An indication that the compliance checks in the associated ComplianceNote were not satisfied for particular resources or a specified reason.

Deprecated. Prefer to use a regular Occurrence, and populate the Envelope at the top level of the Occurrence.

Details of the derived image portion of the DockerImage relationship. This image would be produced from a Dockerfile with FROM .

Provides information about the analysis status of a discovered resource.

An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). For Windows, both distribution and windows_update contain information for the Windows update.

The occurrence representing an SBOM reference as applied to a specific resource. The occurrence follows the DSSE specification. See https://github.com/secure-systems-lab/dsse/blob/master/envelope.md for more details.

Details of a build occurrence.

An occurrence of a severity vulnerability on a resource.

The period during which some deployable was active in a runtime.

AISkillAnalysisOccurrence provides the results of an AI-based skill analysis.

The occurrence provides details of a secret.

Details on how a particular software package was installed on a system.

Occurrence that represents a single "attestation". The authenticity of an attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the authority to which this attestation is attached is primarily useful for lookup (how to find this attestation if you already know the authority and artifact to be verified) and intent (for which authority this attestation was intended to sign.

MUST match https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An authenticated message of arbitrary type.