT - LANGUAGE_KOTLIN - LANGUAGE_SWIFT - LANGUAGE_OBJECTIVEC - LANGUAGE_C - LANGUAGE_CPP - LANGUAGE_SWIFTURL - LANGUAGE_CONAN type: string v1PrecomputedState: default: PRECOMPUTED_STATE_UNSPECIFIED description: |- PrecomputedState represents the state of precomputed operations. - PRECOMPUTED_STATE_UNSPECIFIED: UNSPECIFIED indicates that the precomputed state is not set or unknown. - PRECOMPUTED_STATE_SUCCESS: SUCCESS indicates that the precomputed operation completed successfully. - PRECOMPUTED_STATE_FAILURE: FAILURE indicates that the precomputed operation failed. enum: - PRECOMPUTED_STATE_UNSPECIFIED - PRECOMPUTED_STATE_SUCCESS - PRECOMPUTED_STATE_FAILURE type: string PackageVersionResolutionErrors: description: ResolutionErrors captures the error results. properties: call_graph: $ref: '#/components/schemas/v1ResolutionStatus' resolved: $ref: '#/components/schemas/v1ResolutionStatus' unresolved: $ref: '#/components/schemas/v1ResolutionStatus' type: object v1Bom: properties: dependencies: description: >- Different package managers use different dependency graph serialization strategies. Include the serialized list here to avoid re-implementing this within endoctl. items: $ref: '#/components/schemas/BomDependency' type: array dependency_files: description: >- The list of the dependency files used to create the BOM. This field is optional and is only set when the source code of the package versions is known. It will contain the list of relative path of files used to compute the BOM. For instance for Golang, it will contain the go.mod and go.sum. items: $ref: '#/components/schemas/BomDependencyFile' type: array dependency_graph: additionalProperties: items: type: object type: array title: |- A dependency graph is a K/V pair of package names. The format of the key must be: - mvn://MVN_CENTRAL/foo:bar@2.1 - mvn://CLIENT_REPO/foo:bar@2.1-SNAPSHOT - go://github.com/myorg/myrepo/mypkg@sha type: object resolution_timestamp: format: date-time type: string required: - resolution_timestamp type: object PackageVersionSourceCodeReference: properties: http_clone_url: description: The URL of the source code repository. type: string platform_source: $ref: '#/components/schemas/v1PlatformSource' version: $ref: '#/components/schemas/v1Version' type: object v1PackageVersionDependency: description: PackageVersionDependency is a dependency of a package version. properties: c: $ref: >- #/components/schemas/PackageVersionDependencyUnresolvedDependencySpec cargo: $ref: '#/components/schemas/PackageVersionDependencyCargoDependencySpec' cocoapod: $ref: '#/components/schemas/PackageVersionDependencyCocoapodDependencySpec' gem: $ref: '#/components/schemas/PackageVersionDependencyGemDependencySpec' githubaction: $ref: >- #/components/schemas/PackageVersionDependencyGitHubActionDependencySpec go: $ref: '#/components/schemas/PackageVersionDependencyGoDependencySpec' hugging_face: $ref: >- #/components/schemas/PackageVersionDependencyHuggingFaceDependencySpec maven: $ref: '#/components/schemas/PackageVersionDependencyMavenDependencySpec' npm: $ref: '#/components/schemas/PackageVersionDependencyNpmDependencySpec' nuget: $ref: '#/components/schemas/PackageVersionDependencyNugetDependencySpec' packagist: $ref: '#/components/schemas/PackageVersionDependencyPackagistDependencySpec' pypi: $ref: '#/components/schemas/PackageVersionDependencyPypiDependencySpec' swift: $ref: '#/components/schemas/PackageVersionDependencySwiftDependencySpec' type: object v1ContainerArchitecture: default: CONTAINER_ARCHITECTURE_UNSPECIFIED description: |- Container architecture. - CONTAINER_ARCHITECTURE_UNSPECIFIED: Unspecified architecture. - CONTAINER_ARCHITECTURE_UNKNOWN: Unknown architecture. - CONTAINER_ARCHITECTURE_AMD64: amd64 (64-bit x86) architecture. - CONTAINER_ARCHITECTURE_386: 386 (32-bit x86) architecture. - CONTAINER_ARCHITECTURE_ARM: arm (32-bit ARM) architecture. - CONTAINER_ARCHITECTURE_ARM64: arm64 (64-bit ARM) architecture. - CONTAINER_ARCHITECTURE_PPC64LE: ppc64le (PowerPC 64-bit, little-endian) architecture. - CONTAINER_ARCHITECTURE_PPC64: ppc64 (PowerPC 64-bit, big-endian) architecture . - CONTAINER_ARCHITECTURE_MIPS64LE: mips64le (MIPS 64-bit, little-endian) architecture. - CONTAINER_ARCHITECTURE_MIPS64: mips64 (MIPS 64-bit, big-endian) architecture. - CONTAINER_ARCHITECTURE_MIPSLE: mipsle (MIPS 32-bit, little-endian) architecture. - CONTAINER_ARCHITECTURE_MIPS: mips (MIPS 32-bit, big-endian) architecture. - CONTAINER_ARCHITECTURE_S390X: s390x (IBM System z 64-bit, big-endian) architecture. - CONTAINER_ARCHITECTURE_WASM: wasm (WebAssembly 32-bit) architecture. enum: - CONTAINER_ARCHITECTURE_UNSPECIFIED - CONTAINER_ARCHITECTURE_UNKNOWN - CONTAINER_ARCHITECTURE_AMD64 - CONTAINER_ARCHITECTURE_386 - CONTAINER_ARCHITECTURE_ARM - CONTAINER_ARCHITECTURE_ARM64 - CONTAINER_ARCHITECTURE_PPC64LE - CONTAINER_ARCHITECTURE_PPC64 - CONTAINER_ARCHITECTURE_MIPS64LE - CONTAINER_ARCHITECTURE_MIPS64 - CONTAINER_ARCHITECTURE_MIPSLE - CONTAINER_ARCHITECTURE_MIPS - CONTAINER_ARCHITECTURE_S390X - CONTAINER_ARCHITECTURE_WASM type: string v1ContainerBaseImage: description: The base image of a container Image. properties: chain_id: description: Chain ID for the base image's layers. type: string digest: description: The SHA256 digest of the base image. type: string name: description: The name of the base image. For example, "debian:bookworm-slim". type: string type: object v1ContainerLayer: description: A layer of a container image. properties: base_layer: description: True if the layer is came through the base image otherwise false. type: boolean command: description: |- The command that was run to create the layer. For example, `COPY /app /app`. This is an optional field. type: string digest: description: digest is the sha256 digest of the layer. type: string required: - digest type: object v1ContainerProfileDetails: description: >- ContainerProfileDetails represents the details of the container profiling. properties: application_type: $ref: '#/components/schemas/ContainerProfileDetailsApplicationType' detected_as_base_image: description: >- True if container image is a generic base image. For example, "debian:bookworm-slim" where entry point is generic shell like "/bin/sh" or "/bin/bash". type: boolean duration_ms: description: The duration of the profile in milliseconds. format: int64 type: string entry_point_package_version_name: description: >- Dependency that boots the container image and creates Process ID (PID) 1. type: string profile_type: $ref: '#/components/schemas/ContainerProfileDetailsProfileType' type: object v1ContainerProfileError: description: >- ContainerProfileError represents the error while profiling the container image. properties: description: description: A description of the profile error. type: string status: $ref: '#/components/schemas/ContainerProfileErrorContainerProfileStatus' type: object v1ContainerAsBase: description: >- ContainerAsBase captures usage of this container image as a base image elsewhere. properties: first_seen: description: First time this image was seen used as a base image. format: date-time type: string last_seen: description: Most recent time this image was seen used as a base image. format: date-time type: string update_options: $ref: '#/components/schemas/v1ContainerImageUpdateOptions' use_count: description: >- Number of times this image has been seen used as a base image. This number is used for trending and it's not meant for exact usage tracking. format: uint64 type: string used: description: True if this image is used as a base image elsewhere. type: boolean type: object v1ResolutionStatus: description: |- ResolutionStatus is the response status that indicates if the operation succeeded. The response status will be stored with the results. The caller will continue with subsequent requests and the server can continue with additional packages. properties: description: description: >- A description of the error. Plugins should use proper descriptions that will be helpful to users or operations. type: string error_analysis: description: |- The analysis of the error based on the error parsing rules that can provide additional context on possible fixes. items: $ref: '#/components/schemas/ResolutionStatusErrorAnalysis' type: array error_analysis_best_match: $ref: '#/components/schemas/ResolutionStatusErrorAnalysis' operation: description: |- The operation during which encountered the error. A Go plugin can return as operation reading go.mod file, a Java plugin can be reading a pom.xml. Every plugin is doing different operations and it should identify here the operation that failed. This again will help with debugging. type: string status_error: $ref: '#/components/schemas/ResolutionStatusStatusError' target: description: >- The target object (path or package) where the failure happened. For package scans it is the package. For the workspace scans it is the target path. type: string target_files: additionalProperties: type: string description: >- The content of manifest files or the list of files based on the operation. type: object type: object BomDependency: properties: abstract: description: >- Whether this is an abstract dependency, such as a secondary BOM file. type: boolean cocoapod_dependency_scope: $ref: '#/components/schemas/v1DependencyScope' composition_metadata: $ref: '#/components/schemas/v1ContainerCompositionMetadata' container_layers: description: >- A list of layers where a dependency is introduced in final the container image. It is an optional field. Each entry contains the layer ID (the SHA256 digest of the layer) and the file locations within the layer that indicate the presence of the dependency in the container. items: $ref: '#/components/schemas/v1ContainerDependencyLayer' type: array dependency_scope: $ref: '#/components/schemas/v1DependencyScope' eol_timestamp: description: End of life timestamp of the dependency if known. format: date-time type: string file_locations: description: |- An optional field for BOM dependencies that are either vendored or discovered in containers and identify the list of file locations that this dependency is seen at. items: type: string type: array gem_dependency_scope: $ref: '#/components/schemas/PackageVersionDependencyGemDependencySpecScope' github_action_kind: $ref: >- #/components/schemas/PackageVersionDependencyGitHubActionDependencySpecScope golang_dependency_scope: $ref: '#/components/schemas/PackageVersionDependencyGoDependencySpecScope' hugging_face_dependency_scope: $ref: '#/components/schemas/v1DependencyScope' imported_type: $ref: '#/components/schemas/DependencyImportedType' js_dependency_scope: $ref: '#/components/schemas/PackageVersionDependencyNpmDependencySpecScope' maven_dependency_scope: $ref: >- #/components/schemas/PackageVersionDependencyMavenDependencySpecScope name: type: string nuget_dependency_scope: $ref: '#/components/schemas/v1DependencyScope' packagist_dependency_scope: $ref: >- #/components/schemas/PackageVersionDependencyPackagistDependencySpecScope patched: description: patched indicates whether the dependency version was patched or not. type: boolean pinned: description: Whether the dependency version is fixed to a single version or not. type: boolean platform_source: $ref: '#/components/schemas/v1PlatformSource' public: description: |- A boolean to know if the dependency is public or not. This field might not be set. type: boolean purl: description: >- purl is the package URL notation of the dependency. Populated only for containers and OS packages. type: string pypi_dependency_scope: $ref: '#/components/schemas/PackageVersionDependencyPypiDependencySpecScope' release_date: description: The date that the dependency was released, if known. format: date-time type: string runtime_files: description: >- A list of files accessed when a dependency is called at runtime in the container image. This is an optional field. It is only set when a dependency is found to be used at runtime in the container image. items: $ref: '#/components/schemas/v1ContainerRuntimeDependencyFile' type: array rust_dependency_kind: $ref: '#/components/schemas/CargoDependencySpecDependencyKind' source_repository_http_clone_url: description: >- The HTTP clone URL of the dependency if found. This field might not be set. type: string source_repository_ref: description: |- The ref of the source repsotiory. This can be a tag or a commit SHA. This field might not be set. type: string swift_dependency_scope: $ref: '#/components/schemas/v1DependencyScope' targets: description: >- The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. items: $ref: '#/components/schemas/v1Target' type: array user_app_dep: description: >- For container BOMs, set to true if this is a user application (i.e. the user associated it with an SCA scan). type: boolean vendored: description: Whether this is dependency comes from vendored code or not. type: boolean required: - name type: object BomDependencyFile: properties: path: description: Relative path of the dependency file used to compute the BOM. type: string type: object v1PlatformSource: default: PLATFORM_SOURCE_UNSPECIFIED description: Type of source control platform a resource was discovered on. enum: - PLATFORM_SOURCE_UNSPECIFIED - PLATFORM_SOURCE_GITHUB - PLATFORM_SOURCE_GITLAB - PLATFORM_SOURCE_GITSERVER - PLATFORM_SOURCE_BITBUCKET - PLATFORM_SOURCE_BINARY - PLATFORM_SOURCE_HUGGING_FACE - PLATFORM_SOURCE_AZURE - PLATFORM_SOURCE_ARCHIVE - PLATFORM_SOURCE_EXTERNAL_AI_SERVICE - PLATFORM_SOURCE_GITHUB_ENTERPRISE type: string v1Version: properties: metadata: additionalProperties: type: string description: Version metadata. type: object ref: description: |- Resolved ref of the source control version. Can be a tag, a branch or a SHA. type: string sha: description: >- SHA of the source control version. Because the SHA might not be possible to resolved this field is optional. type: string required: - ref type: object PackageVersionDependencyUnresolvedDependencySpec: description: Unresolved dependency data. properties: name: description: Package name, for example, Alamofire. type: string scope: $ref: '#/components/schemas/v1DependencyScope' targets: description: |- Targets that this dependency applies to. If there is no target then this dependency applies to all targets. items: $ref: '#/components/schemas/v1Target' type: array version_constraints: description: Version constraints, for example, ~> 1.2. type: string required: - name type: object PackageVersionDependencyCargoDependencySpec: description: |- CargoDependencySpec specifies a dependency for type defined in the Rust cargo_metadata crate. properties: cfg: $ref: '#/components/schemas/CargoDependencySpecCfg' features: description: The list of features enabled for this dependency. items: type: string type: array kind: $ref: '#/components/schemas/CargoDependencySpecDependencyKind' name: description: The name of dependency. type: string named: $ref: '#/components/schemas/CargoDependencySpecNamedPlatform' optional: description: Whether this dependency is required or optional. type: boolean path: description: / The file system path for a local path dependency. type: string registry: description: >- / The URL of the index of the registry where this dependency is from. / If not specified, the dependency is from crates.io. type: string rename: description: >- If the dependency is renamed, this is the new name for the dependency. type: string req: description: |- The required version, specified as a list of version requirements. that all have to be satisfied. items: $ref: '#/components/schemas/CargoDependencySpecCargoVersionReq' type: array source: description: The source repository query string to use, if any. type: string targets: description: >- The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. items: $ref: '#/components/schemas/v1Target' type: array uses_default_features: description: Whether the default features in this dependency are used or not. type: boolean version_constraints: description: Package version number rules. type: string required: - name - kind - optional - uses_default_features - version_constraints type: object PackageVersionDependencyCocoapodDependencySpec: description: |- CocoapodDependencySpec specifies storing a dependency for cocoapod packages. properties: name: title: |- The name of the package. Example: Alamofire type: string scope: $ref: '#/components/schemas/v1DependencyScope' targets: description: >- The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. items: $ref: '#/components/schemas/v1Target' type: array version_constraints: title: |- The Cocoapod version that is defined in the Podfile. Example: (~> 1.2) type: string required: - name type: object PackageVersionDependencyGemDependencySpec: description: |- GemDependencySpec specifies storing a dependency for Ruby based repositories or packages. properties: name: title: |- The name of the Ruby dependency (name of a gem). Example: nokogiri type: string scope_type: $ref: '#/components/schemas/PackageVersionDependencyGemDependencySpecScope' targets: description: >- The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. items: $ref: '#/components/schemas/v1Target' type: array version_constraints: title: |- Package version number rules. Example-1: ~= 1.2 Example-2: >= 4.0.0, < 6.0.0 Example-3: == 5.4.7 type: string required: - name - version_constraints type: object PackageVersionDependencyGitHubActionDependencySpec: description: |- GitHubActionDependencySpec specifies storing a dependency for GitHub action packages. properties: action_type: $ref: '#/components/schemas/GitHubActionDependencySpecGHActionType' name: title: |- The name of the GitHub action Example: actions/checkout type: string scope: $ref: >- #/components/schemas/PackageVersionDependencyGitHubActionDependencySpecScope version: title: |- The version of the GitHub action Example: v1, v2, main type: string required: - name type: object PackageVersionDependencyGoDependencySpec: description: |- GoDependencySpec specifies a dependency for Go packages or repositories. properties: package: title: |- The package url of the go dependency. Example: go://github.com/hashicorp/golang-lru/simplelru@v0.5.4 type: string ref: description: The ref of the dependency package version. type: string scope_type: $ref: '#/components/schemas/PackageVersionDependencyGoDependencySpecScope' targets: description: >- The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. items: $ref: '#/components/schemas/v1Target' type: array required: - package - ref type: object PackageVersionDependencyHuggingFaceDependencySpec: description: |- HuggingFaceDependencySpec specifies storing a dependency for hugging face models. properties: name: title: |- The name of the model or package. Example: meta-llama/Meta-Llama-3-8B-Instruct type: string version: title: |- The version of the model or package. Example: main type: string required: - name type: object PackageVersionDependencyMavenDependencySpec: description: |- MavenDependencySpec specifies a dependency for Maven repositories or packages. properties: artifact_id: description: The name of a Maven project. type: string classifier: description: |- Differentiates Maven artifacts that were built from the same POM for different contexts. Some examples are "tests", "client", and "sources". type: string exclusions: description: Maven dependencies of a package version explicitly excluded. type: string group_id: description: A unique identifier for an organization or project in Maven. type: string optional: description: |- Whether a Maven dependency is needed or not for a project to work correctly. type: boolean scope: description: >- Maven dependency scopes which can help to limit the transitivity of the dependencies and determine build tasks and lifecycle a dependency applies to. Deprecated. Maintained for compatibility. type: string scope_type: $ref: >- #/components/schemas/PackageVersionDependencyMavenDependencySpecScope targets: description: >- The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. items: $ref: '#/components/schemas/v1Target' type: array type: description: |- The Maven dependency type. Some examples are "jar", "ear", and "test-jar". type: string version_constraints: description: Maven version number rules. type: string required: - group_id - artifact_id - version_constraints type: object PackageVersionDependencyNpmDependencySpec: description: |- NpmDependencySpec specifies storing a dependency for npm based repositories or packages. properties: name: title: |- name specifies the package name of the npm package. Example: react type: string scope: $ref: '#/components/schemas/PackageVersionDependencyNpmDependencySpecScope' targets: description: >- The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. items: $ref: '#/components/schemas/v1Target' type: array version: title: >- version specifies the version of the npm dependency if concrete version is defined in package.json. Example: 1.0.0 type: string version_constraint: title: >- versionConstraints are module version number rules if no concrete version is found. Example-1: ~= 3.2 Example-2: >= 2.0.0, < 3.0.0 Example-3: == 4.7.0 type: string required: - name type: object PackageVersionDependencyNugetDependencySpec: description: |- NugetDependencySpec specifies storing a dependency for NuGet based repositories or packages. properties: name: title: |- The package URL of the NuGet package. Example: nuget://System.Text.JSON@1.0.0 type: string scope: $ref: '#/components/schemas/v1DependencyScope' targets: description: >- The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. items: $ref: '#/components/schemas/v1Target' type: array version_constraints: title: |- The NuGet package version that is defined in the csproj file. Example-1: [1.0.0, 2.0.0), Example-2: * Example-3: (1.0.0, 2.0.0] type: string required: - name type: object PackageVersionDependencyPackagistDependencySpec: description: |- PackagistDependencySpec specifies storing a dependency for php based repositories or packages. properties: name: title: |- The name of the PHP package dependency. Example: monolog/monolog type: string scope_type: $ref: >- #/components/schemas/PackageVersionDependencyPackagistDependencySpecScope targets: description: >- The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. items: $ref: '#/components/schemas/v1Target' type: array version_constraints: title: |- Package version number rules. Example-1: ^1.5.3 || ^2.0 Example-2: ^1.8.1 Example-3: ^2.8.52 || ^3.4.35 || ^4.4 || ^5.0 || ^6.0 type: string required: - name - version_constraints type: object PackageVersionDependencyPypiDependencySpec: description: |- PypiDependencySpec specifies a dependency for Python based repositories or packages. properties: name: title: |- The package name of the python dependency. Example: multidict type: string package_manager_type: $ref: >- #/components/schemas/PackageVersionDependencyPypiDependencySpecPackageManagerType scope_type: $ref: '#/components/schemas/PackageVersionDependencyPypiDependencySpecScope' targets: description: >- The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. items: $ref: '#/components/schemas/v1Target' type: array version_constraints: title: |- Package version number rules. Example-1: ~= 3.2 Example-2: >= 2.0.0, < 3.0.0 Example-3: == 4.7.0 type: string required: - name - version_constraints type: object PackageVersionDependencySwiftDependencySpec: description: SwiftDependencySpec specifies storing a dependency for Swift packages. properties: branch: minLength: 1 type: string exact: minLength: 1 type: string name: minLength: 1 title: |- The name of the Swift package. Example: github.com/Alamofire/Alamofire type: string range: $ref: >- #/components/schemas/PackageVersionDependencySwiftDependencySpecRange revision: minLength: 1 type: string scope: $ref: '#/components/schemas/v1DependencyScope' targets: description: The targets to which this dependency applies. items: $ref: '#/components/schemas/v1Target' type: array required: - name - exact - revision - branch - range type: object ContainerProfileDetailsApplicationType: default: APPLICATION_TYPE_UNSPECIFIED description: >- ApplicationType represents the type of the application. - APPLICATION_TYPE_UNSPECIFIED: Unspecified application type. - APPLICATION_TYPE_CLI: CLI application type. It is typically set when container image does not have any exposed ports. - APPLICATION_TYPE_SERVER: Server application type. It is typically set when container image has exposed ports. enum: - APPLICATION_TYPE_UNSPECIFIED - APPLICATION_TYPE_CLI - APPLICATION_TYPE_SERVER type: string ContainerProfileDetailsProfileType: default: PROFILE_TYPE_UNSPECIFIED description: >- ProfileType represents the type of the profile. - PROFILE_TYPE_UNSPECIFIED: Unspecified profile type. - PROFILE_TYPE_BASIC: Basic profile type. It Indicates that a container image was profiled using a built in profiling mechanism. - PROFILE_TYPE_INSTRUMENTED: Instrumented profile type. It Indicates that a container image was profiled using an instrumented profiling mechanism. enum: - PROFILE_TYPE_UNSPECIFIED - PROFILE_TYPE_BASIC - PROFILE_TYPE_INSTRUMENTED type: string ContainerProfileErrorContainerProfileStatus: default: CONTAINER_PROFILE_STATUS_UNSPECIFIED description: >- ContainerProfileStatus indicates the result of profiling a container image. - CONTAINER_PROFILE_STATUS_UNSPECIFIED: CONTAINER_PROFILE_STATUS_UNSPECIFIED indicates that the container profile status has not been set or is unknown. - CONTAINER_PROFILE_STATUS_PLUGIN_NOT_FOUND: CONTAINER_PROFILE_STATUS_PLUGIN_NOT_FOUND indicates that the Mint toolkit plugin required for profiling the container image was not found. This typically occurs when the profiling environment is misconfigured or the required Mint toolkit plugin is not installed. - CONTAINER_PROFILE_STATUS_TIMEOUT: CONTAINER_PROFILE_STATUS_TIMEOUT indicates that the profiling operation exceeded the allowed time limit. This typically occurs for complex container images that require extensive processing time or when system resources are constrained. - CONTAINER_PROFILE_STATUS_IMAGE_TOO_LARGE: CONTAINER_PROFILE_STATUS_IMAGE_TOO_LARGE indicates that the container image exceeds the maximum allowed size for profiling. This typically occurs when the uncompressed container image size exceeds the system's configured size limit for profiling operations. - CONTAINER_PROFILE_STATUS_IMAGE_NOT_RUNNABLE: CONTAINER_PROFILE_STATUS_IMAGE_NOT_RUNNABLE indicates that the container image cannot be executed without additional configuration. This typically occurs when the container image requires specific environment variables, volumes, network configuration, or entrypoint arguments that were not provided during the profiling attempt. - CONTAINER_PROFILE_STATUS_MINT_PLUGIN_ERROR: CONTAINER_PROFILE_STATUS_MINT_PLUGIN_ERROR indicates that the Mint plugin encountered an error while profiling the container image. This typically occurs when the Mint plugin encounters an unexpected condition, such as incompatible image format, corrupted layers, or internal plugin failures during the profiling process. - CONTAINER_PROFILE_STATUS_ARTIFACTS_NOT_FOUND: CONTAINER_PROFILE_STATUS_ARTIFACTS_NOT_FOUND indicates that the expected profiling artifacts were not found after the profiling operation completed. This typically occurs when the profiling process runs successfully but fails to produce or persist the expected output artifacts, possibly due to storage issues or unexpected container behavior during profiling. - CONTAINER_PROFILE_STATUS_INTERNAL_ERROR: CONTAINER_PROFILE_STATUS_INTERNAL_ERROR indicates that an internal error occurred while profiling the container image. This typically occurs when an unexpected error occurs during the profiling process, such as a programming error or an unexpected system failure. - CONTAINER_PROFILE_STATUS_PLUGIN_SETUP: CONTAINER_PROFILE_STATUS_PLUGIN_SETUP indicates that an error occurred while setting up the Mint toolkit plugin. This typically occurs when there is an error in setting up the Mint toolkit plugin. - CONTAINER_PROFILE_STATUS_PROFILE_LOAD: CONTAINER_PROFILE_STATUS_PROFILE_LOAD indicates that the profiling data was not found or corrupted. Indicates that the profiling is successfully completed but the profiling data was not found or corrupted. It can happen if the creport.json file is not found or corrupted. - CONTAINER_PROFILE_STATUS_MINT_VERSION_INCOMPATIBLE: CONTAINER_PROFILE_STATUS_MINT_VERSION_INCOMPATIBLE indicates that the Mint version is incompatible with the profiling requirements. This typically occurs when the Mint version is not compatible with the profiling requirements. - CONTAINER_PROFILE_STATUS_IMAGE_TYPE_BASE: CONTAINER_PROFILE_STATUS_IMAGE_TYPE_BASE indicates that the container image was identified as a base image (OS distribution or language runtime) and dynamic profiling was skipped because base images contain no application code to profile. enum: - CONTAINER_PROFILE_STATUS_UNSPECIFIED - CONTAINER_PROFILE_STATUS_PLUGIN_NOT_FOUND - CONTAINER_PROFILE_STATUS_TIMEOUT - CONTAINER_PROFILE_STATUS_IMAGE_TOO_LARGE - CONTAINER_PROFILE_STATUS_IMAGE_NOT_RUNNABLE - CONTAINER_PROFILE_STATUS_MINT_PLUGIN_ERROR - CONTAINER_PROFILE_STATUS_ARTIFACTS_NOT_FOUND - CONTAINER_PROFILE_STATUS_INTERNAL_ERROR - CONTAINER_PROFILE_STATUS_PLUGIN_SETUP - CONTAINER_PROFILE_STATUS_PROFILE_LOAD - CONTAINER_PROFILE_STATUS_MINT_VERSION_INCOMPATIBLE - CONTAINER_PROFILE_STATUS_IMAGE_TYPE_BASE type: string v1ContainerImageUpdateOptions: description: >- ContainerImageUpdateOptions groups possible base image update candidates. properties: latest_version: $ref: '#/components/schemas/v1ContainerImageUpdateOption' next_version: $ref: '#/components/schemas/v1ContainerImageUpdateOption' refreshed: $ref: '#/components/schemas/v1ContainerImageUpdateOption' update_time: description: Time when these update options were determined. format: date-time type: string type: object ResolutionStatusErrorAnalysis: description: |- ErrorAnalysis is the analysis of the error based on the error parsing rules. properties: error_category: $ref: '#/components/schemas/SpecErrorCategory' explanation: description: Explanation of the error based on the error parsing rules. type: string fixable: description: Fixable indicates if the error is fixable through configuration. type: boolean fixable_notes: description: notes about the fixable status. type: string matching_rule: description: matching_rule is the rule that matched the error. type: string matching_snippet: description: matching_snippet is the snippet of the error that matched the rule. type: string type: object ResolutionStatusStatusError: default: STATUS_ERROR_UNSPECIFIED description: >- StatusError is the type of issue discovered. - STATUS_ERROR_MANIFEST_LOAD: MANIFEST_LOAD indicates that the system is unable to find the manifest of the language (pom.xml, packages.json, etc). This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_MANIFEST_PARSE: MANIFEST_PARSE indicates that the system failed to parse the manifest. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_MANIFEST_EMPTY: MANIFEST_EMPTY indicates that the system failed to find any dependencies and is returning empty results on purpose. DEPRECATED: use STATUS_ERROR_MANIFEST_PARSE instead. - STATUS_ERROR_DEPENDENCY: DEPENDENCY indicates that the system failed to resolve a dependency. Usually this happens when a manifest contains bad associations of dependencies and versions. This status error is only used for resolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_CALL_GRAPH: CALL_GRAPH indicates that the system failed to construct the call graph. This status error is only used for callgraph computation. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The callgraph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will not be marked as failed, only a warning log will be emitted by the system. For OSS packages: When it happens, the scan of the package version will not be marked as failed, only a warning log will be emitted by the system. - STATUS_ERROR_MISSING_ARTIFACT: MISSING_ARTIFACT indicates that the system failed to compute the callgraph because the package is not built. This status error is only used for callgraph computation. For OSS packages: When it happens, the system will try to build the package and the computation of the callgraph will be launched again. It should be noted that we should never have this state set in a package version. This is a transient state only used by the system. This state can not happen for tenant packages, we always expect that tenant packages will be built for us. - STATUS_ERROR_BUILD: BUILD indicates that the plugin failed to build the package version. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. It should be noted that this state can not happen for tenant packages, we always expect that tenant packages will be built for us. - STATUS_ERROR_PACKAGE_VERSION_UNAVAILABLE: PACKAGE_VERSION_UNAVAILABLE indicates that the package version is not available from the package manager. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For OSS packages:: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. It should be noted that this state can not happen for tenant packages, for tenant we scan based on the source code and we never download a package from a package manager. - STATUS_ERROR_NO_CODE_ARTIFACT: NO_CODE_ARTIFACT indicates that package version do not have any source code. The status error is only used for call graphs. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_VENV: STATUS_ERROR_VENV indicates that the system failed to create the virtual environment required to generate the call graph. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will be not be marked as a call graph failure. This indicates that the client code was not setup correctly. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_INTERNAL: STATUS_ERROR_INTERNAL indicates that there was an internal system failure such as a data stream error. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will be not be marked as a call graph failure. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_UNSUPPORTED: STATUS_ERROR_UNSUPPORTED indicates that we scanned a package version having an unsupported language. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The call graph will not not becomputed by the system. For tenant packages: When it happens, the scan of the package version is marked as unsupported. For OSS packages: When it happens, the scan of the package version is marked as unsupported. enum: - STATUS_ERROR_UNSPECIFIED - STATUS_ERROR_MANIFEST_LOAD - STATUS_ERROR_MANIFEST_PARSE - STATUS_ERROR_MANIFEST_EMPTY - STATUS_ERROR_DEPENDENCY - STATUS_ERROR_CALL_GRAPH - STATUS_ERROR_MISSING_ARTIFACT - STATUS_ERROR_BUILD - STATUS_ERROR_PACKAGE_VERSION_UNAVAILABLE - STATUS_ERROR_NO_CODE_ARTIFACT - STATUS_ERROR_VENV - STATUS_ERROR_INTERNAL - STATUS_ERROR_UNSUPPORTED type: string v1DependencyScope: default: DEPENDENCY_SCOPE_UNSPECIFIED description: |2- - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. enum: - DEPENDENCY_SCOPE_UNSPECIFIED - DEPENDENCY_SCOPE_TEST - DEPENDENCY_SCOPE_BUILD - DEPENDENCY_SCOPE_NORMAL type: string v1ContainerCompositionMetadata: description: >- ContainerCompositionMetadata is the metadata of the composition of a container image. properties: package_type: $ref: '#/components/schemas/v1ContainerPackageType' type: object v1ContainerDependencyLayer: description: ContainerDependency is a dependency of a container image. properties: digest: description: |- The SHA256 digest of the layer, where a dependency is found to be present in the container. type: string file_locations: description: >- The locations of the files in the container, through which the dependency is evident to be present in the container. items: type: string type: array required: - digest type: object PackageVersionDependencyGemDependencySpecScope: default: SCOPE_UNSPECIFIED description: |- Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_DEVELOPMENT: All development and test dependencies. enum: - SCOPE_UNSPECIFIED - SCOPE_NORMAL - SCOPE_DEVELOPMENT type: string PackageVersionDependencyGitHubActionDependencySpecScope: default: SCOPE_UNSPECIFIED description: |- The scope of the GitHub action dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: NORMAL indicates that the GitHub action is being used in prod context. - SCOPE_TEST: TEST indicates that the GitHub action is being used in test context. enum: - SCOPE_UNSPECIFIED - SCOPE_NORMAL - SCOPE_TEST type: string PackageVersionDependencyGoDependencySpecScope: default: SCOPE_UNSPECIFIED enum: - SCOPE_UNSPECIFIED - SCOPE_NORMAL - SCOPE_TEST type: string DependencyImportedType: default: IMPORTED_TYPE_UNSPECIFIED description: |- ImportedType is the state of import. - IMPORTED_TYPE_UNSPECIFIED: UNSPECIFIED is the default state. This state denotes that imported dependency analysis has not been run yet for this dependency. - IMPORTED_TYPE_IN_SOURCE: IN_SOURCE means the imported dependency analysis succeeded and found that the dependency is imported in source. - IMPORTED_TYPE_NOT_IN_SOURCE: NOT_IN_SOURCE means the imported dependency analysis succeeded and found that the dependency is not imported in source. - IMPORTED_TYPE_PHANTOM: PHANTOM means the imported dependency analysis succeeded and found that the dependency is imported only in the source (a phantom dependency). - IMPORTED_TYPE_SEGMENT_MATCH: Dependency was discovered through code segment match. - IMPORTED_TYPE_INSTALLED_IN_USE: Dependency was discovered through installed dependencies and it is in use. enum: - IMPORTED_TYPE_UNSPECIFIED - IMPORTED_TYPE_IN_SOURCE - IMPORTED_TYPE_NOT_IN_SOURCE - IMPORTED_TYPE_PHANTOM - IMPORTED_TYPE_SEGMENT_MATCH - IMPORTED_TYPE_INSTALLED_IN_USE type: string PackageVersionDependencyNpmDependencySpecScope: default: SCOPE_UNSPECIFIED description: |- The scope of the npm dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_DEPENDENCY: DEPENDENCY indicates that the dependency is required for the package to function. - SCOPE_DEV_DEPENDENCY: DEV_DEPENDENCY indicates that the dependency is required for development purposes. - SCOPE_OPTIONAL_DEPENDENCY: OPTIONAL_DEPENDENCY indicates that the dependency is optional. - SCOPE_PEER_DEPENDENCY: PEER_DEPENDENCY indicates that the dependency is Peer. enum: - SCOPE_UNSPECIFIED - SCOPE_DEPENDENCY - SCOPE_DEV_DEPENDENCY - SCOPE_OPTIONAL_DEPENDENCY - SCOPE_PEER_DEPENDENCY type: string PackageVersionDependencyMavenDependencySpecScope: default: SCOPE_UNSPECIFIED description: |2- - SCOPE_UNSPECIFIED: Scope is not set. - SCOPE_COMPILE: Dependency is required at compile time. - SCOPE_PROVIDED: Dependency is provided at runtime by JDK or a container. - SCOPE_RUNTIME: Dependency is required at runtime but not at compile time. - SCOPE_TEST: Dependency is not required at runtime and is only used for test purposes. - SCOPE_SYSTEM: Dependency is provided by the host system. - SCOPE_CUSTOM: Scope is not predefined and is a customized value for certain ecosystems. - SCOPE_VENDORED_CODE: Dependency is provided by source code vendored. - SCOPE_IMPORT: Dependency is imported via pom/abstract dependency. enum: - SCOPE_UNSPECIFIED - SCOPE_COMPILE - SCOPE_PROVIDED - SCOPE_RUNTIME - SCOPE_TEST - SCOPE_SYSTEM - SCOPE_CUSTOM - SCOPE_VENDORED_CODE - SCOPE_IMPORT type: string PackageVersionDependencyPackagistDependencySpecScope: default: SCOPE_UNSPECIFIED description: |- Scope. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: default scope when no other scope is provided. - SCOPE_DEVELOPMENT: all development and test dependencies. enum: - SCOPE_UNSPECIFIED - SCOPE_NORMAL - SCOPE_DEVELOPMENT type: string PackageVersionDependencyPypiDependencySpecScope: default: SCOPE_UNSPECIFIED description: |- Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_OPTIONAL: All optional dependencies and extras related to features, dev, test or any other. enum: - SCOPE_UNSPECIFIED - SCOPE_NORMAL - SCOPE_OPTIONAL type: string v1ContainerRuntimeDependencyFile: description: >- ContainerRuntimeDependencyFile is a file accessed in the container image at runtime. properties: digests: description: Digest of the file. items: $ref: '#/components/schemas/v1Digest' type: array file_type: $ref: '#/components/schemas/v1FileType' path: description: Path of the dependency file as seen in the container image. type: string real_path: description: >- Actual path of the file accessed when a dependency is called at runtime in the container image. type: string type: object CargoDependencySpecDependencyKind: default: DEPENDENCY_KIND_UNSPECIFIED description: |2- - DEPENDENCY_KIND_UNSPECIFIED: Unspecified kind indicates that we are unsure about the type of dependency. - DEPENDENCY_KIND_NORMAL: Normal kind is the default type of dependency. - DEPENDENCY_KIND_DEVELOPMENT: Development kind indicates that the dependency is used for testing purposes. - DEPENDENCY_KIND_BUILD: Build kind indicates that the dependency is solely used for buildingthe package. enum: - DEPENDENCY_KIND_UNSPECIFIED - DEPENDENCY_KIND_NORMAL - DEPENDENCY_KIND_DEVELOPMENT - DEPENDENCY_KIND_BUILD type: string v1Target: properties: exclude: description: Set to true if a dependency is excluded from the target. type: boolean name: description: 'Target name. Example: linux, dotnet, x86_64.' type: string type: $ref: '#/components/schemas/TargetTargetType' version: description: >- Target version, for example, 6.0.0 for the dotnet framework version 6.0.0. If there is no version specified for a target then that means that a dependency is applicable for all versions of that target. This field is optional because few targets, such as CPU_ARCH, do not have a version. type: string required: - type - name - exclude type: object CargoDependencySpecCfg: description: A cfg expression, like cfg(windows). properties: expr: $ref: '#/components/schemas/CfgCfgExpr' required: - expr type: object CargoDependencySpecNamedPlatform: description: A named platform, like x86_64-apple-darwin. properties: name: type: string required: - name type: object CargoDependencySpecCargoVersionReq: description: |- A crate with a matching name and repository can't be bound to a dependency if its version does not match this requirement. properties: major: format: uint64 type: string minor: format: uint64 type: string op: $ref: '#/components/schemas/CargoVersionReqOp' patch: description: / Patch is only allowed if minor is present. format: uint64 type: string pre: type: string required: - op - major type: object GitHubActionDependencySpecGHActionType: default: GH_ACTION_TYPE_UNSPECIFIED description: |- ActionType indicates what type of action is being used. eg. JS action, Docker action, composite action etc. - GH_ACTION_TYPE_UNSPECIFIED: Unspecified when it is unlcear what typeof action it is. - GH_ACTION_TYPE_GITHUB_REPO: Indicates action's source code is hosted in the GitHub repository. - GH_ACTION_TYPE_DOCKER: Indicates action written in Docker and is hosted in the Docker registry. - GH_ACTION_TYPE_INTERNAL: Indicates that action is using logic internal to the organization. it could be referring to another .yaml file or referring another directory which contains code for GitHub action. enum: - GH_ACTION_TYPE_UNSPECIFIED - GH_ACTION_TYPE_GITHUB_REPO - GH_ACTION_TYPE_DOCKER - GH_ACTION_TYPE_INTERNAL type: string PackageVersionDependencyPypiDependencySpecPackageManagerType: default: PACKAGE_MANAGER_TYPE_UNSPECIFIED description: |- Python package manager. - PACKAGE_MANAGER_TYPE_PIP: PIP package manager - PACKAGE_MANAGER_TYPE_PIPENV: PIPENV package manager - PACKAGE_MANAGER_TYPE_POETRY: POETRY package manager - PACKAGE_MANAGER_TYPE_PDM: PDM package manager - PACKAGE_MANAGER_TYPE_UV: UV package manager enum: - PACKAGE_MANAGER_TYPE_UNSPECIFIED - PACKAGE_MANAGER_TYPE_PIP - PACKAGE_MANAGER_TYPE_PIPENV - PACKAGE_MANAGER_TYPE_POETRY - PACKAGE_MANAGER_TYPE_PDM - PACKAGE_MANAGER_TYPE_UV type: string PackageVersionDependencySwiftDependencySpecRange: description: Range represents a version range. properties: lower_bound: minLength: 1 type: string upper_bound: minLength: 1 type: string required: - lower_bound - upper_bound type: object v1ContainerImageUpdateOption: description: >- ContainerImageUpdateOption describes a single base image update candidate. properties: chain_id: description: Chain ID for the candidate image's layers. type: string digest: description: The SHA256 digest of the candidate image (e.g., "sha256:..."). type: string name: description: |- Full image reference including registry, repository, and tag (e.g., "docker.io/library/ubuntu:22.04"). type: string type: object SpecErrorCategory: default: ERROR_CATEGORY_UNSPECIFIED description: The type of error that the rule is for. enum: - ERROR_CATEGORY_UNSPECIFIED - ERROR_CATEGORY_PRIVATE_REGISTRY - ERROR_CATEGORY_TOOLCHAIN - ERROR_CATEGORY_REPOSITORY - ERROR_CATEGORY_OTHER type: string v1ContainerPackageType: default: CONTAINER_PACKAGE_TYPE_UNSPECIFIED description: |- ContainerPackageType is the type of container package. - CONTAINER_PACKAGE_TYPE_UNSPECIFIED: Unspecified container package type. - CONTAINER_PACKAGE_TYPE_LIBRARY: Library container package type. - CONTAINER_PACKAGE_TYPE_APPLICATION: Application container package type. - CONTAINER_PACKAGE_TYPE_APPLICATION_LIBRARY: Application and Library container package type. - CONTAINER_PACKAGE_TYPE_OS_LIBRARY: OS Library container package type. - CONTAINER_PACKAGE_TYPE_OS_APPLICATION: OS Application container package type. - CONTAINER_PACKAGE_TYPE_OS_APPLICATION_LIBRARY: OS Application and Library container package type. enum: - CONTAINER_PACKAGE_TYPE_UNSPECIFIED - CONTAINER_PACKAGE_TYPE_LIBRARY - CONTAINER_PACKAGE_TYPE_APPLICATION - CONTAINER_PACKAGE_TYPE_APPLICATION_LIBRARY - CONTAINER_PACKAGE_TYPE_OS_LIBRARY - CONTAINER_PACKAGE_TYPE_OS_APPLICATION - CONTAINER_PACKAGE_TYPE_OS_APPLICATION_LIBRARY type: string v1Digest: description: Digest is a digest of a file/container image. properties: algorithm: $ref: '#/components/schemas/v1DigestType' value: description: Digest value of the file. type: string required: - algorithm - value type: object v1FileType: default: FILE_TYPE_UNSPECIFIED enum: - FILE_TYPE_UNSPECIFIED - FILE_TYPE_FILE - FILE_TYPE_SYMLINK type: string TargetTargetType: default: TARGET_TYPE_UNSPECIFIED description: |2- - TARGET_TYPE_LANGUAGE: Language target, for example: Go 1.7 or Java 8. - TARGET_TYPE_FRAMEWORK: Framework target, for example: spring boot 2.0 or dotnet 4.6.2. - TARGET_TYPE_OS: OS target, for example: linux, windows, macos. - TARGET_TYPE_CPU_ARCH: CPU architecture target, for example: amd64, arm64, arm. enum: - TARGET_TYPE_UNSPECIFIED - TARGET_TYPE_LANGUAGE - TARGET_TYPE_FRAMEWORK - TARGET_TYPE_OS - TARGET_TYPE_CPU_ARCH type: string CfgCfgExpr: properties: all: $ref: '#/components/schemas/CfgAll' any: $ref: '#/components/schemas/CargoDependencySpecCfgAny' not: $ref: '#/components/schemas/CfgNot' value: $ref: '#/components/schemas/CargoDependencySpecCfgValue' type: object CargoVersionReqOp: default: OP_UNSPECIFIED enum: - OP_UNSPECIFIED - OP_EXACT - OP_GREATER - OP_GREATEREQ - OP_LESS - OP_LESSEQ - OP_TILDE - OP_CARET - OP_WILDCARD type: string v1DigestType: default: DIGEST_TYPE_UNSPECIFIED enum: - DIGEST_TYPE_UNSPECIFIED - DIGEST_TYPE_SHA1 - DIGEST_TYPE_SHA256 - DIGEST_TYPE_SHA512 - DIGEST_TYPE_MD5 type: string CfgAll: properties: expr: items: $ref: '#/components/schemas/CfgCfgExpr' type: array type: object CargoDependencySpecCfgAny: properties: expr: items: $ref: '#/components/schemas/CfgCfgExpr' type: array type: object CfgNot: properties: expr: $ref: '#/components/schemas/CfgCfgExpr' required: - expr type: object CargoDependencySpecCfgValue: properties: name: description: A named cfg value, like unix. type: string pair: $ref: '#/components/schemas/CfgKeyPair' type: object CfgKeyPair: properties: key: type: string value: type: string required: - key - value type: object ````