occurrencesResponse := grafeas.ListOccurrencesResponse{} imageUrl := "https://gcr.io/myproject/name@sha256hash" hasFixableVulnerability := false // Iterate through occurrences looking for vulnerability occurrences for this image for _, occurrence := range occurrencesResponse.Occurrences { resourceUrl := occurrence.ResourceUrl if imageUrl != resourceUrl && occurrence.Kind != grafeas.Note_PACKAGE_VULNERABILITY { continue } details := occurrence.GetVulnerabilityDetails() issues := details.GetPackageIssue() // This vulnerability is fixable, we should not insert an attestation for _, i := range issues { if i.FixedLocation != nil { hasFixableVulnerability = true } } } // If there are no fixable vulnerabilities, create an attestation occurrence if !hasFixableVulnerability { occ := &grafeas.Occurrence{ ResourceUrl: imageUrl, NoteName: "projects/vulnerabilty-certification/notes/vuln-free", Details: &grafeas.Occurrence_AttestationDetails{ AttestationDetails: &grafeas.AttestationAuthority_AttestationDetails{ Signature: &grafeas.AttestationAuthority_AttestationDetails_PgpSignedAttestation{ PgpSignedAttestation: &grafeas.PgpSignedAttestation{ Signature: "MySignature", ContentType: grafeas.PgpSignedAttestation_SIMPLE_SIGNING_JSON, KeyId: "ThisIsMyKeyId", }, }, }, }, } req := grafeas.CreateOccurrenceRequest{Occurrence: occ} }
