capabilities

package
v0.1.131 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 16, 2026 License: Apache-2.0 Imports: 19 Imported by: 0

Documentation

Overview

Package capabilities contains the proto enum with our IAM capabilities.

Index

Examples

Constants

This section is empty.

Variables

View Source 
var (
	Capability_name = map[int32]string{}/* 186 elements not displayed */

	Capability_value = map[string]int32{}/* 186 elements not displayed */

)

Enum value maps for Capability.

View Source 
var (
	// This decorates our capability enumeration values with
	// the friendly name to show to humans.
	//
	// optional string name = 189350643;
	E_Name = &file_capabilities_proto_extTypes[0]
	// This decorates our capability enumeration values with
	// a bit index enabling compacted encodings.
	//
	// optional uint32 bit = 20221109;
	E_Bit = &file_capabilities_proto_extTypes[1]
	// This decorates our capability enumeration values with a marker denoting the
	// capability as internal only: it can never be granted by a role available to
	// customer organisations. Roles which contain internal only capabilities must
	// have `CAP_INTERNAL` set. Role creation/updating will fail if this is
	// violated.
	//
	// optional bool internal_only = 189350644;
	E_InternalOnly = &file_capabilities_proto_extTypes[2]
)

Extension fields to descriptorpb.EnumValueOptions.

View Source 
var (
	// ConsoleViewerCaps are read-only API capabilities that do not affect state,
	// and cannot pull artifacts from registries.
	ConsoleViewerCaps = SortCaps([]Capability{
		Capability_CAP_EVENTS_SUBSCRIPTION_LIST,

		Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_LIST,
		Capability_CAP_IAM_GROUP_INVITES_LIST,
		Capability_CAP_IAM_GROUPS_LIST,
		Capability_CAP_IAM_ROLE_BINDINGS_LIST,
		Capability_CAP_IAM_ROLES_LIST,
		Capability_CAP_IAM_IDENTITY_LIST,
		Capability_CAP_IAM_IDENTITY_PROVIDERS_LIST,

		Capability_CAP_REPO_LIST,
		Capability_CAP_MANIFEST_LIST,
		Capability_CAP_REFERRERS_LIST,
		Capability_CAP_TAG_LIST,
		Capability_CAP_MANIFEST_METADATA_LIST,
		Capability_CAP_APK_LIST,

		Capability_CAP_TENANT_RECORD_SIGNATURES_LIST,
		Capability_CAP_TENANT_SBOMS_LIST,
		Capability_CAP_TENANT_VULN_REPORTS_LIST,

		Capability_CAP_VERSION_LIST,

		Capability_CAP_VULN_REPORT_LIST,

		Capability_CAP_BUILD_REPORT_LIST,

		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_ARTIFACTS_LIST,

		Capability_CAP_SKILLS_ENTITLEMENTS_LIST,

		Capability_CAP_REGISTRY_ENTITLEMENTS_LIST,
		Capability_CAP_REGISTRY_DEPLOYMENTS_LIST,

		Capability_CAP_REGISTRY_SETTINGS_LIST,

		Capability_CAP_POLICIES_POLICY_LIST,
		Capability_CAP_POLICIES_BINDING_LIST,
		Capability_CAP_POLICIES_DECISION_LIST,
		Capability_CAP_POLICIES_OVERRIDE_LIST,

		Capability_CAP_LIBRARIES_POLICY_LIST,
		Capability_CAP_LIBRARIES_POLICY_BINDING_LIST,
		Capability_CAP_LIBRARIES_POLICY_BLOCK_EVENT_LIST,

		Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_LIST,

		Capability_CAP_PACKAGES_ENTITLEMENTS_LIST,
		Capability_CAP_ADVISORIES_LIST,

		Capability_CAP_ACTIONS_LIST,

		Capability_CAP_GUARDENER_ENTITLEMENT_LIST,
	})

	// ViewerCaps are read-only capabilities that do not affect state,
	// but are allowed to pull from container and apk registries.
	ViewerCaps = SortCaps(ConsoleViewerCaps,

		RegistryPullCaps, APKPullCaps,

		GuardenerUserCaps)

	// EditorCaps can modify state, but not grant roles/permissions.
	EditorCaps = SortCaps([]Capability{
		Capability_CAP_EVENTS_SUBSCRIPTION_CREATE,
		Capability_CAP_EVENTS_SUBSCRIPTION_DELETE,
		Capability_CAP_EVENTS_SUBSCRIPTION_UPDATE,
	}, RegistryEditorCaps, ViewerCaps)

	// SkillsPublishCaps is the capability set required to publish skill artifacts
	// to skills.cgr.dev. Included in OwnerCaps so org owners can push after
	// provisioning a skills entitlement. Can also be granted explicitly to a
	// service principal or non-owner member via chainctl iam role-bindings create.
	//
	// CAP_TERMS_LIST lets chainctl's pre-flight read the org's accepted-docs
	// list so it knows whether to prompt with the TUI before remote.Write.
	SkillsPublishCaps = SortCaps([]Capability{
		Capability_CAP_SKILLS_PUBLISH,
		Capability_CAP_SKILLS_ENTITLEMENTS_LIST,
		Capability_CAP_TERMS_LIST,
	})

	// OwnerCaps includes all capabilities possible by a user.
	OwnerCaps = SortCaps([]Capability{
		Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_CREATE,
		Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_DELETE,
		Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_UPDATE,

		Capability_CAP_IAM_GROUP_INVITES_CREATE,
		Capability_CAP_IAM_GROUP_INVITES_DELETE,

		Capability_CAP_IAM_GROUPS_CREATE,
		Capability_CAP_IAM_GROUPS_DELETE,
		Capability_CAP_IAM_GROUPS_UPDATE,

		Capability_CAP_IAM_IDENTITY_CREATE,
		Capability_CAP_IAM_IDENTITY_DELETE,
		Capability_CAP_IAM_IDENTITY_UPDATE,

		Capability_CAP_IAM_IDENTITY_PROVIDERS_CREATE,
		Capability_CAP_IAM_IDENTITY_PROVIDERS_DELETE,
		Capability_CAP_IAM_IDENTITY_PROVIDERS_UPDATE,

		Capability_CAP_IAM_ROLE_BINDINGS_CREATE,
		Capability_CAP_IAM_ROLE_BINDINGS_DELETE,
		Capability_CAP_IAM_ROLE_BINDINGS_UPDATE,

		Capability_CAP_IAM_ROLES_CREATE,
		Capability_CAP_IAM_ROLES_DELETE,
		Capability_CAP_IAM_ROLES_UPDATE,

		Capability_CAP_VULN_CREATE,
		Capability_CAP_VULN_REPORT_CREATE,

		Capability_CAP_REGISTRY_ENTITLEMENTS_IMAGES_ADD,
		Capability_CAP_REGISTRY_ENTITLEMENTS_IMAGES_REMOVE,

		Capability_CAP_LIBRARIES_ENTITLEMENTS_CREATE,
		Capability_CAP_LIBRARIES_ENTITLEMENTS_DELETE,

		Capability_CAP_SKILLS_ENTITLEMENTS_CREATE,
		Capability_CAP_SKILLS_ENTITLEMENTS_DELETE,
		Capability_CAP_LIBRARIES_CACHE_INVALIDATE,
		Capability_CAP_REPO_CHECK_POLICIES,

		Capability_CAP_POLICIES_BINDING_CREATE,
		Capability_CAP_POLICIES_BINDING_UPDATE,
		Capability_CAP_POLICIES_BINDING_DELETE,
		Capability_CAP_POLICIES_OVERRIDE_CREATE,
		Capability_CAP_POLICIES_OVERRIDE_DELETE,

		Capability_CAP_LIBRARIES_POLICY_CREATE,
		Capability_CAP_LIBRARIES_POLICY_UPDATE,
		Capability_CAP_LIBRARIES_POLICY_DELETE,
		Capability_CAP_LIBRARIES_POLICY_BINDING_CREATE,
		Capability_CAP_LIBRARIES_POLICY_BINDING_UPDATE,
		Capability_CAP_LIBRARIES_POLICY_BINDING_DELETE,

		Capability_CAP_TERMS_ACCEPT,
		Capability_CAP_TERMS_LIST,

		Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_CREATE,
		Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_UPDATE,

		Capability_CAP_MCP_TOOL_CALL,
	}, EditorCaps,

		RegistryPushCaps, APKPushCaps, LibrariesJavaPushCaps, LibrariesJavascriptPushCaps, LibrariesPythonPushCaps,

		LibrariesJavaPullCaps, LibrariesPythonPullCaps, LibrariesJavascriptPullCaps,

		SkillsPublishCaps,

		GuardenerAdminCaps,
	)

	RegistryRepoAdminCaps = SortCaps(RegistryEditorCaps)

	RegistryEditorCaps = SortCaps([]Capability{
		Capability_CAP_REPO_CREATE,
		Capability_CAP_REPO_UPDATE,
		Capability_CAP_REPO_DELETE,
	}, RegistryPullCaps)

	RegistryPullCaps = SortCaps([]Capability{
		Capability_CAP_REPO_BLOBS_GET,

		Capability_CAP_IAM_GROUPS_LIST,

		Capability_CAP_REPO_LIST,
		Capability_CAP_MANIFEST_LIST,
		Capability_CAP_REFERRERS_LIST,
		Capability_CAP_TAG_LIST,
		Capability_CAP_MANIFEST_METADATA_LIST,

		Capability_CAP_TENANT_RECORD_SIGNATURES_LIST,
		Capability_CAP_TENANT_SBOMS_LIST,
		Capability_CAP_TENANT_VULN_REPORTS_LIST,
	})

	RegistryPushCaps = SortCaps([]Capability{
		Capability_CAP_REPO_CREATE,
		Capability_CAP_REPO_UPDATE,
		Capability_CAP_REPO_DELETE,

		Capability_CAP_MANIFEST_CREATE,
		Capability_CAP_MANIFEST_UPDATE,
		Capability_CAP_MANIFEST_DELETE,

		Capability_CAP_TAG_CREATE,
		Capability_CAP_TAG_UPDATE,
		Capability_CAP_TAG_DELETE,

		Capability_CAP_IAM_GROUPS_CREATE,
	}, RegistryPullCaps)

	// PullTokenCreatorCaps is the minimal set of capabilities to create a pull token.
	PullTokenCreatorCaps = SortCaps([]Capability{

		Capability_CAP_IAM_ROLE_BINDINGS_CREATE,
		Capability_CAP_IAM_IDENTITY_CREATE,

		Capability_CAP_IAM_ROLES_LIST,

		Capability_CAP_IAM_GROUPS_LIST,
	})

	RegistryPullTokenCreatorCaps = SortCaps(PullTokenCreatorCaps, RegistryPullCaps, APKPullCaps)

	APKPullCaps = SortCaps([]Capability{
		Capability_CAP_APK_BLOBS_GET,
		Capability_CAP_IAM_GROUPS_LIST,
		Capability_CAP_APK_LIST,
	})

	APKPushCaps = SortCaps([]Capability{
		Capability_CAP_IAM_GROUPS_LIST,
		Capability_CAP_APK_CREATE,
		Capability_CAP_APK_DELETE,
	}, APKPullCaps)

	AdvisoriesViewerCaps = SortCaps([]Capability{
		Capability_CAP_ADVISORIES_LIST,
	})

	// ActionsViewerCaps is the minimal capability set for reading the
	// Chainguard Actions catalog. It backs the actions.viewer role, granted to
	// the public-puller identity so the catalog is readable without org
	// membership.
	ActionsViewerCaps = SortCaps([]Capability{
		Capability_CAP_ACTIONS_LIST,
	})

	AdvisoriesCreatorCaps = SortCaps([]Capability{
		Capability_CAP_ADVISORIES_CREATE,
		Capability_CAP_ADVISORIES_UPDATE,
	}, AdvisoriesViewerCaps)

	AdvisoriesApproverCaps = SortCaps([]Capability{
		Capability_CAP_ADVISORIES_APPROVE,
	}, AdvisoriesCreatorCaps)

	AdvisoriesAdminCaps = SortCaps([]Capability{
		Capability_CAP_ADVISORIES_DELETE,
	}, AdvisoriesApproverCaps)

	LibrariesJavaPullCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_JAVA_LIST,
	})

	LibrariesJavaPushCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_JAVA_CREATE,
	}, LibrariesJavaPullCaps)

	LibrariesPythonPullCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_PYTHON_LIST,
	})

	LibrariesPythonPushCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_PYTHON_CREATE,
	}, LibrariesPythonPullCaps)

	LibrariesJavascriptPullCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_JAVASCRIPT_LIST,
	})

	LibrariesJavascriptPushCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_JAVASCRIPT_CREATE,
	}, LibrariesJavascriptPullCaps)

	LibrariesRebuilderRequestsCreateCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE,
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_LIST,
	})

	LibrariesRebuilderViewerCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_REMEDIATED_ARTIFACTS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_LIST,
		Capability_CAP_LIBRARIES_REBUILDER_NEW_VERSIONS_READ,
	})

	// LibrariesRebuilderTrustedCaps is for the trusted SA (e.g. prepare phase) that
	// can fetch build-scoped JWT tokens.
	LibrariesRebuilderTrustedCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_TOKENS_FETCH,
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_READ,
	})

	// LibrariesRebuilderUntrustedCaps is for untrusted build/test pods. They combine
	// this Chainguard identity check with a per-build JWT token for defence in depth.
	// The read-only malware-status capability lets the build pipeline (e.g. the
	// prepare phase) gate which package versions enter the build matrix; it is
	// read-only and low-risk, so it lives on the untrusted role rather than
	// requiring a separate trusted service account.
	LibrariesRebuilderUntrustedCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_UNTRUSTED,
		Capability_CAP_LIBRARIES_REBUILDER_MALWARE_STATUS_READ,
	})

	LibrariesRebuilderAdminCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE,
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_LIST,
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_CANCEL,
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_GROUP_UPDATE,
		Capability_CAP_LIBRARIES_REBUILDER_ARTIFACTS_INVALIDATE,
		Capability_CAP_LIBRARIES_REBUILDER_EXCLUSIONS_MANAGE,
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_TOKENS_FETCH,
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_UNTRUSTED,
		Capability_CAP_LIBRARIES_REBUILDER_REMEDIATED_ARTIFACTS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_NEW_VERSIONS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_NEW_VERSIONS_REFRESH,
		Capability_CAP_LIBRARIES_REBUILDER_MALWARE_STATUS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_CVE_REMEDIATIONS_LIST,
		Capability_CAP_LIBRARIES_REBUILDER_CVE_REMEDIATIONS_UPDATE,

		Capability_CAP_INTERNAL,
	})

	// GuardenerUserCaps is the minimum capability set required to run
	// guardener (DFC) sessions against a group. terms.list is required
	// because the DFC server checks the group's terms-of-service
	// acceptance with the caller's credentials before starting a session.
	// Registry pull caps are included so users can fetch the base images
	// the DFC session converts to. association.list is the read-only
	// counterpart to association.manage, so users can see which GitHub orgs
	// are linked to the group without being able to link or unlink them.
	// actions.migrate lets users enqueue an on-demand GitHub Actions
	// migration for a repository in the group.
	GuardenerUserCaps = SortCaps([]Capability{
		Capability_CAP_GUARDENER_DFC_CONVERT,
		Capability_CAP_GUARDENER_ASSOCIATION_LIST,
		Capability_CAP_GUARDENER_ACTIONS_MIGRATE,
		Capability_CAP_TERMS_LIST,
	}, RegistryPullCaps)

	// GuardenerAdminCaps extends GuardenerUserCaps with terms.accept so
	// admins can record acceptance of the legal documents that the DFC
	// server requires before sessions can start, and association.manage so
	// admins can self-service link/unlink a GitHub org to the group.
	GuardenerAdminCaps = SortCaps([]Capability{
		Capability_CAP_TERMS_ACCEPT,
		Capability_CAP_GUARDENER_ASSOCIATION_MANAGE,
	}, GuardenerUserCaps)

	MCPToolUserCaps = SortCaps([]Capability{
		Capability_CAP_MCP_TOOL_CALL,
	})

	// ArgosOperatorCaps is the capability set for managing argos
	// (client-side-encrypted document) records.
	ArgosOperatorCaps = SortCaps([]Capability{
		Capability_CAP_ARGOS_DOCUMENTS_CREATE,
		Capability_CAP_ARGOS_DOCUMENTS_DELETE,
		Capability_CAP_ARGOS_DOCUMENTS_LIST,
	})

	// ArgosOSVReaderCaps is the capability set for reading the shared,
	// customer-blind Private OSV corpus. It is kept separate from
	// ArgosOperatorCaps (document management) and is granted to participating
	// orgs via the dedicated argos.osv.reader role, never to staff or org
	// owners by default.
	ArgosOSVReaderCaps = SortCaps([]Capability{
		Capability_CAP_ARGOS_OSV_READ,
	})
)
View Source 
var File_capabilities_proto protoreflect.FileDescriptor

Functions

func Bitify 

func Bitify(capability Capability) (uint32, error)

func Deprecated added in v0.1.21 

func Deprecated(capability Capability) bool

func InternalOnly added in v0.1.56 

func InternalOnly(capability Capability) bool

InternalOnly reports whether the capability is annotated as internal-only via the (internal_only) proto option. Capabilities that return true must never be granted by a role available to customer organisations.

func Names 

func Names() []string

Names returns a slice of all capabilities Stringify'd, sans UNKNOWN.

Example

ExampleNames demonstrates listing all known capability names. 

package main

import (
	"fmt"

	"chainguard.dev/sdk/proto/capabilities"
)

func main() {
	names := capabilities.Names()
	fmt.Println(len(names) > 0)
}

Output:
true

func Stringify 

func Stringify(capability Capability) (string, error)

func StringifyAll 

func StringifyAll(caps []Capability) ([]string, error)

StringifyAll converts capabilities to their string names. A capability with no descriptor has been deleted from the enum; it grants nothing, so it is skipped with a warning rather than failing the whole list — otherwise a single stale capability on a stored role makes that role impossible to read or list, which takes down the Console IDP settings page (CUS-843). Other Stringify errors (a present enum value missing its options or name extension) indicate a proto authoring bug and are surfaced to the caller.

Types

type Capability 

type Capability int32

Capability is an enumeration of the Chainguard IAM capabilities. 

const (
	Capability_UNKNOWN                      Capability = 0
	Capability_CAP_INTERNAL                 Capability = 2
	Capability_CAP_IAM_GROUPS_CREATE        Capability = 101
	Capability_CAP_IAM_GROUPS_UPDATE        Capability = 102
	Capability_CAP_IAM_GROUPS_LIST          Capability = 103
	Capability_CAP_IAM_GROUPS_DELETE        Capability = 104
	Capability_CAP_IAM_GROUP_INVITES_CREATE Capability = 201
	Capability_CAP_IAM_GROUP_INVITES_LIST   Capability = 203
	Capability_CAP_IAM_GROUP_INVITES_DELETE Capability = 204
	Capability_CAP_IAM_ROLES_CREATE         Capability = 301
	Capability_CAP_IAM_ROLES_UPDATE         Capability = 302
	Capability_CAP_IAM_ROLES_LIST           Capability = 303
	Capability_CAP_IAM_ROLES_DELETE         Capability = 304
	Capability_CAP_IAM_ROLE_BINDINGS_CREATE Capability = 401
	Capability_CAP_IAM_ROLE_BINDINGS_UPDATE Capability = 402
	Capability_CAP_IAM_ROLE_BINDINGS_LIST   Capability = 403
	Capability_CAP_IAM_ROLE_BINDINGS_DELETE Capability = 404
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_CLUSTERS_CREATE Capability = 501
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_CLUSTERS_UPDATE Capability = 502
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_CLUSTERS_LIST Capability = 503
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_CLUSTERS_DELETE Capability = 504
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_CLUSTERS_DISCOVER Capability = 505
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_RECORDS_LIST Capability = 603
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_RECORD_CONTEXTS_LIST   Capability = 613
	Capability_CAP_TENANT_RECORD_SIGNATURES_LIST Capability = 623
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_RECORD_POLICY_RESULTS_LIST Capability = 633
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_RISKS_LIST Capability = 640
	Capability_CAP_TENANT_SBOMS_LIST Capability = 650
	// TODO(colin): deprecate this cap once the legacy endpoint is removed
	Capability_CAP_TENANT_VULN_REPORTS_LIST        Capability = 660
	Capability_CAP_TENANT_ATTESTATIONS_LIST        Capability = 670
	Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_CREATE Capability = 701
	Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_UPDATE Capability = 702
	Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_LIST   Capability = 703
	Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_DELETE Capability = 704
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_IAM_POLICY_CREATE Capability = 801
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_IAM_POLICY_UPDATE Capability = 802
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_IAM_POLICY_LIST Capability = 803
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_IAM_POLICY_DELETE   Capability = 804
	Capability_CAP_IAM_IDENTITY_CREATE Capability = 901
	Capability_CAP_IAM_IDENTITY_UPDATE Capability = 902
	Capability_CAP_IAM_IDENTITY_LIST   Capability = 903
	Capability_CAP_IAM_IDENTITY_DELETE Capability = 904
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_NODES_LIST Capability = 1003
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_NAMESPACES_LIST Capability = 1103
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_WORKLOADS_LIST         Capability = 1203
	Capability_CAP_IAM_IDENTITY_PROVIDERS_CREATE Capability = 1301
	Capability_CAP_IAM_IDENTITY_PROVIDERS_UPDATE Capability = 1302
	Capability_CAP_IAM_IDENTITY_PROVIDERS_LIST   Capability = 1303
	Capability_CAP_IAM_IDENTITY_PROVIDERS_DELETE Capability = 1304
	Capability_CAP_EVENTS_SUBSCRIPTION_CREATE    Capability = 1501
	Capability_CAP_EVENTS_SUBSCRIPTION_UPDATE    Capability = 1502
	Capability_CAP_EVENTS_SUBSCRIPTION_LIST      Capability = 1503
	Capability_CAP_EVENTS_SUBSCRIPTION_DELETE    Capability = 1504
	// repo.blobs.get is a capability required to pull container images.
	// We explicitly define this to distinguish roles that allow browsing/viewing
	// metadata associated with images vs pulling the image itself.
	Capability_CAP_REPO_BLOBS_GET Capability = 1600
	// TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also
	// accept CAP_REPO_CREATE as a transitional grant for write access to
	// its REAPI cache surface. Once consumers have migrated to
	// CAP_CASSIE_CAS_WRITE, drop the dual-accept in cassie.
	Capability_CAP_REPO_CREATE Capability = 1603
	Capability_CAP_REPO_UPDATE Capability = 1604
	// TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also
	// accept CAP_REPO_LIST as a transitional grant for read access to
	// its REAPI cache surface. Once consumers have migrated to
	// CAP_CASSIE_CAS_READ, drop the dual-accept in cassie.
	Capability_CAP_REPO_LIST              Capability = 1605
	Capability_CAP_REPO_DELETE            Capability = 1606
	Capability_CAP_MANIFEST_CREATE        Capability = 1607
	Capability_CAP_MANIFEST_UPDATE        Capability = 1608
	Capability_CAP_MANIFEST_LIST          Capability = 1609
	Capability_CAP_MANIFEST_DELETE        Capability = 1610
	Capability_CAP_TAG_CREATE             Capability = 1611
	Capability_CAP_TAG_UPDATE             Capability = 1612
	Capability_CAP_TAG_LIST               Capability = 1613
	Capability_CAP_TAG_DELETE             Capability = 1614
	Capability_CAP_MANIFEST_METADATA_LIST Capability = 1615
	Capability_CAP_REFERRERS_LIST         Capability = 1616
	// repo.internal.admin allows administering internal-only repository fields
	// (catalog tier, bundles, aliases, active tags, README, and sync settings)
	// that are otherwise read-only to customers.
	Capability_CAP_REPO_INTERNAL_ADMIN Capability = 1617
	// apk.blobs.get is a capability required to pull APKs.
	// We explicitly define this to distinguish roles that allow browsing/viewing
	// metadata associated with APKs vs pulling the APK itself.
	Capability_CAP_APK_BLOBS_GET      Capability = 1655
	Capability_CAP_APK_CREATE         Capability = 1650
	Capability_CAP_APK_UPDATE         Capability = 1651
	Capability_CAP_APK_LIST           Capability = 1652
	Capability_CAP_APK_DELETE         Capability = 1653
	Capability_CAP_VERSION_LIST       Capability = 1654
	Capability_CAP_VULN_REPORT_CREATE Capability = 1660
	Capability_CAP_VULN_REPORT_LIST   Capability = 1661
	Capability_CAP_VULN_CREATE        Capability = 1662
	// Custom Image Build
	Capability_CAP_BUILD_REPORT_LIST Capability = 1670
	// Global libraries capabilities
	Capability_CAP_LIBRARIES_ENTITLEMENTS_CREATE Capability = 1800
	Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST   Capability = 1801
	Capability_CAP_LIBRARIES_ENTITLEMENTS_DELETE Capability = 1802
	Capability_CAP_LIBRARIES_ARTIFACTS_LIST      Capability = 1803
	// Ecosystems specific capabilities
	Capability_CAP_LIBRARIES_PYTHON_LIST       Capability = 1810
	Capability_CAP_LIBRARIES_PYTHON_CREATE     Capability = 1811
	Capability_CAP_LIBRARIES_JAVA_LIST         Capability = 1820
	Capability_CAP_LIBRARIES_JAVA_CREATE       Capability = 1821
	Capability_CAP_LIBRARIES_JAVASCRIPT_LIST   Capability = 1830
	Capability_CAP_LIBRARIES_JAVASCRIPT_CREATE Capability = 1831
	// Cache invalidation capability for the libraries cache (covers all ecosystems).
	// Granted to org owners and account admins; not to regular developer members.
	Capability_CAP_LIBRARIES_CACHE_INVALIDATE Capability = 1860
	// Rebuilder API capabilities
	Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE           Capability = 1840
	Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_LIST             Capability = 1841
	Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_CANCEL           Capability = 1842
	Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_GROUP_UPDATE     Capability = 1843
	Capability_CAP_LIBRARIES_REBUILDER_ARTIFACTS_INVALIDATE      Capability = 1850
	Capability_CAP_LIBRARIES_REBUILDER_EXCLUSIONS_MANAGE         Capability = 1851
	Capability_CAP_LIBRARIES_REBUILDER_BUILDS_READ               Capability = 1852
	Capability_CAP_LIBRARIES_REBUILDER_BUILDS_TOKENS_FETCH       Capability = 1853
	Capability_CAP_LIBRARIES_REBUILDER_BUILDS_UNTRUSTED          Capability = 1854
	Capability_CAP_LIBRARIES_REBUILDER_REMEDIATED_ARTIFACTS_READ Capability = 1855
	Capability_CAP_LIBRARIES_REBUILDER_NEW_VERSIONS_READ         Capability = 1856
	Capability_CAP_LIBRARIES_REBUILDER_NEW_VERSIONS_REFRESH      Capability = 1857
	Capability_CAP_LIBRARIES_REBUILDER_MALWARE_STATUS_READ       Capability = 1858
	Capability_CAP_LIBRARIES_REBUILDER_CVE_REMEDIATIONS_LIST     Capability = 1859
	Capability_CAP_LIBRARIES_REBUILDER_CVE_REMEDIATIONS_UPDATE   Capability = 1861
	// AWS Marketplace Subscriptions (Chainguard Libraries on AWS Security Hub Extended)
	Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_CREATE Capability = 1870
	Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_UPDATE Capability = 1871
	Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_LIST   Capability = 1872
	// Registry Entitlements
	Capability_CAP_REGISTRY_ENTITLEMENTS_LIST          Capability = 1680
	Capability_CAP_REGISTRY_ENTITLEMENTS_CREATE        Capability = 1681
	Capability_CAP_REGISTRY_ENTITLEMENTS_DELETE        Capability = 1682
	Capability_CAP_REGISTRY_ENTITLEMENTS_IMAGES_ADD    Capability = 1685
	Capability_CAP_REGISTRY_ENTITLEMENTS_IMAGES_REMOVE Capability = 1686
	// Registry Settings
	Capability_CAP_REGISTRY_SETTINGS_LIST   Capability = 1683
	Capability_CAP_REGISTRY_SETTINGS_UPDATE Capability = 1684
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_SIGSTORE_CREATE Capability = 1701
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_SIGSTORE_UPDATE Capability = 1702
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_SIGSTORE_LIST Capability = 1703
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_SIGSTORE_DELETE Capability = 1704
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_SIGSTORE_CERTIFICATE_CREATE Capability = 1705
	Capability_CAP_ADVISORIES_CREATE           Capability = 1900
	Capability_CAP_ADVISORIES_UPDATE           Capability = 1901
	Capability_CAP_ADVISORIES_LIST             Capability = 1902
	Capability_CAP_ADVISORIES_DELETE           Capability = 1903
	Capability_CAP_ADVISORIES_APPROVE          Capability = 1904
	// Registry Deployments
	Capability_CAP_REGISTRY_DEPLOYMENTS_CREATE Capability = 1950
	Capability_CAP_REGISTRY_DEPLOYMENTS_UPDATE Capability = 1951
	Capability_CAP_REGISTRY_DEPLOYMENTS_LIST   Capability = 1952
	// Policies
	Capability_CAP_POLICIES_POLICY_CREATE  Capability = 2001
	Capability_CAP_POLICIES_POLICY_UPDATE  Capability = 2002
	Capability_CAP_POLICIES_POLICY_LIST    Capability = 2003
	Capability_CAP_POLICIES_POLICY_DELETE  Capability = 2004
	Capability_CAP_POLICIES_BINDING_CREATE Capability = 2011
	Capability_CAP_POLICIES_BINDING_UPDATE Capability = 2012
	Capability_CAP_POLICIES_BINDING_LIST   Capability = 2013
	Capability_CAP_POLICIES_BINDING_DELETE Capability = 2014
	Capability_CAP_POLICIES_DECISION_LIST  Capability = 2015
	// Policy overrides waive enforcement for a specific artifact. These are
	// separate capabilities from binding management so they can be granted
	// independently. By default create and delete are held by org owners (like
	// binding management) and listing is available to viewers.
	Capability_CAP_POLICIES_OVERRIDE_CREATE   Capability = 2016
	Capability_CAP_POLICIES_OVERRIDE_LIST     Capability = 2017
	Capability_CAP_POLICIES_OVERRIDE_DELETE   Capability = 2018
	Capability_CAP_REPO_CHECK_POLICIES        Capability = 2020
	Capability_CAP_PACKAGES_ENTITLEMENTS_LIST Capability = 2100
	// Terms
	Capability_CAP_TERMS_ACCEPT Capability = 2201
	Capability_CAP_TERMS_LIST   Capability = 2202
	// This is orthogonal enough that we should leave
	// it somewhat separate, so add new capabilities above.
	// TODO(mattmoor): Think about whether we can encode specific
	// controller capabilities into our access control here?
	// e.g. could each logical controller/webhook be its own
	// capability?
	Capability_CAP_GULFSTREAM Capability = 10000
	// Guardener
	Capability_CAP_GUARDENER_DFC_CONVERT Capability = 2301
	// guardener.association.manage gates self-service linking/unlinking of a
	// GitHub org to a Chainguard group (the GroupAccountAssociations record).
	Capability_CAP_GUARDENER_ASSOCIATION_MANAGE Capability = 2302
	// guardener.association.list gates read-only listing of the GitHub org
	// installations linked to a Chainguard group (the read counterpart to
	// guardener.association.manage).
	Capability_CAP_GUARDENER_ASSOCIATION_LIST Capability = 2303
	// guardener.entitlement.manage gates the support-only surface for configuring a
	// group's guardener entitlement (e.g. which repo visibility scope guardener
	// responds to). It is internal_only: it can never be granted by a role
	// available to customer organizations.
	Capability_CAP_GUARDENER_ENTITLEMENT_MANAGE Capability = 2304
	// guardener.entitlement.list gates read-only access to a group's guardener
	// entitlement. Unlike guardener.entitlement.manage it is not internal_only, so
	// normal viewers can see the settings that apply to their group.
	Capability_CAP_GUARDENER_ENTITLEMENT_LIST Capability = 2305
	// Guardener actions migrator — on-demand enqueue of a repository's GitHub
	// Actions migration (opens a pull request), tracked via a long-running
	// operation. Mutating, so distinct from the read-only actions catalog cap.
	Capability_CAP_GUARDENER_ACTIONS_MIGRATE Capability = 2306
	// MCP tool calls
	Capability_CAP_MCP_TOOL_CALL Capability = 2401
	// Skills registry — publishing skill artifacts to skills.cgr.dev
	Capability_CAP_SKILLS_PUBLISH Capability = 2501
	// Skills registry entitlements
	Capability_CAP_SKILLS_ENTITLEMENTS_CREATE Capability = 2502
	Capability_CAP_SKILLS_ENTITLEMENTS_LIST   Capability = 2503
	Capability_CAP_SKILLS_ENTITLEMENTS_DELETE Capability = 2504
	// Argos — client-side encrypted document records.
	Capability_CAP_ARGOS_DOCUMENTS_CREATE Capability = 2601
	Capability_CAP_ARGOS_DOCUMENTS_LIST   Capability = 2602
	Capability_CAP_ARGOS_DOCUMENTS_DELETE Capability = 2603
	// Argos — Private OSV API (customer-facing OSV query surface).
	Capability_CAP_ARGOS_OSV_READ Capability = 2604
	// Libraries Policy Gates — customer-facing policies and bindings that
	// configure the cooldown and malware gates applied to upstream package pulls,
	// plus the block events recorded when a pull is withheld.
	Capability_CAP_LIBRARIES_POLICY_CREATE           Capability = 2605
	Capability_CAP_LIBRARIES_POLICY_UPDATE           Capability = 2606
	Capability_CAP_LIBRARIES_POLICY_LIST             Capability = 2607
	Capability_CAP_LIBRARIES_POLICY_DELETE           Capability = 2608
	Capability_CAP_LIBRARIES_POLICY_BINDING_CREATE   Capability = 2609
	Capability_CAP_LIBRARIES_POLICY_BINDING_UPDATE   Capability = 2610
	Capability_CAP_LIBRARIES_POLICY_BINDING_LIST     Capability = 2611
	Capability_CAP_LIBRARIES_POLICY_BINDING_DELETE   Capability = 2612
	Capability_CAP_LIBRARIES_POLICY_BLOCK_EVENT_LIST Capability = 2613
	// Build API
	Capability_CAP_BUILDAPI_BUILD_CREATE Capability = 2701
	Capability_CAP_BUILDAPI_BUILD_LIST   Capability = 2702
	Capability_CAP_BUILDAPI_WORKER_SYNC  Capability = 2703
	Capability_CAP_BUILDAPI_BUILD_CANCEL Capability = 2704
	// Cassie REAPI cache surface. CAS (blobs + ByteStream) and the ActionCache
	// are separately gated: a caller may read or write action results without
	// any authority over the underlying content blobs, and vice versa.
	Capability_CAP_CASSIE_CAS_READ  Capability = 2801
	Capability_CAP_CASSIE_CAS_WRITE Capability = 2802
	Capability_CAP_CASSIE_AC_READ   Capability = 2804
	Capability_CAP_CASSIE_AC_WRITE  Capability = 2803
	// Loggie: the live-log service. Readers tailing a stream hold logs.read;
	// a producer appending to its streams holds logs.write; the orchestrator
	// issuing streams holds logs.create. Appending also requires the stream's
	// signed write name, so a logs.write holder can only append to streams it
	// was handed.
	Capability_CAP_LOGGIE_LOGS_READ   Capability = 2901
	Capability_CAP_LOGGIE_LOGS_WRITE  Capability = 2902
	Capability_CAP_LOGGIE_LOGS_CREATE Capability = 2903
	// Rex: the remote-execution service. The edge authorizes submitting an
	// execution; the scheduler authorizes a worker joining the pool; the
	// executions query surface authorizes cross-run reads at the instance.
	Capability_CAP_REX_EXECUTIONS_CREATE Capability = 2705
	Capability_CAP_REX_EXECUTIONS_LIST   Capability = 2706
	Capability_CAP_REX_WORKERS_CONNECT   Capability = 2707
	// Gated platform classes. USE authorizes submitting an execution that
	// demands a gated class; SERVE authorizes a worker pool advertising one.
	// Both are evaluated at the class's own UIDP node, never at the instance.
	Capability_CAP_REX_CLASS_USE   Capability = 2708
	Capability_CAP_REX_CLASS_SERVE Capability = 2709
	// Actions catalog — the read-only catalog of Chainguard-published GitHub
	// Actions and the upstreams they mirror. Writes are internal (importer only).
	Capability_CAP_ACTIONS_LIST Capability = 2700
)

func Parse 

func Parse(name string) (Capability, error)
Example

ExampleParse demonstrates parsing a capability by name. 

package main

import (
	"fmt"

	"chainguard.dev/sdk/proto/capabilities"
)

func main() {
	// Capability_UNKNOWN is the zero value and is not in the name map.
	capability, err := capabilities.Parse("unknown-capability-name")
	fmt.Println(err)
	fmt.Println(capability == capabilities.Capability_UNKNOWN)
}

Output:
<nil>
true

func SortCaps added in v0.1.36 

func SortCaps(caps ...[]Capability) []Capability

func (Capability) Descriptor 

func (Capability) Descriptor() protoreflect.EnumDescriptor

func (Capability) Enum 

func (x Capability) Enum() *Capability

func (Capability) EnumDescriptor deprecated 

func (Capability) EnumDescriptor() ([]byte, []int)

Deprecated: Use Capability.Descriptor instead.

func (Capability) Number 

func (x Capability) Number() protoreflect.EnumNumber

func (Capability) String 

func (x Capability) String() string

func (Capability) Type 

func (Capability) Type() protoreflect.EnumType

type Set 

type Set []Capability

Set performs efficient encoding of a list of capabilities.

func (Set) MarshalJSON 

func (s Set) MarshalJSON() ([]byte, error)

MarshalJSON implements json.Marshaler

func (Set) String 

func (s Set) String() string

func (*Set) UnmarshalJSON 

func (s *Set) UnmarshalJSON(b []byte) error

UnmarshalJSON implements json.Unmarshaler

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.