建立自訂附註和發生次數

您可以選擇將自己的中繼資料提供給構件分析，以滿足特定業務需求。例如，針對客戶的 Docker 容器提供安全管理服務的機構，可以使用 Artifact Analysis 儲存及擷取映像檔中與安全性相關的中繼資料。

下列步驟說明如何使用 Artifact Analysis API，為映像檔提供認證中繼資料。您可以按照相同的操作說明，儲存及擷取 Artifact Analysis 支援的各種中繼資料。

事前準備

登入 Google Cloud 帳戶。如果您是 Google Cloud新手，歡迎建立帳戶，親自評估產品在實際工作環境中的成效。新客戶還能獲得價值 $300 美元的免費抵免額，可用於執行、測試及部署工作負載。

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

Enable the Container Analysis API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the API

安裝 Google Cloud CLI。

若您採用的是外部識別資訊提供者 (IdP)，請先使用聯合身分登入 gcloud CLI。

執行下列指令，初始化 gcloud CLI：

gcloud init

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

Enable the Container Analysis API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the API

安裝 Google Cloud CLI。

若您採用的是外部識別資訊提供者 (IdP)，請先使用聯合身分登入 gcloud CLI。

執行下列指令，初始化 gcloud CLI：

gcloud init

瞭解如何為專案中的中繼資料設定存取權控管。如果您只使用 Artifact Analysis 容器掃描作業建立的例項中繼資料，請略過這個步驟。

建立專案的附註和例項

本節說明如何建立附註和例項。在本範例中，您將使用 ATTESTATION 種類。

供應商必須在專案中建立每項認證的註記，並在客戶的專案中建立這些認證的例項記錄。

建立附註

請按照下列步驟建立附註並提供附註 ID。

API

建立名為 note.json 的檔案，並在當中加入認證說明和詳細資料。下列程式碼顯示 note.json 檔案範例：

{
  "shortDescription": "A brief Description of the note",
  "longDescription": "A longer description of the note",
  "kind": "ATTESTATION",
  "attestation": {
    "hint": {
      "humanReadableName": "my-attestation-authority"
    }
  }
}

如要進一步瞭解記事的 JSON 表示法，請參閱記事 API 說明文件。

執行下列 curl 指令來建立記事：

curl -v -H "Content-Type: application/json" -H \
  "Authorization: Bearer $(gcloud auth print-access-token)" \
  https://containeranalysis.googleapis.com/v1/projects/PROVIDER_PROJECT_ID/notes?note_id=NOTE_ID -d @note.json

其中：

PROVIDER_PROJECT_ID 是您的專案 ID。
NOTE_ID 會指定附註的 ID。使用長度上限為 100 個字元的字串。

Java

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Java API 參考說明文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱這篇文章，瞭解如何設定本機開發環境的驗證機制。

import com.google.cloud.devtools.containeranalysis.v1.ContainerAnalysisClient;
import io.grafeas.v1.GrafeasClient;
import io.grafeas.v1.Note;
import io.grafeas.v1.ProjectName;
import io.grafeas.v1.Version;
import io.grafeas.v1.AttestationNote;
import java.io.IOException;
import java.lang.InterruptedException;

public class CreateNote {

  // Creates and returns a new Note
  public static Note createNote(String noteId, String projectId)
      throws IOException, InterruptedException {
    // String noteId = "my-note";
    // String projectId = "my-project-id";
    final String projectName = ProjectName.format(projectId);

    Note newNote =
        Note.newBuilder()
            // Associate the Note with the metadata type
            // https://docs.cloud.google.com/artifact-registry/docs/analysis
            // Here, we use the type "attestation"
            .setAttestation(
                AttestationNote.newBuilder()
                    .setHint(
                        AttestationNote.Hint.newBuilder()
                            .setHumanReadableName("my-attestation-authority")))
            .build();

    // Initialize client that will be used to send requests. After completing all of your requests,
    // call the "close" method on the client to safely clean up any remaining background resources.
    GrafeasClient client = ContainerAnalysisClient.create().getGrafeasClient();
    Note result = client.createNote(projectName, noteId, newNote);
    return result;
  }
}

Go

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Go API 參考說明文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱這篇文章，瞭解如何設定本機開發環境的驗證機制。


import (
  "context"
  "fmt"

  containeranalysis "cloud.google.com/go/containeranalysis/apiv1"
  grafeaspb "google.golang.org/genproto/googleapis/grafeas/v1"
)

// createNote creates and returns a new attestation Note.
func createNote(noteID, projectID string) (*grafeaspb.Note, error) {
  ctx := context.Background()
  client, err := containeranalysis.NewClient(ctx)
  if err != nil {
    return nil, fmt.Errorf("NewClient: %w", err)
  }
  defer client.Close()

  projectName := fmt.Sprintf("projects/%s", projectID)

  req := &grafeaspb.CreateNoteRequest{
    Parent: projectName,
    NoteId: noteID,
    Note: &grafeaspb.Note{
      Type: &grafeaspb.Note_Attestation{
        Attestation: &grafeaspb.AttestationNote{
          Hint: &grafeaspb.AttestationNote_Hint{
            HumanReadableName: "my-attestation-authority",
          },
        },
      },
    },
  }

  return client.GetGrafeasClient().CreateNote(ctx, req)
}

Node.js

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Node.js API 參考說明文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱這篇文章，瞭解如何設定本機開發環境的驗證機制。

/**
* TODO(developer): Uncomment these variables before running the sample
*/
// const projectId = 'your-project-id', // Your Google Cloud Project ID
// const noteId = 'my-note-id' // Id of the note

// Import the library and create a client
const {ContainerAnalysisClient} = require('@google-cloud/containeranalysis');
const client = new ContainerAnalysisClient();

// Construct request
// Associate the Note with a metadata type
// https://docs.cloud.google.com/artifact-registry/docs/analysis
// Here, we use the type "attestation"
const formattedParent = client.getGrafeasClient().projectPath(projectId);

// Creates and returns a new Note
const [note] = await client.getGrafeasClient().createNote({
  parent: formattedParent,
  noteId: noteId,
  note: {
    attestation: {
      hint: {
        humanReadableName: 'my-attestation-authority',
      },
    },
  },
});

console.log(`Note ${note.name} created.`);

Ruby

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Ruby API 參考說明文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱這篇文章，瞭解如何設定本機開發環境的驗證機制。

# note_id = "A user-specified identifier for the note"
# project_id = "Your Google Cloud project ID"

require "google/cloud/container_analysis"

# Initialize the client
client = Google::Cloud::ContainerAnalysis.container_analysis.grafeas_client

parent = client.project_path project: project_id
note = {
  attestation: {
    hint: {
      human_readable_name: "attestation-authority"
    }
  }
}
response = client.create_note parent: parent, note_id: note_id, note: note
puts response.name

Python

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Python API 參考說明文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱這篇文章，瞭解如何設定本機開發環境的驗證機制。

from google.cloud.devtools import containeranalysis_v1
from grafeas.grafeas_v1 import types, Version

def create_note(note_id: str, project_id: str) -> types.grafeas.Note:
    """Creates and returns a new attestation note."""
    # note_id = 'my-note'
    # project_id = 'my-gcp-project'

    client = containeranalysis_v1.ContainerAnalysisClient()
    grafeas_client = client.get_grafeas_client()
    project_name = f"projects/{project_id}"
    note = {
      "attestation": {
        "hint": {
          "human_readable_name": "attestation-authority",
        }
      }
    }
    response = grafeas_client.create_note(
        parent=project_name, note_id=note_id, note=note
    )
    return response

為註記建立例項

如何為註記建立例項：

API

建立名為 occurrence.json 的檔案，並在當中加入認證說明和詳細資料。下列程式碼顯示 occurrence.json 檔案範例：

{
  "resourceUri": "your-resource-uri-here",
  "noteName": "projects/your-note-project/notes/your-note-id",
  "kind": "ATTESTATION",
  "attestation": {
    "serializedPayload": "eW91ci1wYXlsb2FkLWhlcmU=",
    "signatures": [
      {
        "publicKeyId": "your-key-id-here",
        "signature": "eW91ci1zaWduYXR1cmUtaGVyZQ=="
      }
    ]
  }
}

如要進一步瞭解記事的 JSON 表示法，請參閱記事 API 說明文件。

執行下列 curl 指令來建立發生事項：

curl -v -H "Content-Type: application/json" -H \
  "Authorization: Bearer $(gcloud auth print-access-token)" \
  https://containeranalysis.googleapis.com/v1/projects/PROVIDER_PROJECT_ID/occurrences/ -d @occurrence.json

其中：

PROVIDER_PROJECT_ID 是您的專案 ID。
NOTE_ID 會指定附註的 ID。使用長度上限為 100 個字元的字串。

Java

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Java API 參考說明文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱這篇文章，瞭解如何設定本機開發環境的驗證機制。

import com.google.cloud.devtools.containeranalysis.v1.ContainerAnalysisClient;
import com.google.protobuf.ByteString;
import io.grafeas.v1.AttestationOccurrence;
import io.grafeas.v1.GrafeasClient;
import io.grafeas.v1.NoteName;
import io.grafeas.v1.Occurrence;
import io.grafeas.v1.ProjectName;
import io.grafeas.v1.Signature;
import java.io.IOException;

public class CreateOccurrence {
  // Creates and returns a new attestation Occurrence associated with an existing Note
  public static Occurrence createOccurrence(
      String resourceUrl, String noteId, String occProjectId, String noteProjectId)
      throws IOException {
    // String resourceUrl = "https://gcr.io/project/image@sha256:123";
    // String noteId = "my-note";
    // String occProjectId = "my-project-id";
    // String noteProjectId = "my-project-id";
    final NoteName noteName = NoteName.of(noteProjectId, noteId);
    final String occProjectName = ProjectName.format(occProjectId);

    Occurrence newOcc =
        Occurrence.newBuilder()
            .setNoteName(noteName.toString())
            .setResourceUri(resourceUrl)
            .setAttestation(
                AttestationOccurrence.newBuilder()
                    .setSerializedPayload(ByteString.copyFrom("your-payload-here", "UTF-8"))
                    .addSignatures(
                        Signature.newBuilder()
                            .setPublicKeyId("your-key-id-here")
                            .setSignature(ByteString.copyFrom("your-signature-here", "UTF-8"))))
            .build();

    // Initialize client that will be used to send requests. After completing all of your requests,
    // call the "close" method on the client to safely clean up any remaining background
    // resources.
    GrafeasClient client = ContainerAnalysisClient.create().getGrafeasClient();
    Occurrence result = client.createOccurrence(occProjectName, newOcc);
    return result;
  }
}

Go

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Go API 參考說明文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱這篇文章，瞭解如何設定本機開發環境的驗證機制。

import (
  "context"
  "fmt"

  containeranalysis "cloud.google.com/go/containeranalysis/apiv1"
  grafeaspb "google.golang.org/genproto/googleapis/grafeas/v1"
)

// createsOccurrence creates and returns a new Occurrence of a previously created attestation note.
  // Use this style of URL when you use Google Artifact Registry.
  // resourceURL := "https://LOCATION-docker.pkg.dev/my-project/my-repo/my-image"
  // noteID := "my-note"
  ctx := context.Background()
  client, err := containeranalysis.NewClient(ctx)
  if err != nil {
    return nil, fmt.Errorf("NewClient: %w", err)
  }
  defer client.Close()

  req := &grafeaspb.CreateOccurrenceRequest{
    Parent: fmt.Sprintf("projects/%s", occProjectID),
    Occurrence: &grafeaspb.Occurrence{
      NoteName: fmt.Sprintf("projects/%s/notes/%s", noteProjectID, noteID),
      // Attach the occurrence to the associated resource uri.
      ResourceUri: resourceURL,
      // Details about the attestation can be added here.
      Details: &grafeaspb.Occurrence_Attestation{
        Attestation: &grafeaspb.AttestationOccurrence{
          SerializedPayload: []byte("..."),
          Signatures: []*grafeaspb.Signature{
            {
              PublicKeyId: "...",
              Signature:   []byte("..."),
            },
          },
        },
      },
    },
  }
  return client.GetGrafeasClient().CreateOccurrence(ctx, req)
}

Node.js

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Node.js API 參考說明文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱這篇文章，瞭解如何設定本機開發環境的驗證機制。

/**
 * TODO(developer): Uncomment these variables before running the sample
 */
// const noteProjectId = 'your-project-id', // Your Google Cloud Project ID
// const noteId = 'my-note-id', // Id of the note
// const occurrenceProjectId = 'your-project-id', // The Google Cloud Project ID of the occurrence
// If you are using Google Artifact Registry
// const imageUrl = 'https://LOCATION-docker.pkg.dev/my-project/my-repo/my-image:123' // Image to attach metadata to

// Import the library and create a client
const {ContainerAnalysisClient} = require('@google-cloud/containeranalysis');
const client = new ContainerAnalysisClient();

// Construct request
const formattedParent = client
.getGrafeasClient()
.projectPath(occurrenceProjectId);
const formattedNote = client
.getGrafeasClient()
.notePath(noteProjectId, noteId);

// Creates and returns a new Occurrence associated with an existing Note
const [occurrence] = await client.getGrafeasClient().createOccurrence({
parent: formattedParent,
occurrence: {
  noteName: formattedNote,
  resourceUri: imageUrl,
  attestation: {
    serializedPayload: Buffer.from('your-payload-here').toString('base64'),
    signatures: [
      {
        publicKeyId: 'your-key-id-here',
        signature: Buffer.from('your-signature-here').toString('base64'),
      },
    ],
  },
},
});
console.log(`Occurrence created ${occurrence.name}.`);
return occurrence;

Ruby

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Ruby API 參考說明文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱這篇文章，瞭解如何設定本機開發環境的驗證機制。

# note_id    = "A user-specified identifier for the note"
# project_id = "Your Google Cloud project ID"
# note_project = "The project that contains the note"
# occurrence_project = "The project that contains the occurrence"

require "google/cloud/container_analysis"
require "base64"

# Initialize the client
client = Google::Cloud::ContainerAnalysis.container_analysis.grafeas_client
note_path = client.note_path project: note_project, note: note_id
project_path = client.project_path project: occurrence_project

occurrence = {
  note_name:    note_path,
  resource_uri: resource_url,
  attestation:  {
    serialized_payload: Base64.encode64("your-payload-here"),
    signatures:         [
      {
        public_key_id: "your-key-id-here",
        signature:     Base64.encode64("your-signature-here")
      }
    ]
  }
}

response = client.create_occurrence parent: project_path, occurrence: occurrence
puts response.name

Python

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Python API 參考說明文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱這篇文章，瞭解如何設定本機開發環境的驗證機制。

import base64
from google.cloud.devtools import containeranalysis_v1
from grafeas.grafeas_v1 import types

def create_occurrence(
    resource_url: str, note_id: str, occurrence_project: str, note_project: str
) -> types.grafeas.Occurrence:
    """Creates and returns a new occurrence of a previously
    created attestation note."""
    # note_id = 'my-note'
    # project_id = 'my-gcp-project'

    client = containeranalysis_v1.ContainerAnalysisClient()
    grafeas_client = client.get_grafeas_client()
    formatted_note = f"projects/{note_project}/notes/{note_id}"
    formatted_project = f"projects/{occurrence_project}"

    occurrence = {
        "note_name": formatted_note,
        "resource_uri": resource_url,
        "attestation": {
            "serialized_payload": base64.b64encode(b"your-payload-here").decode("utf-8"),
            "signatures": [
                {
                    "public_key_id": "your-key-id-here",
                    "signature": base64.b64encode(b"your-signature-here").decode("utf-8"),
                }
            ],
        },
    }

    return grafeas_client.create_occurrence(
        parent=formatted_project, occurrence=occurrence
    )

取得特定註記的所有例項

您可以使用 notes.occurrences.list() 查看客戶專案中特定認證的所有例項。

API

如要列出特定註記的所有例項，請傳送 GET 要求，如下所示：

GET https://containeranalysis.googleapis.com/v1/projects/PROJECT_ID/notes/NOTE_ID/occurrences

如需完整資訊，請參閱 projects.notes.occurrences.list API 端點。

Java

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Java API 參考文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱「為本機開發環境設定驗證機制」。

import static java.lang.Thread.sleep;

import com.google.cloud.devtools.containeranalysis.v1.ContainerAnalysisClient;
import io.grafeas.v1.GrafeasClient;
import io.grafeas.v1.ListNoteOccurrencesRequest;
import io.grafeas.v1.NoteName;
import io.grafeas.v1.Occurrence;
import java.io.IOException;
import java.lang.InterruptedException;

public class OccurrencesForNote {  
  // Retrieves all the Occurrences associated with a specified Note
  // Here, all Occurrences are printed and counted
  public static int getOccurrencesForNote(String noteId, String projectId) 
      throws IOException, InterruptedException {
    // String noteId = "my-note";
    // String projectId = "my-project-id";
    final NoteName noteName = NoteName.of(projectId, noteId);

    ListNoteOccurrencesRequest request = ListNoteOccurrencesRequest.newBuilder()
                                                                   .setName(noteName.toString())
                                                                   .build();

    // Initialize client that will be used to send requests. After completing all of your requests, 
    // call the "close" method on the client to safely clean up any remaining background resources.
    GrafeasClient client = ContainerAnalysisClient.create().getGrafeasClient();
    int i = 0;
    for (Occurrence o : client.listNoteOccurrences(request).iterateAll()) {
      // Write custom code to process each Occurrence here
      System.out.println(o.getName());
      i = i + 1;
    }
    return i;
  }
}

Go

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Go API 參考文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱「為本機開發環境設定驗證機制」。


import (
	"context"
	"fmt"
	"io"

	containeranalysis "cloud.google.com/go/containeranalysis/apiv1"
	"google.golang.org/api/iterator"
	grafeaspb "google.golang.org/genproto/googleapis/grafeas/v1"
)

// getOccurrencesForNote retrieves all the Occurrences associated with a specified Note.
// Here, all Occurrences are printed and counted.
func getOccurrencesForNote(w io.Writer, noteID, projectID string) (int, error) {
	// noteID := fmt.Sprintf("my-note")
	ctx := context.Background()
	client, err := containeranalysis.NewClient(ctx)
	if err != nil {
		return -1, fmt.Errorf("NewClient: %w", err)
	}
	defer client.Close()

	req := &grafeaspb.ListNoteOccurrencesRequest{
		Name: fmt.Sprintf("projects/%s/notes/%s", projectID, noteID),
	}
	it := client.GetGrafeasClient().ListNoteOccurrences(ctx, req)
	count := 0
	for {
		occ, err := it.Next()
		if err == iterator.Done {
			break
		}
		if err != nil {
			return -1, fmt.Errorf("occurrence iteration error: %w", err)
		}
		// Write custom code to process each Occurrence here.
		fmt.Fprintln(w, occ)
		count = count + 1
	}
	return count, nil
}

Node.js

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Node.js API 參考文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱「為本機開發環境設定驗證機制」。

/**
 * TODO(developer): Uncomment these variables before running the sample
 */
// const projectId = 'your-project-id', // Your GCP Project ID
// const noteId = 'my-note-id' // Id of the note

// Import the library and create a client
const {ContainerAnalysisClient} = require('@google-cloud/containeranalysis');
const client = new ContainerAnalysisClient();

// Get path to Note
const formattedNote = client.notePath(projectId, noteId);

// Retrieves all the Occurrences associated with a specified Note
const [occurrences] = await client.getGrafeasClient().listNoteOccurrences({
  name: formattedNote,
});

if (occurrences.length) {
  console.log('Occurrences:');
  occurrences.forEach(occurrence => {
    console.log(`${occurrence.name}:`);
  });
} else {
  console.log('No occurrences found.');
}

Ruby

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Ruby API 參考文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱「為本機開發環境設定驗證機制」。

  # note_id    = "The identifier for the note to query"
  # project_id = "The Google Cloud project ID of the occurrences to retrieve"

  require "google/cloud/container_analysis"

  # Initialize the client
  client = Google::Cloud::ContainerAnalysis.container_analysis.grafeas_client

  name = client.note_path project: project_id, note: note_id
  count = 0
  client.list_note_occurrences(name: name).each do |occurrence|
    # Process occurrence here
    puts occurrence
    count += 1
  end
  puts "Found #{count} occurrences"
  count
end

def get_discovery_info resource_url:, project_id:
  # resource_url = "The URL of the resource associated with the occurrence."
  #                # e.g. https://gcr.io/project/image@sha256:123
  # project_id   = "The Google Cloud project ID of the occurrences to retrieve"

  require "google/cloud/container_analysis"

  # Initialize the client
  client = Google::Cloud::ContainerAnalysis.container_analysis.grafeas_client

  parent = client.project_path project: project_id
  filter = "kind = \"DISCOVERY\" AND resourceUrl = \"#{resource_url}\""
  client.list_occurrences(parent: parent, filter: filter).each do |occurrence|
    # Process discovery occurrence here
    puts occurrence
  end
end

def occurrence_pubsub subscription_id:, timeout_seconds:, project_id:
  # subscription_id = "A user-specified identifier for the new subscription"
  # timeout_seconds = "The number of seconds to listen for new Pub/Sub messages"
  # project_id      = "Your Google Cloud project ID"

  require "google/cloud/pubsub"

  pubsub = Google::Cloud::PubSub.new project_id: project_id
  subscription_admin = pubsub.subscription_admin
  subscription = subscription_admin.create_subscription \
    name: pubsub.subscription_path(subscription_id),
    topic: pubsub.topic_path("container-analysis-occurrences-v1")

  subscriber = pubsub.subscriber subscription.name
  count = 0
  listener = subscriber.listen do |received_message|
    count += 1
    # Process incoming occurrence here
    puts "Message #{count}: #{received_message.data}"
    received_message.acknowledge!
  end

  listener.start
  # Wait for incoming occurrences
  sleep timeout_seconds
  listener.stop.wait!

  subscription_admin.delete_subscription subscription: subscription.name

  # Print and return the total number of Pub/Sub messages received
  puts "Total Messages Received: #{count}"
  count
end

# rubocop:disable Metrics/MethodLength

def poll_discovery_finished resource_url:, timeout_seconds:, project_id:
  # resource_url    = "The URL of the resource associated with the occurrence."
  #                   # e.g. https://gcr.io/project/image@sha256:123
  # timeout_seconds = "The number of seconds to wait for the discovery occurrence"
  # project_id      = "Your Google Cloud project ID"

  require "google/cloud/container_analysis"

  deadline = Time.now + timeout_seconds

  # Initialize the client
  client = Google::Cloud::ContainerAnalysis.container_analysis.grafeas_client
  parent = client.project_path project: project_id

  # Find the discovery occurrence using a filter string
  discovery_occurrence = nil
  while discovery_occurrence.nil?
    begin
      filter = "resourceUrl=\"#{resource_url}\" " \
               'AND noteProjectId="goog-analysis" ' \
               'AND noteId="PACKAGE_VULNERABILITY"'
      # The above filter isn't testable, since it looks for occurrences in a
      # locked down project. Fall back to a more permissive filter for testing
      filter = "kind = \"DISCOVERY\" AND resourceUrl = \"#{resource_url}\""
      # Only the discovery occurrence should be returned for the given filter
      discovery_occurrence = client.list_occurrences(parent: parent, filter: filter).first
    rescue StandardError # If there is an error, keep trying until the deadline
      puts "discovery occurrence not yet found"
    ensure
      # check for timeout
      sleep 1
      raise "Timeout while retrieving discovery occurrence." if Time.now > deadline
    end
  end

  # Wait for the discovery occurrence to enter a terminal state
  status = Grafeas::V1::DiscoveryOccurrence::AnalysisStatus::PENDING
  until [:FINISHED_SUCCESS, :FINISHED_FAILED, :FINISHED_UNSUPPORTED].include? status
    # Update occurrence
    begin
      updated = client.get_occurrence name: discovery_occurrence.name
      status = updated.discovery.analysis_status
    rescue StandardError # If there is an error, keep trying until the deadline
      puts "discovery occurrence not yet in terminal state"
    ensure
      # check for timeout
      sleep 1
      raise "Timeout while retrieving discovery occurrence." if Time.now > deadline
    end
  end
  puts "Found discovery occurrence #{updated.name}."
  puts "Status: #{updated.discovery.analysis_status}"
  updated
end

# rubocop:enable Metrics/MethodLength

def find_vulnerabilities_for_image resource_url:, project_id:
  # resource_url = "The URL of the resource associated with the occurrence
  #                e.g. https://gcr.io/project/image@sha256:123"
  # project_id   = "The Google Cloud project ID of the vulnerabilities to find"

  require "google/cloud/container_analysis"

  # Initialize the client
  client = Google::Cloud::ContainerAnalysis.container_analysis.grafeas_client

  parent = client.project_path project: project_id
  filter = "resourceUrl = \"#{resource_url}\" AND kind = \"VULNERABILITY\""
  client.list_occurrences parent: parent, filter: filter
end

def find_high_severity_vulnerabilities_for_image resource_url:, project_id:
  # resource_url       = "The URL of the resource associated with the occurrence."
  #                      # If you are using Google Container Registry
  #                      # e.g. https://gcr.io/project/repo/image@sha256:123
  #                      # If you are using Google Artifact Registry
  #                      # e.g. https://LOCATION-docker.pkg.dev/project/repo/image@sha256:123
  # project_id   = "The Google Cloud project ID of the vulnerabilities to find"

  require "google/cloud/container_analysis"

  # Initialize the client
  client = Google::Cloud::ContainerAnalysis.container_analysis.grafeas_client

  parent = client.project_path project: project_id
  filter = "resourceUrl = \"#{resource_url}\" AND kind = \"VULNERABILITY\""
  vulnerability_list = client.list_occurrences parent: parent, filter: filter
  # Filter the list to include only "high" and "critical" vulnerabilities
  vulnerability_list.select do |item|
    [:HIGH, :CRITICAL].include? item.vulnerability.effective_severity
  end
end

Python

如要瞭解如何安裝及使用 Artifact Analysis 的用戶端程式庫，請參閱「Artifact Analysis 用戶端程式庫」。詳情請參閱 Artifact Analysis Python API 參考文件。

如要向 Artifact Analysis 進行驗證，請設定應用程式預設憑證。詳情請參閱「為本機開發環境設定驗證機制」。

from google.cloud.devtools import containeranalysis_v1


def get_occurrences_for_note(note_id: str, project_id: str) -> int:
    """Retrieves all the occurrences associated with a specified Note.
    Here, all occurrences are printed and counted."""
    # note_id = 'my-note'
    # project_id = 'my-gcp-project'

    client = containeranalysis_v1.ContainerAnalysisClient()
    grafeas_client = client.get_grafeas_client()
    note_name = f"projects/{project_id}/notes/{note_id}"

    response = grafeas_client.list_note_occurrences(name=note_name)
    count = 0
    for o in response:
        # do something with the retrieved occurrence
        # in this sample, we will simply count each one
        count += 1
    return count

後續步驟

如要瞭解如何查看及篩選容器映像檔的註記和例項，請參閱查看安全漏洞例項。
如需設定通知的操作說明，請參閱「Pub/Sub 通知」。

建立自訂附註和發生次數 透過集合功能整理內容 你可以依據偏好儲存及分類內容。

事前準備

建立專案的附註和例項

建立附註

API

Java

Go

Node.js

Ruby

Python

為註記建立例項

API

Java

Go

Node.js

Ruby

Python

取得特定註記的所有例項

API

Java

Go

Node.js

Ruby

Python

後續步驟

建立自訂附註和發生次數