
    \\                        S r SSKJr  SSKJr  SSKJr  SSKrSSKrSSKJr  SSKJ	r
  SSKJr  SS	KJr  SSKr " S
 S5      r " S S5      r " S S5      r " S S5      r " S S5      r " S S5      r " S S5      r " S S5      r " S S5      r " S S5      r " S S5      r " S  S!5      r " S" S#5      rS$ rS% rS& rS' r S( r!S) r"S* r#S+ r$S, r%S- r&S. r'S/ r(g)0z3Utility for interacting with containeranalysis API.    )absolute_import)division)unicode_literalsN)filter_util)requests)
enable_api)
exceptionsc                   @    \ rS rSrSrS rSS jrS rS rS r	S r
S	rg
)ContainerAnalysisMetadata   zSContainerAnalysisMetadata defines metadata retrieved from containeranalysis API.
  c                 l   [        5       U l        [        5       U l        [	        5       U l        [        5       U l        [        5       U l	        [        5       U l        [        5       U l        [        5       U l        [!        5       U l        [%        5       U l        [)        5       U l        [-        5       U l        g N)PackageVulnerabilitySummaryvulnerabilityImageBasisSummaryimageDiscoverySummary	discoveryDeploymentSummary
deploymentBuildSummarybuildProvenanceSummary
provenancePackageSummarypackageAttestationSummaryattestationUpgradeSummaryupgradeComplianceSummary
complianceDsseAttestaionSummarydsse_attestationSbomReferenceSummarysbom_referenceselfs    Blib/googlecloudsdk/command_lib/artifacts/containeranalysis_util.py__init__"ContainerAnalysisMetadata.__init__#   s}    46D"$DJ%'DN')DODJ')DO!#DL)+D!#DL')DO13D.0D    c                 Z   [         R                  " 5       nUR                  UR                  R                  R
                  :X  a  U R                  R                  U5        GO0UR                  UR                  R                  R                  :X  a  U R                  R                  U5        GOUR                  UR                  R                  R                  :X  a  U R                  R                  U5        GOUR                  UR                  R                  R                  :X  a  U R                  R                  U5        GOOUR                  UR                  R                  R                  :X  a  U R                  R                  U5        GOUR                  UR                  R                  R                   :X  ad  UR"                  (       aS  UR"                  R$                  (       d  UR"                  R&                  (       a  U R                  R                  U5        GOrUR                  UR                  R                  R(                  :X  a  U R*                  R                  U5        GO'UR                  UR                  R                  R,                  :X  a  U R.                  R                  U5        OUR                  UR                  R                  R0                  :X  a  U R2                  R                  U5        OUR                  UR                  R                  R4                  :X  a  U R6                  R                  U5        OIUR                  UR                  R                  R8                  :X  a  U R:                  R                  U5        UR                  UR                  R                  R                  :X  a  U R<                  R                  U5        UR                  UR                  R                  R                   :X  a$  U(       a  U R"                  R                  U5        ggg)a  Adds occurrences retrieved from containeranalysis API.

Generally we have a 1-1 correspondence between type and summary it's added
to. The exceptions (due to backwards compatibility issues) are:
BUILD: If you pass in --show-provenance, there will be a provenance
section (for intoto builds) but no build section. If you pass in
--show-all-metadata or --show-build-details, there will be a provenance
section (for intoto builds) and a builds section (for every build). That
does mean an occurrence may be in both provenance_summary and build_summary.
DSSE_ATTESTATION: We always return it in both the DSSE_ATTESTATION section
and the provenance section.

Args:
  occ: the occurrence retrieved from the API.
  include_build: whether build-kind occurrences should be added to build.
N)ca_requestsGetMessageskind
OccurrenceKindValueValuesEnumVULNERABILITYr   AddOccurrenceIMAGEr   
DEPLOYMENTr   	DISCOVERYr   DSSE_ATTESTATIONr   BUILDr   intotoStatementinTotoSlsaProvenanceV1PACKAGEr   ATTESTATIONr   UPGRADEr    
COMPLIANCEr"   SBOM_REFERENCEr&   r$   )r(   occinclude_buildmessagess       r)   r4   'ContainerAnalysisMetadata.AddOccurrence1   s   " &&(H
xx8&&::HHH
&&s+	X((<<BB	B
jjs#	X((<<GG	G
oo##C(	X((<<FF	F
nn""3'	X((<<MM	M
oo##C(H'';;AAAIIYY&&#))*J*J
oo##C(	X((<<DD	D
ll  %	X((<<HH	H
$$S)	X((<<DD	D
ll  %	X((<<GG	G
oo##C(	X((<<KK	K
'', xx8&&::KKK
))#. 	H'';;AAA
jjs#  	Br,   c                 l   0 nU R                   R                  (       a  U R                   R                  US'   U R                  R                  (       a  U R                  R                  US'   U R                  R                  (       a  U R                  R                  US'   U R
                  R                  (       a  U R
                  R                  US'   U R                  R                  (       a  U R                  R                  US'   U R                  R                  (       a  U R                  R                  US'   U R                  R                  (       a  U R                  R                  US'   U R                  R                  (       a  U R                  R                  US'   U R                  R                   (       a  U R                  R                   US	'   U R"                  R$                  (       a  U R"                  R$                  US
'   UR'                  U R(                  R+                  5       5        U$ )zzReturns a dictionary representing the metadata.

The returned dictionary is used by artifacts docker images list command.
r5   r6   r7   r9   r<   r=   r>   r?   r8   r@   )r   base_imagesr   deploymentsr   r   build_detailsr   packagesr   attestationsr    upgradesr"   compliancesr$   dsse_attestationsr&   sbom_referencesupdater   ImagesListView)r(   views     r)   rP   (ContainerAnalysisMetadata.ImagesListViewi   s}   
 Dzzjj,,d7m""??66d<~~..22d;zzjj..d7m||--d9o$$ ,,99d=||--d9o""??66d<..!%!6!6!H!Hd**#22BBdKK""1134Kr,   c                    0 nU R                   R                  (       a  U R                   US'   U R                  R                  (       a  U R                  US'   U R                  R                  (       a  U R                  US'   U R
                  R                  (       a  U R
                  US'   U R                  R                  5       nU(       a  X!S'   U R                  R                  (       a  U R                  US'   U R                  R                  (       a  U R                  US'   U R                  R                  (       a  U R                  US'   U R                  R                  (       a  U R                  US	'   U R                   R"                  (       a  U R                   US
'   U R$                  R&                  (       a  U R$                  US'   U R(                  R*                  (       a  U R(                  US'   U$ )z~Returns a dictionary representing the metadata.

The returned dictionary is used by artifacts docker images describe command.
image_basis_summarydeployment_summarydiscovery_summarybuild_details_summarypackage_vulnerability_summaryprovenance_summarypackage_summaryattestation_summaryupgrade_summarycompliance_summarydsse_attestation_summarysbom_summary)r   rF   r   rG   r   r   rH   r   ArtifactsDescribeViewr   r   rI   r   rJ   r    rK   r"   rL   r$   rM   r&   rN   )r(   rQ   vulns      r)   r`   /ContainerAnalysisMetadata.ArtifactsDescribeView   sm   
 Dzz$(JJd !""#'??d ~~"&..dzz&*jjd"#335D.2*+!!#'??d || $d$$$($4$4d !|| $d""#'??d ..)-)>)>d%&**!00d>Kr,   c                 x    U R                   R                   (       a  [        U R                   R                   5      $ g)z(Returns SLSA build level 0-3 or unknown.unknown)r   _ComputeSLSABuildLevelr'   s    r)   SLSABuildLevel(ContainerAnalysisMetadata.SLSABuildLevel   s'    !!#DOO$>$>??r,   c                     U R                   R                   Vs/ s H-  nUR                  R                  R                  R
                  PM/     sn$ s  snf r   )r&   rN   sbomReferencepayload	predicatelocation)r(   sbom_refs     r)   SbomLocations'ContainerAnalysisMetadata.SbomLocations   sM     ++;;;H 	&&0099;  s   4A)r   r   r"   r   r   r$   r   r   r   r&   r    r   N)T)__name__
__module____qualname____firstlineno____doc__r*   r4   rP   r`   rf   rn   __static_attributes__ r,   r)   r   r      s'    16$p:Br,   r   c                   <    \ rS rSrSrS rS rS rS rS r	S r
S	rg
)r      zDPackageVulnerabilitySummary holds package vulnerability information.c                      0 U l         / U l        g r   )vulnerabilitiescountsr'   s    r)   r*   $PackageVulnerabilitySummary.__init__   s    DDKr,   c                     [         R                  " UR                  R                  5      nU R                  R                  U/ 5      R                  U5        g r   )six	text_typer   effectiveSeverityrz   
setdefaultappend)r(   rA   sevs      r)   r4   )PackageVulnerabilitySummary.AddOccurrence   s=    
--));;
<C##C,33C8r,   c                 B    U =R                   UR                   -  sl         g r   )r{   )r(   summarys     r)   
AddSummary&PackageVulnerabilitySummary.AddSummary   s    KK7>>!Kr,   c                 :    U R                   R                  U5        g r   )r{   r   )r(   counts     r)   AddCount$PackageVulnerabilitySummary.AddCount   s    KKur,   c                 R   [         R                  " 5       n0 nU R                  (       a  U R                  US'   U R                   H_  nUR                  UR
                  R                  R                  :X  d  M3  UR                  UR                  -
  US'   UR                  US'     U$    U$ )zReturns a dictionary representing package vulnerability metadata.

The returned dictionary is used by artifacts docker images describe command.
rz   not_fixed_vulnerability_counttotal_vulnerability_count)
r.   r/   rz   r{   severityFixableTotalByDigestSeverityValueValuesEnumSEVERITY_UNSPECIFIED
totalCountfixableCount)r(   rC   rQ   r   s       r)   r`   1PackageVulnerabilitySummary.ArtifactsDescribeView   s    
 &&(HD $ 4 4d
..H99""#7#78 u111 	,-,1,<,<()K  Kr,   c                    [         R                  " 5       n0 nU R                  (       a  U R                  US'   0 nU R                   Hl  nUR                  nU(       d  M  XQR
                  R                  R                  :w  d  M=  UR                  XSR                  US5      UR                  -   05        Mn     U(       a  X2S'   U$ )zReturns a dictionary representing package vulnerability metadata.

The returned dictionary is used by artifacts docker images list command.
PACKAGE_VULNERABILITYr   vuln_counts)r.   r/   rz   r{   r   r   r   r   rO   getr   )r(   rC   rQ   r   r   r   s         r)   rP   *PackageVulnerabilitySummary.ImagesListView   s    
 &&(HD&*&:&:d"#KNNc
##66NN Ca!85;K;K!KLM  '=Kr,   )r{   rz   N)rp   rq   rr   rs   rt   r*   r4   r   r   r`   rP   ru   rv   r,   r)   r   r      s#    L9"&r,   r   c                   $    \ rS rSrSrS rS rSrg)r      z0ImageBasisSummary holds image basis information.c                     / U l         g r   rF   r'   s    r)   r*   ImageBasisSummary.__init__   
    Dr,   c                 :    U R                   R                  U5        g r   )rF   r   r(   rA   s     r)   r4   ImageBasisSummary.AddOccurrence       C r,   r   Nrp   rq   rr   rs   rt   r*   r4   ru   rv   r,   r)   r   r      s    8!r,   r   c                   $    \ rS rSrSrS rS rSrg)r      z+BuildSummary holds image build information.c                     / U l         g r   rH   r'   s    r)   r*   BuildSummary.__init__   s
    Dr,   c                 :    U R                   R                  U5        g r   )rH   r   r   s     r)   r4   BuildSummary.AddOccurrence   s    c"r,   r   Nr   rv   r,   r)   r   r      s    3#r,   r   c                   $    \ rS rSrSrS rS rSrg)r   i  z5DeploymentSummary holds image deployment information.c                     / U l         g r   rG   r'   s    r)   r*   DeploymentSummary.__init__  r   r,   c                 :    U R                   R                  U5        g r   )rG   r   r   s     r)   r4   DeploymentSummary.AddOccurrence  r   r,   r   Nr   rv   r,   r)   r   r         =!r,   r   c                   $    \ rS rSrSrS rS rSrg)r   i  zADiscoverySummary holds image vulnerability discovery information.c                     / U l         g r   r   r'   s    r)   r*   DiscoverySummary.__init__  s	    DNr,   c                 :    U R                   R                  U5        g r   )r   r   r   s     r)   r4   DiscoverySummary.AddOccurrence  s    NN#r,   r   Nr   rv   r,   r)   r   r     s    Ir,   r   c                   $    \ rS rSrSrS rS rSrg)r   i  z5ProvenanceSummary holds image provenance information.c                     / U l         g r   r   r'   s    r)   r*   ProvenanceSummary.__init__  s	    DOr,   c                 :    U R                   R                  U5        g r   )r   r   r   s     r)   r4   ProvenanceSummary.AddOccurrence  s    OO3r,   r   Nr   rv   r,   r)   r   r     s    = r,   r   c                   $    \ rS rSrSrS rS rSrg)r   i  z/PackageSummary holds image package information.c                     / U l         g r   rI   r'   s    r)   r*   PackageSummary.__init__"  	    DMr,   c                 :    U R                   R                  U5        g r   )rI   r   r   s     r)   r4   PackageSummary.AddOccurrence%      MMr,   r   Nr   rv   r,   r)   r   r         7r,   r   c                   $    \ rS rSrSrS rS rSrg)r   i)  z7AttestationSummary holds image attestation information.c                     / U l         g r   rJ   r'   s    r)   r*   AttestationSummary.__init__,  s
    Dr,   c                 :    U R                   R                  U5        g r   )rJ   r   r   s     r)   r4    AttestationSummary.AddOccurrence/  s    S!r,   r   Nr   rv   r,   r)   r   r   )  s    ?"r,   r   c                   $    \ rS rSrSrS rS rSrg)r   i3  z/UpgradeSummary holds image upgrade information.c                     / U l         g r   rK   r'   s    r)   r*   UpgradeSummary.__init__6  r   r,   c                 :    U R                   R                  U5        g r   )rK   r   r   s     r)   r4   UpgradeSummary.AddOccurrence9  r   r,   r   Nr   rv   r,   r)   r   r   3  r   r,   r   c                   $    \ rS rSrSrS rS rSrg)r!   i=  z5ComplianceSummary holds image compliance information.c                     / U l         g r   rL   r'   s    r)   r*   ComplianceSummary.__init__@  r   r,   c                 :    U R                   R                  U5        g r   )rL   r   r   s     r)   r4   ComplianceSummary.AddOccurrenceC  r   r,   r   Nr   rv   r,   r)   r!   r!   =  r   r,   r!   c                   $    \ rS rSrSrS rS rSrg)r#   iG  z?DsseAttestaionSummary holds image dsse_attestation information.c                     / U l         g r   rM   r'   s    r)   r*   DsseAttestaionSummary.__init__J  s
    Dr,   c                 :    U R                   R                  U5        g r   )rM   r   r   s     r)   r4   #DsseAttestaionSummary.AddOccurrenceM  s    !!#&r,   r   Nr   rv   r,   r)   r#   r#   G  s    G 'r,   r#   c                   $    \ rS rSrSrS rS rSrg)r%   iQ  z<SbomReferenceSummary holds image SBOM reference information.c                     / U l         g r   rN   r'   s    r)   r*   SbomReferenceSummary.__init__T  s
    Dr,   c                 :    U R                   R                  U5        g r   )rN   r   r   s     r)   r4   "SbomReferenceSummary.AddOccurrenceW  s    $r,   r   Nr   rv   r,   r)   r%   r%   Q  s    D%r,   r%   c                    [        5       nSR                  U R                  5       5      U R                  5       /n[        X15      nUc  U$ [        R
                  " U R                  U5      nUR                  =(       d    UR                  =(       d    UR                  nU H  nUR                  Xv5        M     UR                  R                  (       al  [        R                  " U R                  [        R                  " 5       R!                  U5      R#                  5       5      nUR                  R%                  U5        U$ )z&Retrieves metadata for a docker image.
https://{})r   formatGetDockerString#_CreateFilterFromImagesDescribeArgsr.   ListOccurrencesprojectshow_build_detailsshow_all_metadatametadata_filterr4   r   rz   GetVulnerabilitySummaryr   ContainerAnalysisFilterWithResources	GetFilterr   )	docker_versionargsmetadatadocker_urls
occ_filteroccurrencesrB   rA   vuln_summarys	            r)   GetContainerAnalysisMetadatar   [  s   &((.88:;$$&+ 3;E*O++N,B,BJO+
O!7!7O4;O;O  c3.  ++66++-;;	"&L %%l3	/r,   c                    [        5       n [        R                  " U R                  S5      nU(       d  U$ SR                  U R                  5       5      U R                  5       /n[        U5      n[        R                  " U R                  U5      nU H  nUR                  US5        M     U$ ! [        R
                   a    Sn Nf = f)a  Retrieves build and SBOM metadata for a docker image.

This function is used only for SLSA build level computation and retrieving
SBOM locations. If the containeranalysis API is disabled for the project, no
request will be sent and it returns empty metadata resulting in 'unknown' SLSA
level.

Args:
  docker_version: docker info about image and project.

Returns:
  The build and SBOM metadata for the given image.
z containeranalysis.googleapis.comFr   )r   r   IsServiceEnabledr   serviceusage_exceptions#GetServicePermissionDeniedExceptionr   r   '_CreateFilterForImageSummaryOccurrencesr.   r   r4   )r   r   
ca_enabledr   r   r   rA   s          r)   GetImageSummaryMetadatar  u  s     '((,, BJ 
O .88:;$$&+ 7{C*++N,B,BJO+c3&  
/! 
!	D	D Js   !B. .CCc                     [        5       n[        U5      n[        R                  " X5      nU H  nUR	                  US5        M     U$ )z*Retrieves occurrences for Maven artifacts.F)r   _CreateFilterForMavenr.   r   r4   )r   artifact_resourcer   r   r   rA   s         r)   GetArtifactOccurrencesr    sF    &(($%67*++G@+c3&  
/r,   c                 2   [         R                  " [        5      nSR                  U R	                  5       5      U R	                  5       /nX" Vs/ s H  nSR                  U5      PM     sn-   n[        XAU5      n[        R                  " U R                  U5      nU H6  n	UR                  U	R                  [        5       5      R                  U	5        M8     [        R                  " 5       R                  U5      R                  U5      R!                  5       n
[        R"                  " U R                  U
5      nU HS  nUR$                   H@  nUR                  UR                  [        5       5      R&                  R)                  U5        MB     MU     U$ s  snf )a  Retrieves metadata for all images with a given path prefix.

The prefix may initially be used to resolve to a list of images if
--show-occurrences-from is used.
To account for cases where there is or isn't a list of images,
this always filters on both prefix and the list of images. In both of
those cases, the lookup is for both the case where there is and isn't
an https prefix, in both the prefixes and in the images list.

Args:
  repo_or_image: The repository originally given by the user.
  occurrence_filter: The repository originally given by the user.
  images: The list of images that matched the prefix, without https prepended.

Returns:
  The metadata about the given images.
r   )collectionsdefaultdictr   r   r   _CreateFilterForImagesr.   ListOccurrencesWithFiltersr   r   resourceUrir4   r   r   WithResourcePrefixesr   GetChunkifiedFilters"GetVulnerabilitySummaryWithFiltersr{   r   r   )repo_or_imageoccurrence_filterimagesr   prefixesimg
image_urlsocc_filtersr   rA   summary_filters	summariesr   r   s                 r)   %GetContainerAnalysisMetadataForImagesr    sY   & $$%>?(-779:##%( VDVc,,S1VDD*&xJO+66}7L7L7BD+c1355B]35G   779NNj)*>*>*@ <<_.)g



#
%''4}XXe_    
/% Es   Fc                     [         R                  " 5       nSS/nUR                  U5        UR                  U /5        UR	                  5       $ )z>Builds filters for containeranalysis APIs for Maven Artifacts.r3   r7   r   r   	WithKindsr   r   )maven_resourcer   filter_kindss      r)   r  r    sH    224*!;/,|$N+,				r,   c                     [         R                  " 5       nSS/nUR                  U5        UR                  U 5        UR	                  5       $ )zIBuilds filters for containeranalysis APIs for build and SBOM occurrences.r9   r@   r  )r  r   r   s      r)   r  r    sF    224*+,,|$6"				r,   c                    [         R                  " 5       n/ nUR                  (       Gd  UR                  (       a  UR	                  S5        UR
                  (       a"  UR	                  S5        UR	                  S5        UR                  (       a  UR	                  S5        UR                  (       a  UR	                  S5        UR                  (       a"  UR	                  S5        UR	                  S5        UR                  (       a  UR	                  S5        U(       d  UR                  (       d  gUR                  U5        UR                  UR                  5        UR                  U 5        UR                  5       $ )	a  Parses `docker images describe` arguments into a filter to send to containeranalysis API.

The returned filter will combine the user-provided filter specified by
the --metadata-filter flag and occurrence kind filters specified by flags
such as --show-package-vulnerability.

Returns None if there is no information to fetch from containeranalysis API.

Args:
  images: list, the fully-qualified path of docker images.
  args: user provided command line arguments.

Returns:
  A filter string to send to the containeranalysis API.

For example, given a user input:
gcloud docker images describe \
  us-west1-docker.pkg.dev/my-project/my-repo/ubuntu@sha256:abc \
  --show-package-vulnerability \
  --show-image-basis \
  --metadata-filter='createTime>"2019-04-10T"'

this method will create a filter:

'''
((kind="VULNERABILITY") OR (kind="IMAGE")) AND
(createTime>"2019-04-10T") AND
(resourceUrl=us-west1-docker.pkg.dev/my-project/my-repo/ubuntu@sha256:abc' OR
resourceUrl=https://us-west1-docker.pkg.dev/my-project/my-repo/ubuntu@sha256:abc'))
'''
r9   r3   r7   r5   r6   r8   r@   N)r   r   r   r   r   show_package_vulnerabilityshow_image_basisshow_deploymentshow_provenanceshow_sbom_referencesr   r  WithCustomFilterr   r   )r  r   r   r   s       r)   r   r     s   B 224*,				'"&&/*+&'",',-'"  *+
  4 4|$d2236"				r,   c                     [         R                  " 5       nUR                  U 5        UR                  U5        UR	                  U5        UR                  5       $ )a  Creates a list of filters from a docker image prefix, a custom filter and fully-qualified image URLs.

Args:
  prefixes: URL prefixes. Only metadata of images with any of these prefixes
    will be retrieved.
  custom_filter: user provided filter string.
  images: fully-qualified docker image URLs. Only metadata of these images
    will be retrieved.

Returns:
  A filter string to send to the containeranalysis API.
)r   r   r  r   r(  r  )r  custom_filterr  r   s       r)   r  r  +  sK     224*!!(+6"m,		(	(	**r,   c                    U (       d  gSnU  Vs/ s H4  o"R                   (       d  M  UR                   R                  (       d  M2  UPM6     nnU H  nUR                   R                  nUR                  (       d  M,  UR                  R                  (       d  MI  UR                  R                  R                  (       d  Mp  UR                  R                  R                  R
                  (       d  M  UR                  R                  R                  R
                  U:X  d  M    g   U  Vs/ s H4  o"R                   (       d  M  UR                   R                  (       d  M2  UPM6     nnU(       d  gUS   n U R                   R                  n[        U5      (       a#  [        U 5      (       a  [        U5      (       a  ggggs  snf s  snf )am  Computes SLSA build level from a build provenance.

Determines SLSA Level based on a list of occurrences,
preferring data from SLSA v1.0 occurrences over others.

Args:
  provenance: build provenance list containing build occurrences.

Returns:
  A string `unknown` if build provenance doesn't exist, otherwise
  an integer from 0 to 3 indicating SLSA build level.
rd   4https://cloudbuild.googleapis.com/GoogleHostedWorker   r         )
r   r;   rk   
runDetailsbuilderidr:   	_HasSteps_HasValidKey_HasLevel3BuildVersion)r   builder_id_v1p	builds_v1build_v1provenance_v1builds_v0_1intotos           r)   re   re   ?  s[    
H-Awwa177+I+Ia   hNN99M 	##...##..666##..66999##..6699]J   Awwa177+B+Ba   
1~*++&vJ		'	'	
A$s"   F;F;F;'G ?G G c                    U (       a  [        U S5      (       a  [        U R                  S5      (       a  [        U R                  R                  S5      (       ak  [        U R                  R                  R                  S5      (       a<  U R                  R                  R                  R                  n[        S U 5       5      $ g)zCheck whether a build provenance contains build steps.

Args:
  intoto: intoto statement in build occurrence.

Returns:
  A boolean value indicating whether intoto contains build steps.
slsaProvenancerecipe	argumentsadditionalPropertiesc              3   d   #    U  H&  oR                   S :H  =(       a    UR                  v   M(     g7f)stepsN)keyvalue).0r7  s     r)   	<genexpr>_HasSteps.<locals>.<genexpr>  s#     @Zuu+AGG+Zs   .0F)hasattrr>  r?  r@  rA  any)r<  
propertiess     r)   r3  r3  s  s     
&*
+
+
&''
2
2
&''..
<
<




&
&
0
02H  &&--77LLJ@Z@@@	r,   c                    ^ U (       av  [        U S5      (       ae  [        U R                  S5      (       aJ  U R                  R                  (       a/  SmU4S jn[        XR                  R                  5      nU(       a  gg)zCheck whether a build provenance contains valid signature and key id.

Args:
  build: container analysis build occurrence.

Returns:
  A boolean value indicating whether build occurrence contains valid signature
  and key id.
envelope
signatureszd^projects/verified-builder/locations/.+/keyRings/attestor/cryptoKeys/builtByGCB/cryptoKeyVersions/1$c                    > [        U S5      =(       aG    U R                  =(       a4    [        U S5      =(       a!    [        R                  " TU R                  5      $ )Nsigkeyid)rI  rP  rematchrQ  )	signaturekey_id_patterns    r)   CheckSignature$_HasValidKey.<locals>.CheckSignature  sF    i' 8mm8i)8 hh~y79r,   TF)rI  rM  rN  filter)r   rV  filteredrU  s      @r)   r4  r4    s\     
%
$
$
%..,
/
/
..
#
#{N9
 nnn&?&?@H	r,   c                    U (       a  [        U S5      (       a  [        U R                  S5      (       a  [        U R                  R                  S5      (       a  U R                  R                  R                  (       at  U R                  R                  R                  R	                  S5      u  pUS:X  a=  U(       a6  UR	                  S5      u  p4[        U5      S:  =(       d    [        U5      S:  $ g	)
zCheck whether a build provenance contains level 3 build version.

Args:
  intoto: intoto statement in build occurrence.

Returns:
  A boolean value indicating whether intoto contains level 3 build version.
r>  r1  r2  z@vr,  .r   r-  F)rI  r>  r1  r2  splitint)r<  uriversionmajor_versionminor_versions        r)   r5  r5    s     
&*
+
+
&''
3
3
&''//
6
6



'
'
*
***2255;;DANSEE'.}}S'9$}!#>s='9Q'>>	r,   ))rt   
__future__r   r   r   r
  rR  (googlecloudsdk.api_lib.containeranalysisr   r   r.   googlecloudsdk.api_lib.servicesr   r	   r   r~   r   r   r   r   r   r   r   r   r   r   r!   r#   r%   r   r  r  r  r  r  r   r  re   r3  r4  r5  rv   r,   r)   <module>re     s    : &  '  	 @ L 6 Q 
R Rj6 6r! !# #! !     " " ! !' '% %4#L
*Z  = @+(1h.:r,   