diff --git a/content/platform/administration/cloudevents/events-reference.md b/content/platform/administration/cloudevents/events-reference.md index 923da7345e..d9390c8da3 100644 --- a/content/platform/administration/cloudevents/events-reference.md +++ b/content/platform/administration/cloudevents/events-reference.md @@ -6,7 +6,7 @@ aliases: description: "Chainguard Events" type: "article" date: 2022-11-15T12:05:04 -lastmod: 2026-10-08T18:22:23 +lastmod: 2026-10-12T15:51:50 draft: false tags: ["Platform", "Reference", "Product"] images: [] @@ -98,7 +98,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: cgr.dev Ce-Specversion: 1.0 Ce-Subject: The identifier of the repository being pulled from -Ce-Time: 2026-10-08T18:22:23.42357289Z +Ce-Time: 2026-10-12T15:51:50.671585504Z Ce-Type: dev.chainguard.registry.pull.v1 Content-Length: 777 Content-Type: application/json @@ -128,7 +128,7 @@ User-Agent: Chainguard Enforce "tag": "The tag of the image being pulled", "type": "Type determines whether the object being pulled is a manifest or blob", "user_agent": "The user-agent of the client who pulled", - "when": "2026-10-08T18:22:23.422671" + "when": "2026-10-12T15:51:50.670794" } } @@ -151,7 +151,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: cgr.dev Ce-Specversion: 1.0 Ce-Subject: The identifier of the repository being pushed to -Ce-Time: 2026-10-08T18:22:23.422911111Z +Ce-Time: 2026-10-12T15:51:50.670991639Z Ce-Type: dev.chainguard.registry.push.v1 Content-Length: 707 Content-Type: application/json @@ -180,7 +180,7 @@ User-Agent: Chainguard Enforce "tag": "The tag of the image being pushed", "type": "Type determines whether the object being pushed is a manifest or blob", "user_agent": "The user-agent of the client who pushed", - "when": "2026-10-08T18:22:23.422325" + "when": "2026-10-12T15:51:50.670769" } } @@ -203,7 +203,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/auth/v1/register Ce-Specversion: 1.0 Ce-Subject: Chainguard UIDP -Ce-Time: 2026-10-08T18:22:23.436040192Z +Ce-Time: 2026-10-12T15:51:50.695359332Z Ce-Type: dev.chainguard.api.auth.registered.v1 Content-Length: 154 Content-Type: application/json @@ -243,7 +243,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/events/v1/subscriptions Ce-Specversion: 1.0 Ce-Subject: UIDP identifier of the subscription -Ce-Time: 2026-10-08T18:22:23.440646359Z +Ce-Time: 2026-10-12T15:51:50.689477761Z Ce-Type: dev.chainguard.api.events.subscription.created.v1 Content-Length: 152 Content-Type: application/json @@ -281,7 +281,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/events/v1/subscriptions Ce-Specversion: 1.0 Ce-Subject: UIDP identifier of the subscription to delete -Ce-Time: 2026-10-08T18:22:23.44082622Z +Ce-Time: 2026-10-12T15:51:50.689673804Z Ce-Type: dev.chainguard.api.events.subscription.deleted.v1 Content-Length: 119 Content-Type: application/json @@ -320,7 +320,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/externalGroupRoleMappings Ce-Specversion: 1.0 Ce-Subject: UIDP of the mapping -Ce-Time: 2026-10-08T18:22:23.426266193Z +Ce-Time: 2026-10-12T15:51:50.6869683Z Ce-Type: dev.chainguard.api.iam.external_group_role_mappings.created.v1 Content-Length: 290 Content-Type: application/json @@ -361,7 +361,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/externalGroupRoleMappings Ce-Specversion: 1.0 Ce-Subject: UIDP of the mapping -Ce-Time: 2026-10-08T18:22:23.426470207Z +Ce-Time: 2026-10-12T15:51:50.687081268Z Ce-Type: dev.chainguard.api.iam.external_group_role_mappings.deleted.v1 Content-Length: 93 Content-Type: application/json @@ -398,7 +398,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/externalGroupRoleMappings:batchDelete Ce-Specversion: 1.0 Ce-Subject: UIDP of the identity provider -Ce-Time: 2026-10-08T18:22:23.426611627Z +Ce-Time: 2026-10-12T15:51:50.687190397Z Ce-Type: dev.chainguard.api.iam.external_group_role_mappings.deleted.batch.v1 Content-Length: 346 Content-Type: application/json @@ -446,7 +446,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/account_associations Ce-Specversion: 1.0 Ce-Subject: UIDP with which this account information is associated -Ce-Time: 2026-10-08T18:22:23.425771147Z +Ce-Time: 2026-10-12T15:51:50.677837107Z Ce-Type: dev.chainguard.api.iam.account_associations.created.v1 Content-Length: 385 Content-Type: application/json @@ -492,7 +492,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/account_associations Ce-Specversion: 1.0 Ce-Subject: UIDP with which this account information is associated -Ce-Time: 2026-10-08T18:22:23.425928103Z +Ce-Time: 2026-10-12T15:51:50.678047317Z Ce-Type: dev.chainguard.api.iam.account_associations.updated.v1 Content-Length: 336 Content-Type: application/json @@ -538,7 +538,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/account_associations Ce-Specversion: 1.0 Ce-Subject: UIDP of the group whose associations will be deleted -Ce-Time: 2026-10-08T18:22:23.426082124Z +Ce-Time: 2026-10-12T15:51:50.678224674Z Ce-Type: dev.chainguard.api.iam.account_associations.deleted.v1 Content-Length: 129 Content-Type: application/json @@ -577,7 +577,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/group_invites Ce-Specversion: 1.0 Ce-Subject: group UIDP under which this invite resides -Ce-Time: 2026-10-08T18:22:23.433242646Z +Ce-Time: 2026-10-12T15:51:50.682029563Z Ce-Type: dev.chainguard.api.iam.group_invite.created.v1 Content-Length: 145 Content-Type: application/json @@ -617,7 +617,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/group_invites Ce-Specversion: 1.0 Ce-Subject: UIDP of the record -Ce-Time: 2026-10-08T18:22:23.433649233Z +Ce-Time: 2026-10-12T15:51:50.682234534Z Ce-Type: dev.chainguard.api.iam.group_invite.deleted.v1 Content-Length: 92 Content-Type: application/json @@ -656,7 +656,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/groups Ce-Specversion: 1.0 Ce-Subject: group UIDP under which this group resides -Ce-Time: 2026-10-08T18:22:23.434277324Z +Ce-Time: 2026-10-12T15:51:50.677093851Z Ce-Type: dev.chainguard.api.iam.group.created.v1 Content-Length: 169 Content-Type: application/json @@ -695,7 +695,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/groups Ce-Specversion: 1.0 Ce-Subject: group UIDP under which this group resides -Ce-Time: 2026-10-08T18:22:23.434445817Z +Ce-Time: 2026-10-12T15:51:50.677316741Z Ce-Type: dev.chainguard.api.iam.group.updated.v1 Content-Length: 169 Content-Type: application/json @@ -734,7 +734,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/groups Ce-Specversion: 1.0 Ce-Subject: UIDP of the record -Ce-Time: 2026-10-08T18:22:23.434557644Z +Ce-Time: 2026-10-12T15:51:50.677482242Z Ce-Type: dev.chainguard.api.iam.group.deleted.v1 Content-Length: 92 Content-Type: application/json @@ -773,7 +773,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identities Ce-Specversion: 1.0 Ce-Subject: UIDP of identity -Ce-Time: 2026-10-08T18:22:23.43906772Z +Ce-Time: 2026-10-12T15:51:50.685515098Z Ce-Type: dev.chainguard.api.iam.identity.created.v1 Content-Length: 329 Content-Type: application/json @@ -816,7 +816,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identities Ce-Specversion: 1.0 Ce-Subject: The unique identifier of this specific identity -Ce-Time: 2026-10-08T18:22:23.439239277Z +Ce-Time: 2026-10-12T15:51:50.685671512Z Ce-Type: dev.chainguard.api.iam.identity.updated.v1 Content-Length: 245 Content-Type: application/json @@ -856,7 +856,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identities Ce-Specversion: 1.0 Ce-Subject: UIDP of the record -Ce-Time: 2026-10-08T18:22:23.43940033Z +Ce-Time: 2026-10-12T15:51:50.685826318Z Ce-Type: dev.chainguard.api.iam.identity.deleted.v1 Content-Length: 92 Content-Type: application/json @@ -895,7 +895,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of identity provider -Ce-Time: 2026-10-08T18:22:23.426816257Z +Ce-Time: 2026-10-12T15:51:50.67270336Z Ce-Type: dev.chainguard.api.iam.identity_providers.created.v1 Content-Length: 378 Content-Type: application/json @@ -938,7 +938,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identityProviders Ce-Specversion: 1.0 Ce-Subject: The UIDP of the IAM group to nest this identity provider under -Ce-Time: 2026-10-08T18:22:23.426955461Z +Ce-Time: 2026-10-12T15:51:50.672843639Z Ce-Type: dev.chainguard.api.iam.identity_providers.updated.v1 Content-Length: 279 Content-Type: application/json @@ -978,7 +978,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of the IdP -Ce-Time: 2026-10-08T18:22:23.427046792Z +Ce-Time: 2026-10-12T15:51:50.673131396Z Ce-Type: dev.chainguard.api.iam.identity_providers.deleted.v1 Content-Length: 89 Content-Type: application/json @@ -1015,7 +1015,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of the identity provider -Ce-Time: 2026-10-08T18:22:23.427159611Z +Ce-Time: 2026-10-12T15:51:50.673303017Z Ce-Type: dev.chainguard.api.iam.identity_providers.scim_token.generated.v1 Content-Length: 250 Content-Type: application/json @@ -1055,7 +1055,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of the identity provider -Ce-Time: 2026-10-08T18:22:23.427284527Z +Ce-Time: 2026-10-12T15:51:50.673518875Z Ce-Type: dev.chainguard.api.iam.identity_providers.scim_token.regenerated.v1 Content-Length: 319 Content-Type: application/json @@ -1099,7 +1099,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of the identity provider -Ce-Time: 2026-10-08T18:22:23.42744494Z +Ce-Time: 2026-10-12T15:51:50.673755083Z Ce-Type: dev.chainguard.api.iam.identity_providers.scim_token.revoked.v1 Content-Length: 189 Content-Type: application/json @@ -1138,7 +1138,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of the identity provider -Ce-Time: 2026-10-08T18:22:23.427563831Z +Ce-Time: 2026-10-12T15:51:50.673911793Z Ce-Type: dev.chainguard.api.iam.identity_providers.scim_enabled.updated.v1 Content-Length: 187 Content-Type: application/json @@ -1179,7 +1179,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/rolebindings Ce-Specversion: 1.0 Ce-Subject: UIDP of the Role to bind -Ce-Time: 2026-10-08T18:22:23.439563351Z +Ce-Time: 2026-10-12T15:51:50.679070899Z Ce-Type: dev.chainguard.api.iam.rolebindings.created.v1 Content-Length: 261 Content-Type: application/json @@ -1221,7 +1221,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/rolebindings/batch Ce-Specversion: 1.0 Ce-Subject: UID of this role binding, under a parent group UIDP -Ce-Time: 2026-10-08T18:22:23.439704835Z +Ce-Time: 2026-10-12T15:51:50.679292781Z Ce-Type: dev.chainguard.api.iam.rolebindings.created.batch.v1 Content-Length: 220 Content-Type: application/json @@ -1264,7 +1264,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/rolebindings Ce-Specversion: 1.0 Ce-Subject: UID of this role binding -Ce-Time: 2026-10-08T18:22:23.439851159Z +Ce-Time: 2026-10-12T15:51:50.679471849Z Ce-Type: dev.chainguard.api.iam.rolebindings.updated.v1 Content-Length: 173 Content-Type: application/json @@ -1303,7 +1303,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/rolebindings Ce-Specversion: 1.0 Ce-Subject: UID of the record -Ce-Time: 2026-10-08T18:22:23.439997476Z +Ce-Time: 2026-10-12T15:51:50.679601489Z Ce-Type: dev.chainguard.api.iam.rolebindings.deleted.v1 Content-Length: 91 Content-Type: application/json @@ -1342,7 +1342,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/roles Ce-Specversion: 1.0 Ce-Subject: UIDP of the role under the group -Ce-Time: 2026-10-08T18:22:23.435562234Z +Ce-Time: 2026-10-12T15:51:50.680767693Z Ce-Type: dev.chainguard.api.iam.roles.created.v1 Content-Length: 159 Content-Type: application/json @@ -1381,7 +1381,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/roles Ce-Specversion: 1.0 Ce-Subject: UIDP of the role under the group -Ce-Time: 2026-10-08T18:22:23.435665893Z +Ce-Time: 2026-10-12T15:51:50.681646612Z Ce-Type: dev.chainguard.api.iam.roles.updated.v1 Content-Length: 159 Content-Type: application/json @@ -1420,7 +1420,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/roles Ce-Specversion: 1.0 Ce-Subject: UIDP of the role to delete -Ce-Time: 2026-10-08T18:22:23.435760199Z +Ce-Time: 2026-10-12T15:51:50.681831392Z Ce-Type: dev.chainguard.api.iam.roles.deleted.v1 Content-Length: 101 Content-Type: application/json @@ -1459,7 +1459,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/terms Ce-Specversion: 1.0 Ce-Subject: Chainguard UIDP of the organization -Ce-Time: 2026-10-08T18:22:23.435875635Z +Ce-Time: 2026-10-12T15:51:50.685937614Z Ce-Type: dev.chainguard.api.iam.terms.accepted.v1 Content-Length: 159 Content-Type: application/json @@ -1502,7 +1502,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/repos Ce-Specversion: 1.0 Ce-Subject: UIDP of the destination organization -Ce-Time: 2026-10-08T18:22:23.436587408Z +Ce-Time: 2026-10-12T15:51:50.695576454Z Ce-Type: dev.chainguard.api.platform.registry.chart.added.v1 Content-Length: 208 Content-Type: application/json @@ -1547,7 +1547,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/repos Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific repository -Ce-Time: 2026-10-08T18:22:23.427857384Z +Ce-Time: 2026-10-12T15:51:50.69001255Z Ce-Type: dev.chainguard.api.platform.registry.repo.created.v1 Content-Length: 243 Content-Type: application/json @@ -1589,7 +1589,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/repos Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific repository -Ce-Time: 2026-10-08T18:22:23.428051757Z +Ce-Time: 2026-10-12T15:51:50.690228904Z Ce-Type: dev.chainguard.api.platform.registry.repo.updated.v1 Content-Length: 243 Content-Type: application/json @@ -1631,7 +1631,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/repos Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific repository -Ce-Time: 2026-10-08T18:22:23.429488856Z +Ce-Time: 2026-10-12T15:51:50.69245432Z Ce-Type: dev.chainguard.api.platform.registry.repo.deleted.v1 Content-Length: 116 Content-Type: application/json @@ -1668,7 +1668,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/tags Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific tag -Ce-Time: 2026-10-08T18:22:23.429624836Z +Ce-Time: 2026-10-12T15:51:50.692617494Z Ce-Type: dev.chainguard.api.platform.registry.tag.created.v1 Content-Length: 197 Content-Type: application/json @@ -1707,7 +1707,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/tags Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific tag -Ce-Time: 2026-10-08T18:22:23.429763936Z +Ce-Time: 2026-10-12T15:51:50.692724311Z Ce-Type: dev.chainguard.api.platform.registry.tag.updated.v1 Content-Length: 197 Content-Type: application/json @@ -1746,7 +1746,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/tags Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific tag -Ce-Time: 2026-10-08T18:22:23.429905772Z +Ce-Time: 2026-10-12T15:51:50.692816025Z Ce-Type: dev.chainguard.api.platform.registry.tag.deleted.v1 Content-Length: 109 Content-Type: application/json @@ -1785,7 +1785,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/policies/v1/bindings Ce-Specversion: 1.0 Ce-Subject: UIDP of the binding -Ce-Time: 2026-10-08T18:22:23.431522651Z +Ce-Time: 2026-10-12T15:51:50.675088485Z Ce-Type: dev.chainguard.api.policies.bindings.created.v1 Content-Length: 245 Content-Type: application/json @@ -1829,7 +1829,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/policies/v1/bindings Ce-Specversion: 1.0 Ce-Subject: UIDP of the binding -Ce-Time: 2026-10-08T18:22:23.431701376Z +Ce-Time: 2026-10-12T15:51:50.675332717Z Ce-Type: dev.chainguard.api.policies.bindings.updated.v1 Content-Length: 245 Content-Type: application/json @@ -1873,7 +1873,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/policies/v1/bindings Ce-Specversion: 1.0 Ce-Subject: UIDP of the binding -Ce-Time: 2026-10-08T18:22:23.431835724Z +Ce-Time: 2026-10-12T15:51:50.675605532Z Ce-Type: dev.chainguard.api.policies.bindings.deleted.v1 Content-Length: 93 Content-Type: application/json @@ -1912,7 +1912,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/policies/v1/overrides Ce-Specversion: 1.0 Ce-Subject: UIDP of the override -Ce-Time: 2026-10-08T18:22:23.432010098Z +Ce-Time: 2026-10-12T15:51:50.675873826Z Ce-Type: dev.chainguard.api.policies.overrides.created.v1 Content-Length: 303 Content-Type: application/json @@ -1954,7 +1954,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/policies/v1/overrides Ce-Specversion: 1.0 Ce-Subject: UIDP of the override -Ce-Time: 2026-10-08T18:22:23.432175766Z +Ce-Time: 2026-10-12T15:51:50.676105171Z Ce-Type: dev.chainguard.api.policies.overrides.deleted.v1 Content-Length: 94 Content-Type: application/json @@ -1993,7 +1993,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/policies/v1/policies Ce-Specversion: 1.0 Ce-Subject: UIDP of the policy -Ce-Time: 2026-10-08T18:22:23.430957691Z +Ce-Time: 2026-10-12T15:51:50.674330646Z Ce-Type: dev.chainguard.api.policies.policies.created.v1 Content-Length: 337 Content-Type: application/json @@ -2037,7 +2037,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/policies/v1/policies Ce-Specversion: 1.0 Ce-Subject: UIDP of the policy -Ce-Time: 2026-10-08T18:22:23.431162961Z +Ce-Time: 2026-10-12T15:51:50.674629275Z Ce-Type: dev.chainguard.api.policies.policies.updated.v1 Content-Length: 337 Content-Type: application/json @@ -2081,7 +2081,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/policies/v1/policies Ce-Specversion: 1.0 Ce-Subject: UIDP of the policy -Ce-Time: 2026-10-08T18:22:23.431301085Z +Ce-Time: 2026-10-12T15:51:50.674868531Z Ce-Type: dev.chainguard.api.policies.policies.deleted.v1 Content-Length: 92 Content-Type: application/json @@ -2120,7 +2120,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/accountAssociations Ce-Specversion: 1.0 Ce-Subject: UIDP with which this account information is associated -Ce-Time: 2026-10-08T18:22:23.424746885Z +Ce-Time: 2026-10-12T15:51:50.676418863Z Ce-Type: dev.chainguard.api.iam.account_associations.created.v1 Content-Length: 385 Content-Type: application/json @@ -2166,7 +2166,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/accountAssociations Ce-Specversion: 1.0 Ce-Subject: UIDP of the group whose associations will be deleted -Ce-Time: 2026-10-08T18:22:23.424973659Z +Ce-Time: 2026-10-12T15:51:50.676692069Z Ce-Type: dev.chainguard.api.iam.account_associations.deleted.v1 Content-Length: 129 Content-Type: application/json @@ -2203,7 +2203,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/accountAssociations Ce-Specversion: 1.0 Ce-Subject: UIDP with which this account information is associated -Ce-Time: 2026-10-08T18:22:23.425173425Z +Ce-Time: 2026-10-12T15:51:50.676892432Z Ce-Type: dev.chainguard.api.iam.account_associations.updated.v1 Content-Length: 336 Content-Type: application/json @@ -2251,7 +2251,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/externalGroupRoleMappings Ce-Specversion: 1.0 Ce-Subject: UIDP of the mapping -Ce-Time: 2026-10-08T18:22:23.436215141Z +Ce-Time: 2026-10-12T15:51:50.686180671Z Ce-Type: dev.chainguard.api.iam.external_group_role_mappings.created.v1 Content-Length: 290 Content-Type: application/json @@ -2292,7 +2292,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/externalGroupRoleMappings Ce-Specversion: 1.0 Ce-Subject: UIDP of the mapping -Ce-Time: 2026-10-08T18:22:23.436327912Z +Ce-Time: 2026-10-12T15:51:50.686364467Z Ce-Type: dev.chainguard.api.iam.external_group_role_mappings.deleted.v1 Content-Length: 93 Content-Type: application/json @@ -2329,7 +2329,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/externalGroupRoleMappings:batchDelete Ce-Specversion: 1.0 Ce-Subject: UIDP of the identity provider -Ce-Time: 2026-10-08T18:22:23.436456036Z +Ce-Time: 2026-10-12T15:51:50.68649761Z Ce-Type: dev.chainguard.api.iam.external_group_role_mappings.deleted.batch.v1 Content-Length: 346 Content-Type: application/json @@ -2377,7 +2377,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/groupInvites Ce-Specversion: 1.0 Ce-Subject: group UIDP under which this invite resides -Ce-Time: 2026-10-08T18:22:23.440274268Z +Ce-Time: 2026-10-12T15:51:50.686717012Z Ce-Type: dev.chainguard.api.iam.group_invite.created.v1 Content-Length: 145 Content-Type: application/json @@ -2417,7 +2417,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/groupInvites Ce-Specversion: 1.0 Ce-Subject: UIDP of the record -Ce-Time: 2026-10-08T18:22:23.440462193Z +Ce-Time: 2026-10-12T15:51:50.686849771Z Ce-Type: dev.chainguard.api.iam.group_invite.deleted.v1 Content-Length: 92 Content-Type: application/json @@ -2456,7 +2456,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/groups Ce-Specversion: 1.0 Ce-Subject: UIDP of the record -Ce-Time: 2026-10-08T18:22:23.436790678Z +Ce-Time: 2026-10-12T15:51:50.687419526Z Ce-Type: dev.chainguard.api.iam.group.deleted.v1 Content-Length: 92 Content-Type: application/json @@ -2493,7 +2493,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/groups Ce-Specversion: 1.0 Ce-Subject: group UIDP under which this group resides -Ce-Time: 2026-10-08T18:22:23.436908105Z +Ce-Time: 2026-10-12T15:51:50.68760689Z Ce-Type: dev.chainguard.api.iam.group.created.v1 Content-Length: 169 Content-Type: application/json @@ -2532,7 +2532,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/groups Ce-Specversion: 1.0 Ce-Subject: group UIDP under which this group resides -Ce-Time: 2026-10-08T18:22:23.436996508Z +Ce-Time: 2026-10-12T15:51:50.687785447Z Ce-Type: dev.chainguard.api.iam.group.updated.v1 Content-Length: 169 Content-Type: application/json @@ -2573,7 +2573,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/identities Ce-Specversion: 1.0 Ce-Subject: UIDP of identity -Ce-Time: 2026-10-08T18:22:23.432488312Z +Ce-Time: 2026-10-12T15:51:50.671997805Z Ce-Type: dev.chainguard.api.iam.identity.created.v1 Content-Length: 329 Content-Type: application/json @@ -2616,7 +2616,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/identities Ce-Specversion: 1.0 Ce-Subject: UIDP of the record -Ce-Time: 2026-10-08T18:22:23.432699462Z +Ce-Time: 2026-10-12T15:51:50.672200696Z Ce-Type: dev.chainguard.api.iam.identity.deleted.v1 Content-Length: 92 Content-Type: application/json @@ -2653,7 +2653,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/identities Ce-Specversion: 1.0 Ce-Subject: The unique identifier of this specific identity -Ce-Time: 2026-10-08T18:22:23.432850098Z +Ce-Time: 2026-10-12T15:51:50.672325432Z Ce-Type: dev.chainguard.api.iam.identity.updated.v1 Content-Length: 245 Content-Type: application/json @@ -2693,7 +2693,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/identities:updateIdentityMetadata Ce-Specversion: 1.0 Ce-Subject: The caller's identity UID -Ce-Time: 2026-10-08T18:22:23.432990086Z +Ce-Time: 2026-10-12T15:51:50.672475702Z Ce-Type: dev.chainguard.api.iam.identity.metadata.updated.v1 Content-Length: 135 Content-Type: application/json @@ -2733,7 +2733,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of identity provider -Ce-Time: 2026-10-08T18:22:23.434742114Z +Ce-Time: 2026-10-12T15:51:50.693038906Z Ce-Type: dev.chainguard.api.iam.identity_providers.created.v1 Content-Length: 378 Content-Type: application/json @@ -2776,7 +2776,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/identityProviders Ce-Specversion: 1.0 Ce-Subject: The UIDP of the IAM group to nest this identity provider under -Ce-Time: 2026-10-08T18:22:23.434868405Z +Ce-Time: 2026-10-12T15:51:50.69316121Z Ce-Type: dev.chainguard.api.iam.identity_providers.updated.v1 Content-Length: 279 Content-Type: application/json @@ -2816,7 +2816,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of the IdP -Ce-Time: 2026-10-08T18:22:23.434969344Z +Ce-Time: 2026-10-12T15:51:50.693251021Z Ce-Type: dev.chainguard.api.iam.identity_providers.deleted.v1 Content-Length: 89 Content-Type: application/json @@ -2853,7 +2853,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of the identity provider -Ce-Time: 2026-10-08T18:22:23.435052243Z +Ce-Time: 2026-10-12T15:51:50.693367901Z Ce-Type: dev.chainguard.api.iam.identity_providers.scim_token.generated.v1 Content-Length: 250 Content-Type: application/json @@ -2893,7 +2893,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of the identity provider -Ce-Time: 2026-10-08T18:22:23.435150982Z +Ce-Time: 2026-10-12T15:51:50.693467935Z Ce-Type: dev.chainguard.api.iam.identity_providers.scim_token.regenerated.v1 Content-Length: 319 Content-Type: application/json @@ -2937,7 +2937,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of the identity provider -Ce-Time: 2026-10-08T18:22:23.435256033Z +Ce-Time: 2026-10-12T15:51:50.693568264Z Ce-Type: dev.chainguard.api.iam.identity_providers.scim_token.revoked.v1 Content-Length: 189 Content-Type: application/json @@ -2976,7 +2976,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of the identity provider -Ce-Time: 2026-10-08T18:22:23.435400997Z +Ce-Time: 2026-10-12T15:51:50.693668186Z Ce-Type: dev.chainguard.api.iam.identity_providers.scim_enabled.updated.v1 Content-Length: 187 Content-Type: application/json @@ -3017,7 +3017,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/overlayBindings Ce-Specversion: 1.0 Ce-Subject: The identifier of this overlay binding -Ce-Time: 2026-10-08T18:22:23.43838018Z +Ce-Time: 2026-10-12T15:51:50.678455075Z Ce-Type: dev.chainguard.api.platform.registry.overlay_binding.created.v1 Content-Length: 449 Content-Type: application/json @@ -3072,7 +3072,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/overlayBindings Ce-Specversion: 1.0 Ce-Subject: The identifier of this overlay binding -Ce-Time: 2026-10-08T18:22:23.438614443Z +Ce-Time: 2026-10-12T15:51:50.678722306Z Ce-Type: dev.chainguard.api.platform.registry.overlay_binding.updated.v1 Content-Length: 449 Content-Type: application/json @@ -3127,7 +3127,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/overlayBindings Ce-Specversion: 1.0 Ce-Subject: The identifier of the deleted overlay binding -Ce-Time: 2026-10-08T18:22:23.438844146Z +Ce-Time: 2026-10-12T15:51:50.67889839Z Ce-Type: dev.chainguard.api.platform.registry.overlay_binding.deleted.v1 Content-Length: 120 Content-Type: application/json @@ -3166,7 +3166,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/overlays Ce-Specversion: 1.0 Ce-Subject: The identifier of this overlay -Ce-Time: 2026-10-08T18:22:23.433826159Z +Ce-Time: 2026-10-12T15:51:50.694810952Z Ce-Type: dev.chainguard.api.platform.registry.overlay.created.v1 Content-Length: 224 Content-Type: application/json @@ -3211,7 +3211,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/overlays Ce-Specversion: 1.0 Ce-Subject: The identifier of this overlay -Ce-Time: 2026-10-08T18:22:23.43399466Z +Ce-Time: 2026-10-12T15:51:50.694970165Z Ce-Type: dev.chainguard.api.platform.registry.overlay.updated.v1 Content-Length: 224 Content-Type: application/json @@ -3256,7 +3256,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/overlays Ce-Specversion: 1.0 Ce-Subject: The identifier of the deleted overlay -Ce-Time: 2026-10-08T18:22:23.434109743Z +Ce-Time: 2026-10-12T15:51:50.695145738Z Ce-Type: dev.chainguard.api.platform.registry.overlay.deleted.v1 Content-Length: 112 Content-Type: application/json @@ -3295,7 +3295,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/repos Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific repository -Ce-Time: 2026-10-08T18:22:23.437328141Z +Ce-Time: 2026-10-12T15:51:50.69422199Z Ce-Type: dev.chainguard.api.platform.registry.repo.created.v1 Content-Length: 243 Content-Type: application/json @@ -3337,7 +3337,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/repos Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific repository -Ce-Time: 2026-10-08T18:22:23.437676704Z +Ce-Time: 2026-10-12T15:51:50.694322759Z Ce-Type: dev.chainguard.api.platform.registry.repo.updated.v1 Content-Length: 243 Content-Type: application/json @@ -3379,7 +3379,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/repos Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific repository -Ce-Time: 2026-10-08T18:22:23.437873989Z +Ce-Time: 2026-10-12T15:51:50.694470806Z Ce-Type: dev.chainguard.api.platform.registry.repo.deleted.v1 Content-Length: 116 Content-Type: application/json @@ -3416,7 +3416,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/repos Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific repository -Ce-Time: 2026-10-08T18:22:23.438014713Z +Ce-Time: 2026-10-12T15:51:50.694613804Z Ce-Type: dev.chainguard.api.platform.registry.repo.updated.v1 Content-Length: 243 Content-Type: application/json @@ -3460,7 +3460,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/roleBindings Ce-Specversion: 1.0 Ce-Subject: UIDP of the Role to bind -Ce-Time: 2026-10-08T18:22:23.430169404Z +Ce-Time: 2026-10-12T15:51:50.693804649Z Ce-Type: dev.chainguard.api.iam.rolebindings.created.v1 Content-Length: 261 Content-Type: application/json @@ -3502,7 +3502,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/roleBindings Ce-Specversion: 1.0 Ce-Subject: UID of the record -Ce-Time: 2026-10-08T18:22:23.430389106Z +Ce-Time: 2026-10-12T15:51:50.693910298Z Ce-Type: dev.chainguard.api.iam.rolebindings.deleted.v1 Content-Length: 91 Content-Type: application/json @@ -3539,7 +3539,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/roleBindings:batchCreate Ce-Specversion: 1.0 Ce-Subject: UID of this role binding, under a parent group UIDP -Ce-Time: 2026-10-08T18:22:23.430566999Z +Ce-Time: 2026-10-12T15:51:50.693996708Z Ce-Type: dev.chainguard.api.iam.rolebindings.created.batch.v1 Content-Length: 220 Content-Type: application/json @@ -3582,7 +3582,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/roleBindings Ce-Specversion: 1.0 Ce-Subject: UID of this role binding -Ce-Time: 2026-10-08T18:22:23.43072282Z +Ce-Time: 2026-10-12T15:51:50.694081687Z Ce-Type: dev.chainguard.api.iam.rolebindings.updated.v1 Content-Length: 173 Content-Type: application/json @@ -3623,7 +3623,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/roles Ce-Specversion: 1.0 Ce-Subject: UIDP of the role under the group -Ce-Time: 2026-10-08T18:22:23.424038376Z +Ce-Time: 2026-10-12T15:51:50.679850289Z Ce-Type: dev.chainguard.api.iam.roles.created.v1 Content-Length: 159 Content-Type: application/json @@ -3662,7 +3662,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/roles Ce-Specversion: 1.0 Ce-Subject: UIDP of the role under the group -Ce-Time: 2026-10-08T18:22:23.424274967Z +Ce-Time: 2026-10-12T15:51:50.680043676Z Ce-Type: dev.chainguard.api.iam.roles.updated.v1 Content-Length: 159 Content-Type: application/json @@ -3701,7 +3701,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/roles Ce-Specversion: 1.0 Ce-Subject: UIDP of the role to delete -Ce-Time: 2026-10-08T18:22:23.424482125Z +Ce-Time: 2026-10-12T15:51:50.680177771Z Ce-Type: dev.chainguard.api.iam.roles.deleted.v1 Content-Length: 101 Content-Type: application/json @@ -3740,7 +3740,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/tags Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific tag -Ce-Time: 2026-10-08T18:22:23.4254028Z +Ce-Time: 2026-10-12T15:51:50.682492269Z Ce-Type: dev.chainguard.api.platform.registry.tag.created.v1 Content-Length: 197 Content-Type: application/json @@ -3779,7 +3779,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v2beta1/tags Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific tag -Ce-Time: 2026-10-08T18:22:23.425591461Z +Ce-Time: 2026-10-12T15:51:50.683654554Z Ce-Type: dev.chainguard.api.platform.registry.tag.deleted.v1 Content-Length: 109 Content-Type: application/json @@ -3818,7 +3818,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v2beta1/terms Ce-Specversion: 1.0 Ce-Subject: Chainguard UIDP of the organization -Ce-Time: 2026-10-08T18:22:23.437138512Z +Ce-Time: 2026-10-12T15:51:50.674059448Z Ce-Type: dev.chainguard.api.iam.terms.accepted.v1 Content-Length: 159 Content-Type: application/json diff --git a/content/platform/chainctl/chainctl-docs/chainctl.md b/content/platform/chainctl/chainctl-docs/chainctl.md index 6911995723..81ecea7770 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl.md +++ b/content/platform/chainctl/chainctl-docs/chainctl.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl" slug: chainctl url: /platform/chainctl/chainctl-docs/chainctl/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_actions.md b/content/platform/chainctl/chainctl-docs/chainctl_actions.md index 471323b87d..22bf4ea41b 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_actions.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_actions.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl actions" slug: chainctl_actions url: /platform/chainctl/chainctl-docs/chainctl_actions/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_actions_catalog.md b/content/platform/chainctl/chainctl-docs/chainctl_actions_catalog.md index 81dc2d7698..3d2a5903e7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_actions_catalog.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_actions_catalog.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl actions catalog" slug: chainctl_actions_catalog url: /platform/chainctl/chainctl-docs/chainctl_actions_catalog/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_actions_catalog_list.md b/content/platform/chainctl/chainctl-docs/chainctl_actions_catalog_list.md index 8a56fa0ef4..f4919b73e2 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_actions_catalog_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_actions_catalog_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl actions catalog list" slug: chainctl_actions_catalog_list url: /platform/chainctl/chainctl-docs/chainctl_actions_catalog_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_actions_discover.md b/content/platform/chainctl/chainctl-docs/chainctl_actions_discover.md index e9ee4a1304..cedf9ef203 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_actions_discover.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_actions_discover.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl actions discover" slug: chainctl_actions_discover url: /platform/chainctl/chainctl-docs/chainctl_actions_discover/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements.md b/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements.md index bb22c8e388..0135952047 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl actions entitlements" slug: chainctl_actions_entitlements url: /platform/chainctl/chainctl-docs/chainctl_actions_entitlements/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_create.md b/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_create.md index 24a6ded2a4..cc6ccc3738 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl actions entitlements create" slug: chainctl_actions_entitlements_create url: /platform/chainctl/chainctl-docs/chainctl_actions_entitlements_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_delete.md index 71249850b4..a69a51b391 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl actions entitlements delete" slug: chainctl_actions_entitlements_delete url: /platform/chainctl/chainctl-docs/chainctl_actions_entitlements_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_list.md b/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_list.md index 05bd1882a9..dfac4734bd 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_actions_entitlements_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl actions entitlements list" slug: chainctl_actions_entitlements_list url: /platform/chainctl/chainctl-docs/chainctl_actions_entitlements_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_actions_list.md b/content/platform/chainctl/chainctl-docs/chainctl_actions_list.md index 343b14626c..371b809b14 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_actions_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_actions_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl actions list" slug: chainctl_actions_list url: /platform/chainctl/chainctl-docs/chainctl_actions_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_agent.md b/content/platform/chainctl/chainctl-docs/chainctl_agent.md index 03b3a5caf7..6d8a87efc4 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_agent.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_agent.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl agent" slug: chainctl_agent url: /platform/chainctl/chainctl-docs/chainctl_agent/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_agent_accept-terms.md b/content/platform/chainctl/chainctl-docs/chainctl_agent_accept-terms.md index b1d3bc94f3..17a911a47f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_agent_accept-terms.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_agent_accept-terms.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl agent accept-terms" slug: chainctl_agent_accept-terms url: /platform/chainctl/chainctl-docs/chainctl_agent_accept-terms/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth.md b/content/platform/chainctl/chainctl-docs/chainctl_auth.md index ce9fcfefc9..82d74c9703 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth" slug: chainctl_auth url: /platform/chainctl/chainctl-docs/chainctl_auth/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-docker.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-docker.md index 9cecb63c14..6632fe5757 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-docker.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-docker.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth configure-docker" slug: chainctl_auth_configure-docker url: /platform/chainctl/chainctl-docs/chainctl_auth_configure-docker/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-npm.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-npm.md index 426a2c22d4..418d33576e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-npm.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-npm.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth configure-npm" slug: chainctl_auth_configure-npm url: /platform/chainctl/chainctl-docs/chainctl_auth_configure-npm/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service.md index c34ddd3788..6ad954c492 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth configure-refresh-service" slug: chainctl_auth_configure-refresh-service url: /platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service_install.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service_install.md index 006c7ce58a..91d6188d0e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service_install.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service_install.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth configure-refresh-service install" slug: chainctl_auth_configure-refresh-service_install url: /platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service_install/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service_uninstall.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service_uninstall.md index 81b4395fdf..541b7f036c 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service_uninstall.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service_uninstall.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth configure-refresh-service uninstall" slug: chainctl_auth_configure-refresh-service_uninstall url: /platform/chainctl/chainctl-docs/chainctl_auth_configure-refresh-service_uninstall/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure.md index 5e890eda72..b919dda9c7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth configure" slug: chainctl_auth_configure url: /platform/chainctl/chainctl-docs/chainctl_auth_configure/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_docker.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_docker.md index 9502d9835d..01a562d31b 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_docker.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_docker.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth configure docker" slug: chainctl_auth_configure_docker url: /platform/chainctl/chainctl-docs/chainctl_auth_configure_docker/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_npm.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_npm.md index ccb70a1e9e..99a138087c 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_npm.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_npm.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth configure npm" slug: chainctl_auth_configure_npm url: /platform/chainctl/chainctl-docs/chainctl_auth_configure_npm/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_nuget.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_nuget.md index b96dbb3930..16b8034804 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_nuget.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_configure_nuget.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth configure nuget" slug: chainctl_auth_configure_nuget url: /platform/chainctl/chainctl-docs/chainctl_auth_configure_nuget/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_delete-account.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_delete-account.md index b47e93ab2f..579b6ae43f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_delete-account.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_delete-account.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth delete-account" slug: chainctl_auth_delete-account url: /platform/chainctl/chainctl-docs/chainctl_auth_delete-account/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_login.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_login.md index 577eb5c8e9..ef7eb8e7a7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_login.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_login.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth login" slug: chainctl_auth_login url: /platform/chainctl/chainctl-docs/chainctl_auth_login/ @@ -36,7 +36,7 @@ chainctl auth login [--invite-code=INVITE_CODE] [--identity-token=PATH_TO_TOKEN] ### Options ``` - --audience stringArray The Chainguard token audience to request. Can be specified multiple times. An interactive login for a platform audience (API, registry, apk, images, libraries, skills, uploads, and the hosted sandbox sessions and workflow runs) mints one refresh token covering all of them, so a single login serves every platform audience; any other audience is minted on its own. Defaults to the comma-separated list in $CHAINCTL_AUDIENCES when set. + --audience stringArray The Chainguard token audience to request. Can be specified multiple times. An interactive login for a platform audience (API, registry, apk, images, libraries, skills, uploads, the hosted sandbox sessions and workflow runs, and Facts analytics) mints one refresh token covering all of them, so a single login serves every platform audience; any other audience is minted on its own. When the cached session lacks any platform audience, the login signs in again rather than renewing it. Defaults to the comma-separated list in $CHAINCTL_AUDIENCES when set. --headless Skip browser authentication and use device flow. --identity string The unique ID of the identity to assume when logging in. --identity-provider string The unique ID of the customer managed identity provider to authenticate with. Mutually exclusive with --org-name. diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_logout.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_logout.md index 9863a90c39..71415d7ad0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_logout.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_logout.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth logout" slug: chainctl_auth_logout url: /platform/chainctl/chainctl-docs/chainctl_auth_logout/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token.md index 551058a7e3..23853558a5 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth pull-token" slug: chainctl_auth_pull-token url: /platform/chainctl/chainctl-docs/chainctl_auth_pull-token/ @@ -23,7 +23,7 @@ chainctl auth pull-token [flags] --description string Optional description for the pull token. --name string Optional name for the pull token. (default "pull-token") --parent string The IAM organization or folder with which the pull token identity is associated. - --repository string The repository type to create a pull token for. Must be one of: oci, apk, ruby, ruby_athena, java, python_athena, dotnet, go_athena, python, javascript, java_athena, javascript_athena, dotnet_athena, go. (default "oci") + --repository string The repository type to create a pull token for. Must be one of: oci, apk, java_athena, python_athena, javascript_athena, dotnet, dotnet_athena, java, javascript, go, go_athena, ruby, ruby_athena, python. (default "oci") --save Save the OCI registry pull token to the Docker configuration. --ttl ns Time To Live for the validity of the pull token. Valid unit strings range from nanoseconds to hours and are ns, `us`, `ms`, `s`, `m`, and `h`. Maximum value is 8760h or one year. (default 720h0m0s) ``` diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token_create.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token_create.md index 30964dec49..05ca739239 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth pull-token create" slug: chainctl_auth_pull-token_create url: /platform/chainctl/chainctl-docs/chainctl_auth_pull-token_create/ @@ -14,7 +14,7 @@ toc: true Create a pull token. ``` -chainctl auth pull-token create [--save=true|false] [--name=NAME] [--description=DESC] [--ttl=NUM_HOURS_ACTIVE] [--parent=PARENT] [--repository={oci|apk|ruby|ruby_athena|java|python_athena|dotnet|go_athena|python|javascript|java_athena|javascript_athena|dotnet_athena|go}] [flags] +chainctl auth pull-token create [--save=true|false] [--name=NAME] [--description=DESC] [--ttl=NUM_HOURS_ACTIVE] [--parent=PARENT] [--repository={oci|apk|java_athena|python_athena|javascript_athena|dotnet|dotnet_athena|java|javascript|go|go_athena|ruby|ruby_athena|python}] [flags] ``` ### Examples @@ -42,7 +42,7 @@ chainctl auth pull-token create [--save=true|false] [--name=NAME] [--description --description string Optional description for the pull token. --name string Optional name for the pull token. (default "pull-token") --parent string The IAM organization or folder with which the pull token identity is associated. - --repository string The repository type to create a pull token for. Must be one of: oci, apk, ruby, ruby_athena, java, python_athena, dotnet, go_athena, python, javascript, java_athena, javascript_athena, dotnet_athena, go. (default "oci") + --repository string The repository type to create a pull token for. Must be one of: oci, apk, java_athena, python_athena, javascript_athena, dotnet, dotnet_athena, java, javascript, go, go_athena, ruby, ruby_athena, python. (default "oci") --save Save the OCI registry pull token to the Docker configuration. --ttl ns Time To Live for the validity of the pull token. Valid unit strings range from nanoseconds to hours and are ns, `us`, `ms`, `s`, `m`, and `h`. Maximum value is 8760h or one year. (default 720h0m0s) ``` diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token_list.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token_list.md index 2f4588aa65..43ed13f7f7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_pull-token_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth pull-token list" slug: chainctl_auth_pull-token_list url: /platform/chainctl/chainctl-docs/chainctl_auth_pull-token_list/ @@ -14,7 +14,7 @@ toc: true List all pull-tokens ``` -chainctl auth pull-token list [--parent=PARENT] [--expired=true|false] [--repository={oci|apk|ruby|ruby_athena|java|python_athena|dotnet|go_athena|python|javascript|java_athena|javascript_athena|dotnet_athena|go}] [flags] +chainctl auth pull-token list [--parent=PARENT] [--expired=true|false] [--repository={oci|apk|java_athena|python_athena|javascript_athena|dotnet|dotnet_athena|java|javascript|go|go_athena|ruby|ruby_athena|python}] [flags] ``` ### Examples @@ -41,7 +41,7 @@ chainctl auth pull-token list [--parent=PARENT] [--expired=true|false] [--reposi ``` --expired If true return only expired pull tokens. --parent string The IAM organization or folder with which the pull-token identity is associated. - --repository string The repository type to list pull tokens for. Must be one of: oci, apk, ruby, ruby_athena, java, python_athena, dotnet, go_athena, python, javascript, java_athena, javascript_athena, dotnet_athena, go + --repository string The repository type to list pull tokens for. Must be one of: oci, apk, java_athena, python_athena, javascript_athena, dotnet, dotnet_athena, java, javascript, go, go_athena, ruby, ruby_athena, python ``` ### Options inherited from parent commands diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_status.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_status.md index eedf692689..d7da5cf581 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_status.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_status.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth status" slug: chainctl_auth_status url: /platform/chainctl/chainctl-docs/chainctl_auth_status/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_token.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_token.md index e7884019d0..13eb477b2c 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_token.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_token.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth token" slug: chainctl_auth_token url: /platform/chainctl/chainctl-docs/chainctl_auth_token/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_auth_token_capabilities.md b/content/platform/chainctl/chainctl-docs/chainctl_auth_token_capabilities.md index 2afed5a6bc..ebd6223d92 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_auth_token_capabilities.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_auth_token_capabilities.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl auth token capabilities" slug: chainctl_auth_token_capabilities url: /platform/chainctl/chainctl-docs/chainctl_auth_token_capabilities/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_config.md b/content/platform/chainctl/chainctl-docs/chainctl_config.md index daa25eb3c9..4540ce205e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_config.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_config.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl config" slug: chainctl_config url: /platform/chainctl/chainctl-docs/chainctl_config/ @@ -19,10 +19,10 @@ Local config file commands for chainctl. Every config property can also be set with an environment variable, which is useful for scripts and CI. Take the property name, uppercase it, replace dots -with underscores, and add a `CHAINGUARD_` prefix: +and hyphens with underscores, and add a `CHAINGUARD_` prefix: - `default.group` becomes `CHAINGUARD_DEFAULT_GROUP` - - `platform.api` becomes `CHAINGUARD_PLATFORM_API` + - `default.skip-version-check` becomes `CHAINGUARD_DEFAULT_SKIP_VERSION_CHECK` - `output.silent` becomes `CHAINGUARD_OUTPUT_SILENT` Environment variables take precedence over the config file, and command line diff --git a/content/platform/chainctl/chainctl-docs/chainctl_config_edit.md b/content/platform/chainctl/chainctl-docs/chainctl_config_edit.md index db4330f200..1c054bc8f7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_config_edit.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_config_edit.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl config edit" slug: chainctl_config_edit url: /platform/chainctl/chainctl-docs/chainctl_config_edit/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_config_reset.md b/content/platform/chainctl/chainctl-docs/chainctl_config_reset.md index 583219a386..20f622655f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_config_reset.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_config_reset.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl config reset" slug: chainctl_config_reset url: /platform/chainctl/chainctl-docs/chainctl_config_reset/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_config_save.md b/content/platform/chainctl/chainctl-docs/chainctl_config_save.md index 8995e12345..63b7e621f6 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_config_save.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_config_save.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl config save" slug: chainctl_config_save url: /platform/chainctl/chainctl-docs/chainctl_config_save/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_config_set.md b/content/platform/chainctl/chainctl-docs/chainctl_config_set.md index e63668d20e..03ec8529e1 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_config_set.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_config_set.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl config set" slug: chainctl_config_set url: /platform/chainctl/chainctl-docs/chainctl_config_set/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_config_unset.md b/content/platform/chainctl/chainctl-docs/chainctl_config_unset.md index c5b3b8f43d..dde863efaa 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_config_unset.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_config_unset.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl config unset" slug: chainctl_config_unset url: /platform/chainctl/chainctl-docs/chainctl_config_unset/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_config_validate.md b/content/platform/chainctl/chainctl-docs/chainctl_config_validate.md index 21c3b5cf33..59fa8883bf 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_config_validate.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_config_validate.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl config validate" slug: chainctl_config_validate url: /platform/chainctl/chainctl-docs/chainctl_config_validate/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_config_view.md b/content/platform/chainctl/chainctl-docs/chainctl_config_view.md index 804ab8d929..87d7a44bd3 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_config_view.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_config_view.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl config view" slug: chainctl_config_view url: /platform/chainctl/chainctl-docs/chainctl_config_view/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_events.md b/content/platform/chainctl/chainctl-docs/chainctl_events.md index 679207644e..b44e7fd3bb 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_events.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_events.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl events" slug: chainctl_events url: /platform/chainctl/chainctl-docs/chainctl_events/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions.md b/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions.md index 57e99f2b6c..39b326457e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl events subscriptions" slug: chainctl_events_subscriptions url: /platform/chainctl/chainctl-docs/chainctl_events_subscriptions/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_create.md b/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_create.md index 4869b4e0e9..bc7262b099 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl events subscriptions create" slug: chainctl_events_subscriptions_create url: /platform/chainctl/chainctl-docs/chainctl_events_subscriptions_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_delete.md index 736c0ca268..05e388e036 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl events subscriptions delete" slug: chainctl_events_subscriptions_delete url: /platform/chainctl/chainctl-docs/chainctl_events_subscriptions_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_list.md b/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_list.md index e5fa10c9d1..fa6f69d180 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_events_subscriptions_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl events subscriptions list" slug: chainctl_events_subscriptions_list url: /platform/chainctl/chainctl-docs/chainctl_events_subscriptions_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener.md index cfeaf8a36d..e97bfb6ac4 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener" slug: chainctl_guardener url: /platform/chainctl/chainctl-docs/chainctl_guardener/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_entitlement.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_entitlement.md index 21a053d0f1..fc5fc2a917 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_entitlement.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_entitlement.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener entitlement" slug: chainctl_guardener_entitlement url: /platform/chainctl/chainctl-docs/chainctl_guardener_entitlement/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_entitlement_get.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_entitlement_get.md index 6361b367d2..883080f30a 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_entitlement_get.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_entitlement_get.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener entitlement get" slug: chainctl_guardener_entitlement_get url: /platform/chainctl/chainctl-docs/chainctl_guardener_entitlement_get/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github.md index 77765933df..5c354570b7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener github" slug: chainctl_guardener_github url: /platform/chainctl/chainctl-docs/chainctl_guardener_github/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_link.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_link.md index fac08451bb..f572bbdb6d 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_link.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_link.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener github link" slug: chainctl_guardener_github_link url: /platform/chainctl/chainctl-docs/chainctl_guardener_github_link/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate.md index 4c20cbcec0..995b465620 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener github migrate" slug: chainctl_guardener_github_migrate url: /platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate/ @@ -33,4 +33,5 @@ Migrate the Actions and images enabled by a repository's configuration. * [chainctl guardener github](/platform/chainctl/chainctl-docs/chainctl_guardener_github/) - Link and unlink a GitHub organization to a Chainguard group. * [chainctl guardener github migrate create](/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_create/) - Enqueue the repository's configured Actions and image migrations. * [chainctl guardener github migrate get](/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_get/) - Show the state of a migration operation. +* [chainctl guardener github migrate list](/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_list/) - List a group's migration operations. diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_create.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_create.md index 9c2bcc1c91..1e5b20ea77 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener github migrate create" slug: chainctl_guardener_github_migrate_create url: /platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_get.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_get.md index 672c881f25..4a24d07bfd 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_get.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_get.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener github migrate get" slug: chainctl_guardener_github_migrate_get url: /platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_get/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_list.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_list.md new file mode 100644 index 0000000000..f51034c008 --- /dev/null +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_list.md @@ -0,0 +1,57 @@ +--- +date: 2026-10-12T15:51:44Z +title: "chainctl guardener github migrate list" +slug: chainctl_guardener_github_migrate_list +url: /platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate_list/ +draft: false +tags: ["chainctl", "Reference", "Product"] +images: [] +type: "article" +toc: true +--- +## chainctl guardener github migrate list + +List a group's migration operations. + +### Synopsis + +List a group's migration operations, newest first. + +Each migration started with "migrate create", from the console, or by the +scheduled resync is listed once. Pass its OPERATION to "migrate get" to see +each feature's pull request. Use --repo to list one repository's migrations. + +Listing requires guardener.actions.migrate or guardener.images.migrate on the +group. Operations for a feature you lack the permission for are left out. + +``` +chainctl guardener github migrate list [flags] +``` + +### Options + +``` + --limit int The most migrations to list. (default 20) + -o, --output string Output format: table or json. (default "table") + --parent string Name or UIDP of the Chainguard group whose migrations to list. Prompts interactively if omitted. + --repo string Only list migrations of this repository (a github.com URL or "owner/repo"). +``` + +### Options inherited from parent commands + +``` + --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev") + --audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev") + --config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly. + --console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev") + --force-color Force color output even when stdout is not a TTY. + -h, --help Help for chainctl + --issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev") + --log-level string Set the log level (debug, info) (default "ERROR") + -v, --v int Set the log verbosity level. +``` + +### SEE ALSO + +* [chainctl guardener github migrate](/platform/chainctl/chainctl-docs/chainctl_guardener_github_migrate/) - Migrate the Actions and images enabled by a repository's configuration. + diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_status.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_status.md index f8f05c3f3a..d2777484c0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_status.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_status.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener github status" slug: chainctl_guardener_github_status url: /platform/chainctl/chainctl-docs/chainctl_guardener_github_status/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_unlink.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_unlink.md index a4de4d7fc6..6d0ab27bd0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_unlink.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_github_unlink.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener github unlink" slug: chainctl_guardener_github_unlink url: /platform/chainctl/chainctl-docs/chainctl_guardener_github_unlink/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans.md index 75c142a3f1..38eec2aec3 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener scans" slug: chainctl_guardener_scans url: /platform/chainctl/chainctl-docs/chainctl_guardener_scans/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans_get.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans_get.md index c2a75f11ef..bbbf792ff0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans_get.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans_get.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener scans get" slug: chainctl_guardener_scans_get url: /platform/chainctl/chainctl-docs/chainctl_guardener_scans_get/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans_list.md b/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans_list.md index 2ccb982cf5..1a473a415c 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_guardener_scans_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl guardener scans list" slug: chainctl_guardener_scans_list url: /platform/chainctl/chainctl-docs/chainctl_guardener_scans_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam.md b/content/platform/chainctl/chainctl-docs/chainctl_iam.md index 61ea1d44e9..730ea1a9cd 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam" slug: chainctl_iam url: /platform/chainctl/chainctl-docs/chainctl_iam/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations.md index 166f4ad15a..cb84848f92 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations" slug: chainctl_iam_account-associations url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check.md index e4b6745924..33a3e5666f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations check" slug: chainctl_iam_account-associations_check url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_aws.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_aws.md index a89df6af8e..44233861bc 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_aws.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_aws.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations check aws" slug: chainctl_iam_account-associations_check_aws url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_aws/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_azure.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_azure.md index 6dc84cdddd..e1e3cc7b50 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_azure.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_azure.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations check azure" slug: chainctl_iam_account-associations_check_azure url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_azure/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_gcp.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_gcp.md index 5a66a0d2e5..6d772293bb 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_gcp.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_gcp.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations check gcp" slug: chainctl_iam_account-associations_check_gcp url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_check_gcp/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_describe.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_describe.md index dfe1aca41d..dbb1c794a0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_describe.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations describe" slug: chainctl_iam_account-associations_describe url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_describe/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set.md index 36f9522665..93c56f3cb9 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations set" slug: chainctl_iam_account-associations_set url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_aws.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_aws.md index 811f91bc10..233285a180 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_aws.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_aws.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations set aws" slug: chainctl_iam_account-associations_set_aws url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_aws/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_azure.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_azure.md index e5330a67c9..de2d9d0f89 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_azure.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_azure.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations set azure" slug: chainctl_iam_account-associations_set_azure url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_azure/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_gcp.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_gcp.md index 69a12b7ec4..264ea7dd68 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_gcp.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_gcp.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations set gcp" slug: chainctl_iam_account-associations_set_gcp url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_set_gcp/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset.md index eda7610fd2..c88513fa40 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations unset" slug: chainctl_iam_account-associations_unset url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_aws.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_aws.md index afea7e2ade..57b5062301 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_aws.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_aws.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations unset aws" slug: chainctl_iam_account-associations_unset_aws url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_aws/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_azure.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_azure.md index 4c48180ceb..b7895abe4e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_azure.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_azure.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations unset azure" slug: chainctl_iam_account-associations_unset_azure url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_azure/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_gcp.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_gcp.md index 1234d570c0..402fdf5c7a 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_gcp.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_gcp.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam account-associations unset gcp" slug: chainctl_iam_account-associations_unset_gcp url: /platform/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_gcp/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings.md index 467ade5208..769c9aa11f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam external-group-role-mappings" slug: chainctl_iam_external-group-role-mappings url: /platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_create.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_create.md index 4e709cf8d8..9a21fe044c 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam external-group-role-mappings create" slug: chainctl_iam_external-group-role-mappings_create url: /platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_delete.md index 5d68902842..a2ec616957 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam external-group-role-mappings delete" slug: chainctl_iam_external-group-role-mappings_delete url: /platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_list.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_list.md index f02f12be4a..fbbd99d850 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam external-group-role-mappings list" slug: chainctl_iam_external-group-role-mappings_list url: /platform/chainctl/chainctl-docs/chainctl_iam_external-group-role-mappings_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_folders.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_folders.md index c5490fa0b9..38065ac9fd 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_folders.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_folders.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam folders" slug: chainctl_iam_folders url: /platform/chainctl/chainctl-docs/chainctl_iam_folders/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_delete.md index eb8713a0b0..2dc927b6be 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam folders delete" slug: chainctl_iam_folders_delete url: /platform/chainctl/chainctl-docs/chainctl_iam_folders_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_describe.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_describe.md index b714c84a13..969488a5df 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_describe.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam folders describe" slug: chainctl_iam_folders_describe url: /platform/chainctl/chainctl-docs/chainctl_iam_folders_describe/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_list.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_list.md index ce145b936b..8aab8e9178 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam folders list" slug: chainctl_iam_folders_list url: /platform/chainctl/chainctl-docs/chainctl_iam_folders_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_update.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_update.md index 5e54884b43..3ed3bd9efd 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_update.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_folders_update.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam folders update" slug: chainctl_iam_folders_update url: /platform/chainctl/chainctl-docs/chainctl_iam_folders_update/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities.md index aa819b8821..7bfe044fa3 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities" slug: chainctl_iam_identities url: /platform/chainctl/chainctl-docs/chainctl_iam_identities/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create.md index d16d76e44e..0239def6a6 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities create" slug: chainctl_iam_identities_create url: /platform/chainctl/chainctl-docs/chainctl_iam_identities_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws.md index 642af1993e..68d945b236 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities create aws" slug: chainctl_iam_identities_create_aws url: /platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_role.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_role.md index f924394505..e81eb4a626 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_role.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_role.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities create aws role" slug: chainctl_iam_identities_create_aws_role url: /platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_role/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_user.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_user.md index 0241e11dfa..5b2b898d3f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_user.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_user.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities create aws user" slug: chainctl_iam_identities_create_aws_user url: /platform/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_user/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_delegate.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_delegate.md index e15958c33f..9141ca563b 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_delegate.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_delegate.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities create delegate" slug: chainctl_iam_identities_create_delegate url: /platform/chainctl/chainctl-docs/chainctl_iam_identities_create_delegate/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_github.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_github.md index 1b5ae44fce..e922d53d0e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_github.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_github.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities create github" slug: chainctl_iam_identities_create_github url: /platform/chainctl/chainctl-docs/chainctl_iam_identities_create_github/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_gitlab.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_gitlab.md index e63442fa78..160a5ac1ae 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_gitlab.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_create_gitlab.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities create gitlab" slug: chainctl_iam_identities_create_gitlab url: /platform/chainctl/chainctl-docs/chainctl_iam_identities_create_gitlab/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_delete.md index 79a33a0e9c..6c98a9006f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities delete" slug: chainctl_iam_identities_delete url: /platform/chainctl/chainctl-docs/chainctl_iam_identities_delete/ @@ -33,6 +33,9 @@ chainctl iam identities delete {IDENTITY_NAME | IDENTITY_ID | --expired [--paren # Delete all expired static identities in an organization chainctl iam identities delete --expired --parent=my-org + + # Delete all expired static identities in every location, even with default.group set + chainctl iam identities delete --expired --parent="" ``` ### Options diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_describe.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_describe.md index 0cd11651dd..613d3b0587 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_describe.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities describe" slug: chainctl_iam_identities_describe url: /platform/chainctl/chainctl-docs/chainctl_iam_identities_describe/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_list.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_list.md index f176def924..b05c538cdc 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities list" slug: chainctl_iam_identities_list url: /platform/chainctl/chainctl-docs/chainctl_iam_identities_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_update.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_update.md index 6bed71d006..e9b664170f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_update.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identities_update.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identities update" slug: chainctl_iam_identities_update url: /platform/chainctl/chainctl-docs/chainctl_iam_identities_update/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers.md index 7ea1ecf90e..84a87242a0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers" slug: chainctl_iam_identity-providers url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_create.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_create.md index a07510b91b..e9e92b8af0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers create" slug: chainctl_iam_identity-providers_create url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_delete.md index 3274087767..1b7261236a 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers delete" slug: chainctl_iam_identity-providers_delete url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_describe.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_describe.md index 73e0223084..fb815360e2 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_describe.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers describe" slug: chainctl_iam_identity-providers_describe url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_describe/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings.md index 5a7bdb1bd4..fb4ee14c53 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers group-mappings" slug: chainctl_iam_identity-providers_group-mappings url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_create.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_create.md index e9ecc6a2cf..c3f0b2fa00 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers group-mappings create" slug: chainctl_iam_identity-providers_group-mappings_create url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_delete.md index 367c12ed99..28149f8033 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers group-mappings delete" slug: chainctl_iam_identity-providers_group-mappings_delete url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_list.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_list.md index 3b1219bfa6..f258d89470 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers group-mappings list" slug: chainctl_iam_identity-providers_group-mappings_list url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_group-mappings_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_list.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_list.md index e7c21410da..31a8989b2d 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers list" slug: chainctl_iam_identity-providers_list url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim.md index e0f06bb2eb..665ec6d0a7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers scim" slug: chainctl_iam_identity-providers_scim url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_disable.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_disable.md index 2e4d6e375b..cf3c4021c2 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_disable.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_disable.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers scim disable" slug: chainctl_iam_identity-providers_scim_disable url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_disable/ @@ -13,6 +13,10 @@ toc: true Disable SCIM provisioning for an identity provider. +### Synopsis + +Disable SCIM provisioning for an identity provider. The identity provider's SCIM configuration is created when its first SCIM token is generated, so run `chainctl iam identity-providers scim token generate` before switching provisioning on or off. + ``` chainctl iam identity-providers scim disable IDENTITY_PROVIDER [flags] ``` diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_enable.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_enable.md index a418f10514..482cda92e2 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_enable.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_enable.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers scim enable" slug: chainctl_iam_identity-providers_scim_enable url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_enable/ @@ -13,6 +13,10 @@ toc: true Enable SCIM provisioning for an identity provider. +### Synopsis + +Enable SCIM provisioning for an identity provider. The identity provider's SCIM configuration is created when its first SCIM token is generated, so run `chainctl iam identity-providers scim token generate` before switching provisioning on or off. + ``` chainctl iam identity-providers scim enable IDENTITY_PROVIDER [flags] ``` diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token.md index 2ac2997d47..7513343020 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers scim token" slug: chainctl_iam_identity-providers_scim_token url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_generate.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_generate.md index a993ca65ed..2ddbe79724 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_generate.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_generate.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers scim token generate" slug: chainctl_iam_identity-providers_scim_token_generate url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_generate/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_regenerate.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_regenerate.md index 1e7caa1c0d..4dfb976d49 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_regenerate.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_regenerate.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers scim token regenerate" slug: chainctl_iam_identity-providers_scim_token_regenerate url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_regenerate/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_revoke.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_revoke.md index 72c9d63d04..5a77e004b7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_revoke.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_revoke.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers scim token revoke" slug: chainctl_iam_identity-providers_scim_token_revoke url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_token_revoke/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_users.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_users.md index fb00fb34e1..303bfed7e0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_users.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_users.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers scim users" slug: chainctl_iam_identity-providers_scim_users url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_users/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_users_list.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_users_list.md index cc196c2b74..043876d79b 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_users_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_users_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers scim users list" slug: chainctl_iam_identity-providers_scim_users_list url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_scim_users_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_update.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_update.md index b255ff2cd7..433a0e0c58 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_update.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_update.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam identity-providers update" slug: chainctl_iam_identity-providers_update url: /platform/chainctl/chainctl-docs/chainctl_iam_identity-providers_update/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_invites.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_invites.md index 10fa2b322d..528ba479cd 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_invites.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_invites.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam invites" slug: chainctl_iam_invites url: /platform/chainctl/chainctl-docs/chainctl_iam_invites/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_create.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_create.md index d005227ef4..06b0fc001f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam invites create" slug: chainctl_iam_invites_create url: /platform/chainctl/chainctl-docs/chainctl_iam_invites_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_delete.md index 6f39132706..0ec7c8d30d 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam invites delete" slug: chainctl_iam_invites_delete url: /platform/chainctl/chainctl-docs/chainctl_iam_invites_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_list.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_list.md index 3edf0a2016..bbcbfb6762 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_invites_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam invites list" slug: chainctl_iam_invites_list url: /platform/chainctl/chainctl-docs/chainctl_iam_invites_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations.md index 19fd735daa..b948c0ea07 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam organizations" slug: chainctl_iam_organizations url: /platform/chainctl/chainctl-docs/chainctl_iam_organizations/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_delete.md index 5e08a0a92e..e02215c97f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam organizations delete" slug: chainctl_iam_organizations_delete url: /platform/chainctl/chainctl-docs/chainctl_iam_organizations_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_describe.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_describe.md index 48bd69b8f6..a7a44ddc4a 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_describe.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam organizations describe" slug: chainctl_iam_organizations_describe url: /platform/chainctl/chainctl-docs/chainctl_iam_organizations_describe/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_list.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_list.md index e14137f327..ff8d9f2e45 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_organizations_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam organizations list" slug: chainctl_iam_organizations_list url: /platform/chainctl/chainctl-docs/chainctl_iam_organizations_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings.md index 7eb3fab2ef..28fa4ecf00 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam role-bindings" slug: chainctl_iam_role-bindings url: /platform/chainctl/chainctl-docs/chainctl_iam_role-bindings/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_create.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_create.md index 4b76526693..cb9ee26b9c 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam role-bindings create" slug: chainctl_iam_role-bindings_create url: /platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_delete.md index d11de77ca4..4b9b8227bc 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam role-bindings delete" slug: chainctl_iam_role-bindings_delete url: /platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_list.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_list.md index 14628107f0..048e06fe17 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam role-bindings list" slug: chainctl_iam_role-bindings_list url: /platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_update.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_update.md index a2b8846042..eb31a85b21 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_update.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_update.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam role-bindings update" slug: chainctl_iam_role-bindings_update url: /platform/chainctl/chainctl-docs/chainctl_iam_role-bindings_update/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles.md index ab527c6bc2..d8844f4457 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam roles" slug: chainctl_iam_roles url: /platform/chainctl/chainctl-docs/chainctl_iam_roles/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_capabilities.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_capabilities.md index ed66f8d271..9c7a770a9f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_capabilities.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_capabilities.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam roles capabilities" slug: chainctl_iam_roles_capabilities url: /platform/chainctl/chainctl-docs/chainctl_iam_roles_capabilities/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_capabilities_list.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_capabilities_list.md index 9c6afbe784..e87d239183 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_capabilities_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_capabilities_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam roles capabilities list" slug: chainctl_iam_roles_capabilities_list url: /platform/chainctl/chainctl-docs/chainctl_iam_roles_capabilities_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_create.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_create.md index 413bf89ceb..aecf99b4e3 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam roles create" slug: chainctl_iam_roles_create url: /platform/chainctl/chainctl-docs/chainctl_iam_roles_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_delete.md index d9dfd8f703..153e887e3d 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam roles delete" slug: chainctl_iam_roles_delete url: /platform/chainctl/chainctl-docs/chainctl_iam_roles_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_list.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_list.md index 7229429f52..4ac5e1a452 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam roles list" slug: chainctl_iam_roles_list url: /platform/chainctl/chainctl-docs/chainctl_iam_roles_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_update.md b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_update.md index c09cc387e8..96e5444f0f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_update.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_iam_roles_update.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl iam roles update" slug: chainctl_iam_roles_update url: /platform/chainctl/chainctl-docs/chainctl_iam_roles_update/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images.md b/content/platform/chainctl/chainctl-docs/chainctl_images.md index ce3a1ca864..8c7a04d6ad 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images" slug: chainctl_images url: /platform/chainctl/chainctl-docs/chainctl_images/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_advisories.md b/content/platform/chainctl/chainctl-docs/chainctl_images_advisories.md index 02fdae6d8f..d007d48562 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_advisories.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_advisories.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images advisories" slug: chainctl_images_advisories url: /platform/chainctl/chainctl-docs/chainctl_images_advisories/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_advisories_list.md b/content/platform/chainctl/chainctl-docs/chainctl_images_advisories_list.md index e8b5bf1364..788258acb1 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_advisories_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_advisories_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images advisories list" slug: chainctl_images_advisories_list url: /platform/chainctl/chainctl-docs/chainctl_images_advisories_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_catalog.md b/content/platform/chainctl/chainctl-docs/chainctl_images_catalog.md index 89b9434b8d..410c8bb720 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_catalog.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_catalog.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images catalog" slug: chainctl_images_catalog url: /platform/chainctl/chainctl-docs/chainctl_images_catalog/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_changelog.md b/content/platform/chainctl/chainctl-docs/chainctl_images_changelog.md index f76067a0df..99204615ac 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_changelog.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_changelog.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images changelog" slug: chainctl_images_changelog url: /platform/chainctl/chainctl-docs/chainctl_images_changelog/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_diff.md b/content/platform/chainctl/chainctl-docs/chainctl_images_diff.md index ed698026bf..fa68e75974 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_diff.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_diff.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images diff" slug: chainctl_images_diff url: /platform/chainctl/chainctl-docs/chainctl_images_diff/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_discover.md b/content/platform/chainctl/chainctl-docs/chainctl_images_discover.md index b460c915b5..d023b43c40 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_discover.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_discover.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images discover" slug: chainctl_images_discover url: /platform/chainctl/chainctl-docs/chainctl_images_discover/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_entitlements.md b/content/platform/chainctl/chainctl-docs/chainctl_images_entitlements.md index 5c9027c767..aade01ac05 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_entitlements.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_entitlements.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images entitlements" slug: chainctl_images_entitlements url: /platform/chainctl/chainctl-docs/chainctl_images_entitlements/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_entitlements_list.md b/content/platform/chainctl/chainctl-docs/chainctl_images_entitlements_list.md index 60fae564eb..532b3e9f89 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_entitlements_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_entitlements_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images entitlements list" slug: chainctl_images_entitlements_list url: /platform/chainctl/chainctl-docs/chainctl_images_entitlements_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_helm.md b/content/platform/chainctl/chainctl-docs/chainctl_images_helm.md index 4a85a0d974..9cc16ad0e2 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_helm.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_helm.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images helm" slug: chainctl_images_helm url: /platform/chainctl/chainctl-docs/chainctl_images_helm/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_helm_add-chart.md b/content/platform/chainctl/chainctl-docs/chainctl_images_helm_add-chart.md index 1f766d99e5..3bcb760a1d 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_helm_add-chart.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_helm_add-chart.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images helm add-chart" slug: chainctl_images_helm_add-chart url: /platform/chainctl/chainctl-docs/chainctl_images_helm_add-chart/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_helm_history.md b/content/platform/chainctl/chainctl-docs/chainctl_images_helm_history.md index 9d3f1ff2c8..ec7ec305d6 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_helm_history.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_helm_history.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images helm history" slug: chainctl_images_helm_history url: /platform/chainctl/chainctl-docs/chainctl_images_helm_history/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_helm_refs.md b/content/platform/chainctl/chainctl-docs/chainctl_images_helm_refs.md index bc96a73a70..5c61642eeb 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_helm_refs.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_helm_refs.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images helm refs" slug: chainctl_images_helm_refs url: /platform/chainctl/chainctl-docs/chainctl_images_helm_refs/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_helm_values.md b/content/platform/chainctl/chainctl-docs/chainctl_images_helm_values.md index db2809d894..3030f56df0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_helm_values.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_helm_values.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images helm values" slug: chainctl_images_helm_values url: /platform/chainctl/chainctl-docs/chainctl_images_helm_values/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_history.md b/content/platform/chainctl/chainctl-docs/chainctl_images_history.md index 4833cfbcf6..8c2de82eea 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_history.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_history.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images history" slug: chainctl_images_history url: /platform/chainctl/chainctl-docs/chainctl_images_history/ @@ -37,7 +37,7 @@ chainctl images history IMAGE[:TAG] [flags] ### Options ``` - --parent string Organization to view image history from Defaults to the default.group config value (env: CHAINGUARD_DEFAULT_GROUP). + --parent string Organization to view image history from. Defaults to the default.group config value (env: CHAINGUARD_DEFAULT_GROUP). --recursive Search repositories recursively through all descendants instead of just children ``` diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_list.md b/content/platform/chainctl/chainctl-docs/chainctl_images_list.md index 9dfef8b044..ddaa313b5a 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images list" slug: chainctl_images_list url: /platform/chainctl/chainctl-docs/chainctl_images_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays.md b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays.md index 213cdc7ca1..9c9b1f1398 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images overlays" slug: chainctl_images_overlays url: /platform/chainctl/chainctl-docs/chainctl_images_overlays/ @@ -19,8 +19,8 @@ Manage tag-based Custom Assembly overlays. An overlay is a reusable image customization (packages, environment variables, annotations, accounts, and certificates) owned by an -organization or folder. Attaching an overlay to a repo — or, with ---all-repos, to every repo in an organization, including repos created +organization. Attaching an overlay to a repo — or, with --all-repos, to +every repo under an organization or folder, including repos created later — creates a binding that selects which tags the overlay applies to: @@ -30,9 +30,11 @@ to: When bindings of different kinds match the same tag, they layer in the order ALL, then VARIANT, then EXACT, with later layers taking -precedence; a repo's own bindings layer above all-repos bindings. -Bindings of the same kind may coexist on a repo only when their -overlays do not conflict. +precedence. All-repos bindings layer by scope depth — the organization +first, then each nested folder, deeper folders taking precedence — and +a repo's own bindings layer above every all-repos binding. Bindings of +the same kind may coexist in one scope only when their overlays do not +conflict. The Guarded Entrypoint keys layer per key: fail_mode and command_override come from the most specific binding that sets them, and a binding that diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_attach.md b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_attach.md index 3a7232b29e..7e6c970219 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_attach.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_attach.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images overlays attach" slug: chainctl_images_overlays_attach url: /platform/chainctl/chainctl-docs/chainctl_images_overlays_attach/ @@ -17,8 +17,9 @@ Attach Custom Assembly overlays to a repo or to every repo in an organization. Attach one or more Custom Assembly overlays by creating a binding per overlay. A binding attaches an overlay to a single repo (--repo) or to -every repo in an organization (--all-repos), including repos created -after the binding exists. +every repo under an organization or folder (--all-repos with --parent +naming the organization or the folder), including repos created after +the binding exists. Every binding selects which tags its overlay applies to. Pass exactly one of: @@ -34,13 +35,15 @@ attached to a repo only once. Multiple overlays attach in the order given, one binding each; on a failure, the bindings already created are kept and the error names the overlay that failed. -An all-repos binding is owned by the organization and applies its -overlay to each repo's matching tags. An overlay can have at most one -all-repos binding per organization. When an all-repos binding and a -repo's own binding match the same tag, the repo's binding takes -precedence where both overlays set the same field, and their package -lists combine. Repos with a legacy customization keep the legacy -behavior; all-repos bindings do not apply to them. +An all-repos binding is owned by the organization or folder named by +--parent and applies its overlay to the matching tags of every repo +under that scope. An overlay can have at most one all-repos binding +per organization or folder. When bindings at several scopes match the +same tag, they layer by depth — the organization first, then each +nested folder — with deeper scopes taking precedence where both +overlays set the same field, the repo's own binding above all, and +their package lists combining. Repos with a legacy customization keep +the legacy behavior; all-repos bindings do not apply to them. The command prints each binding UID. Use them with "update-binding" and "detach", or look them up later with "chainctl images overlays list". @@ -59,6 +62,10 @@ chainctl images overlays attach [flags] # including repos created later chainctl images overlays attach --overlay my-overlay --all-repos --parent my-org --all + # Apply an overlay to every repo under a folder, including repos + # created later + chainctl images overlays attach --overlay my-overlay --all-repos --parent my-org/golden-images --all + # Apply two overlays to every tag of a repo chainctl images overlays attach --overlay my-certs,my-packages --repo python --parent my-org --all @@ -73,9 +80,9 @@ chainctl images overlays attach [flags] ``` --all Bind to every tag on the repo; multiple --all bindings may coexist when their overlays do not conflict. Mutually exclusive with --tag and --variant. - --all-repos Attach to every repo in the organization, including repos created later; mutually exclusive with --repo. + --all-repos Attach to every repo under the organization or folder named by --parent, including repos created later; mutually exclusive with --repo. --overlay strings Overlay to attach: UIDP or name (resolved within the repo's org). Comma separated and repeatable; each overlay gets its own binding with the same tag selector. - --parent string Org name or UIDP: the organization the binding is created under with --all-repos, or the org for resolving --repo by name (unused when --repo is a UIDP). If unset, auto-selects when the caller belongs to a single org, otherwise prompts. Defaults to the default.group config value (env: CHAINGUARD_DEFAULT_GROUP). + --parent string Org or folder name or UIDP: the scope the binding is created under with --all-repos, or the group for resolving --repo by name (unused when --repo is a UIDP). If unset, auto-selects when the caller belongs to a single org, otherwise prompts. Defaults to the default.group config value (env: CHAINGUARD_DEFAULT_GROUP). --repo string Target repo: UIDP, or name resolved within --parent. Mutually exclusive with --all-repos. --tag strings Exact tag names to bind to (repeatable). Mutually exclusive with --all and --variant. "all" and "dev" are not tags: use --all or --variant=dev. --variant string Bind to a tag variant: currently only "dev" (matches tags ending in -dev). Mutually exclusive with --tag and --all. diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_create.md b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_create.md index 86b2f13bd0..e063958d26 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images overlays create" slug: chainctl_images_overlays_create url: /platform/chainctl/chainctl-docs/chainctl_images_overlays_create/ @@ -15,7 +15,11 @@ Create a Custom Assembly overlay. ### Synopsis -Create a Custom Assembly overlay under an organization or folder. +Create a Custom Assembly overlay under an organization. + +Overlays are organization-level resources: one definition is +referencable from every scope. Attach scopes a binding to a single +repo, to a folder's repos, or to the whole organization. Pass the overlay configuration either as repeated --package flags, or as a YAML file with --file in the same shape that "chainctl images repos @@ -48,7 +52,7 @@ chainctl images overlays create [flags] ``` -f, --file chainctl images repos build The name of the YAML file containing the overlay configuration, the same shape chainctl images repos build accepts. Takes precedence over --package. --package strings Package to include (repeatable). - --parent string Parent group name or UIDP under which to create the overlay. Defaults to the default.group config value (env: CHAINGUARD_DEFAULT_GROUP). + --parent string Org name or UIDP under which to create the overlay; overlays are always organization-level. Defaults to the default.group config value (env: CHAINGUARD_DEFAULT_GROUP). --with-certificates strings Comma separated list of files to read the custom certificates from. --with-runtime-keys strings Comma separated list of files to read customer APK signing public keys from. Each file becomes a key in /etc/apk/keys named after the file's basename, which must match the filename referenced by the repository's APKINDEX signature (.SIGN.RSA256.). --with-runtime-repositories strings Comma separated list of runtime APK repository URLs to write to /etc/apk/repositories in the image. diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_delete.md index c8693e382b..9f737505c4 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images overlays delete" slug: chainctl_images_overlays_delete url: /platform/chainctl/chainctl-docs/chainctl_images_overlays_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_detach.md b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_detach.md index 776d306b4a..00e1235e2d 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_detach.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_detach.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images overlays detach" slug: chainctl_images_overlays_detach url: /platform/chainctl/chainctl-docs/chainctl_images_overlays_detach/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_list.md b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_list.md index ac5e68c334..c83f108f62 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images overlays list" slug: chainctl_images_overlays_list url: /platform/chainctl/chainctl-docs/chainctl_images_overlays_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_update-binding.md b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_update-binding.md index 3e203cddcf..76802c30e5 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_update-binding.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_update-binding.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images overlays update-binding" slug: chainctl_images_overlays_update-binding url: /platform/chainctl/chainctl-docs/chainctl_images_overlays_update-binding/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_update.md b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_update.md index 20fd1cb336..1c727511f1 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_update.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_overlays_update.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images overlays update" slug: chainctl_images_overlays_update url: /platform/chainctl/chainctl-docs/chainctl_images_overlays_update/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_repos.md b/content/platform/chainctl/chainctl-docs/chainctl_images_repos.md index b4bc7b8799..a7a0000660 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_repos.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_repos.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images repos" slug: chainctl_images_repos url: /platform/chainctl/chainctl-docs/chainctl_images_repos/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build.md b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build.md index 5a886e693e..bcdb297af0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images repos build" slug: chainctl_images_repos_build url: /platform/chainctl/chainctl-docs/chainctl_images_repos_build/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_apply.md b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_apply.md index c664667ab1..658c8e5128 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_apply.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_apply.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images repos build apply" slug: chainctl_images_repos_build_apply url: /platform/chainctl/chainctl-docs/chainctl_images_repos_build_apply/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_edit.md b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_edit.md index 3462103298..576d7d8ba4 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_edit.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_edit.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images repos build edit" slug: chainctl_images_repos_build_edit url: /platform/chainctl/chainctl-docs/chainctl_images_repos_build_edit/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_list.md b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_list.md index ae735235a2..971fcf02d9 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images repos build list" slug: chainctl_images_repos_build_list url: /platform/chainctl/chainctl-docs/chainctl_images_repos_build_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_logs.md b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_logs.md index 0b1d5a5dec..453fbafd6e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_logs.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_build_logs.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images repos build logs" slug: chainctl_images_repos_build_logs url: /platform/chainctl/chainctl-docs/chainctl_images_repos_build_logs/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_create.md b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_create.md index 35f75a8a26..8f27dcdd39 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images repos create" slug: chainctl_images_repos_create url: /platform/chainctl/chainctl-docs/chainctl_images_repos_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_delete.md index e03859f174..bba119e74e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images repos delete" slug: chainctl_images_repos_delete url: /platform/chainctl/chainctl-docs/chainctl_images_repos_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_list.md b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_list.md index 91ec092295..1f64da2ad1 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images repos list" slug: chainctl_images_repos_list url: /platform/chainctl/chainctl-docs/chainctl_images_repos_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_update.md b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_update.md index 73f96c4208..4c3ac038e3 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_repos_update.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_repos_update.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images repos update" slug: chainctl_images_repos_update url: /platform/chainctl/chainctl-docs/chainctl_images_repos_update/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_tags.md b/content/platform/chainctl/chainctl-docs/chainctl_images_tags.md index c28601c073..af97150c3c 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_tags.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_tags.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images tags" slug: chainctl_images_tags url: /platform/chainctl/chainctl-docs/chainctl_images_tags/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_tags_list.md b/content/platform/chainctl/chainctl-docs/chainctl_images_tags_list.md index e9d12517c6..4d9b02be71 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_tags_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_tags_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images tags list" slug: chainctl_images_tags_list url: /platform/chainctl/chainctl-docs/chainctl_images_tags_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_images_tags_resolve.md b/content/platform/chainctl/chainctl-docs/chainctl_images_tags_resolve.md index 3d3ee7db62..b274d4e336 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_images_tags_resolve.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_images_tags_resolve.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl images tags resolve" slug: chainctl_images_tags_resolve url: /platform/chainctl/chainctl-docs/chainctl_images_tags_resolve/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries.md index f934a2efff..3a9e8da9c5 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries" slug: chainctl_libraries url: /platform/chainctl/chainctl-docs/chainctl_libraries/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache.md index 6fc1fea17a..8fca6ea129 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries cache" slug: chainctl_libraries_cache url: /platform/chainctl/chainctl-docs/chainctl_libraries_cache/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_list.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_list.md index e52f19a4d9..12e300169a 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries cache list" slug: chainctl_libraries_cache_list url: /platform/chainctl/chainctl-docs/chainctl_libraries_cache_list/ @@ -31,7 +31,7 @@ chainctl libraries cache list [--ecosystem ECOSYSTEM] [--group G | --scope S | - --limit int32 Maximum number of entries to show. (default 100) --live Only list live entries (the ones that govern serving). --package string Only list entries for one package. Requires --ecosystem. - --parent string The name or id of the organization whose resolution cache to list. + --parent string The name or id of the organization whose resolution cache to list. Defaults to the default.group config value (env: CHAINGUARD_DEFAULT_GROUP). --registry string Only list entries for one registry. --scope string Only list entries under an npm scope prefix. Requires --ecosystem. --tier string Only list entries recording this tier (CHAINGUARD or UPSTREAM). diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_opt-in.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_opt-in.md index c43edd0fe4..200096c0ab 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_opt-in.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_opt-in.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries cache opt-in" slug: chainctl_libraries_cache_opt-in url: /platform/chainctl/chainctl-docs/chainctl_libraries_cache_opt-in/ @@ -26,7 +26,7 @@ chainctl libraries cache opt-in [--ecosystem ECOSYSTEM] [--parent ORG] [flags] ``` --ecosystem string Change one ecosystem (JAVA, PYTHON, JAVASCRIPT). Omit for all ecosystems. - --parent string The name or id of the organization whose opt-out to change. + --parent string The name or id of the organization whose opt-out to change. Defaults to the default.group config value (env: CHAINGUARD_DEFAULT_GROUP). ``` ### Options inherited from parent commands diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_opt-out.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_opt-out.md index 190ebc5603..25e3b7d660 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_opt-out.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_opt-out.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries cache opt-out" slug: chainctl_libraries_cache_opt-out url: /platform/chainctl/chainctl-docs/chainctl_libraries_cache_opt-out/ @@ -27,7 +27,7 @@ chainctl libraries cache opt-out [--ecosystem ECOSYSTEM] [--parent ORG] [flags] ``` --ecosystem string Change one ecosystem (JAVA, PYTHON, JAVASCRIPT). Omit for all ecosystems. - --parent string The name or id of the organization whose opt-out to change. + --parent string The name or id of the organization whose opt-out to change. Defaults to the default.group config value (env: CHAINGUARD_DEFAULT_GROUP). ``` ### Options inherited from parent commands diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_status.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_status.md index e0db5baf8c..a02fe7d643 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_status.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_status.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries cache status" slug: chainctl_libraries_cache_status url: /platform/chainctl/chainctl-docs/chainctl_libraries_cache_status/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_zap.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_zap.md index e40e2987c1..9e28461d41 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_zap.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_cache_zap.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries cache zap" slug: chainctl_libraries_cache_zap url: /platform/chainctl/chainctl-docs/chainctl_libraries_cache_zap/ @@ -33,7 +33,7 @@ chainctl libraries cache zap [--ecosystem ECOSYSTEM] [--group G | --scope S | -- --ecosystem string Scope the zap to one ecosystem (JAVA, PYTHON, JAVASCRIPT). Omit for an org-wide zap. --group string Zap a Maven group prefix (e.g. com.fasterxml.jackson). Requires --ecosystem. --package string Zap a single package (java: group:artifact). Requires --ecosystem. - --parent string The name or id of the organization whose resolution cache to zap. + --parent string The name or id of the organization whose resolution cache to zap. Defaults to the default.group config value (env: CHAINGUARD_DEFAULT_GROUP). --registry string Narrow a package or prefix zap to one registry. --scope string Zap an npm scope prefix (e.g. @angular). Requires --ecosystem. --version string Zap a single version. Requires --package. diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements.md index 14d484ea0d..deccd56d32 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries entitlements" slug: chainctl_libraries_entitlements url: /platform/chainctl/chainctl-docs/chainctl_libraries_entitlements/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_create.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_create.md index 0c33d29b3b..130a291fea 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries entitlements create" slug: chainctl_libraries_entitlements_create url: /platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_delete.md index 522e9579f4..25e0f424b2 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries entitlements delete" slug: chainctl_libraries_entitlements_delete url: /platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_list.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_list.md index 150b3e5cec..df0b377ecd 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries entitlements list" slug: chainctl_libraries_entitlements_list url: /platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_go.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_go.md index 4d8378f767..c6716d03ef 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_go.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_go.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries go" slug: chainctl_libraries_go url: /platform/chainctl/chainctl-docs/chainctl_libraries_go/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_go_upload.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_go_upload.md index 3b19a31f39..76a58fd8b3 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_go_upload.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_go_upload.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries go upload" slug: chainctl_libraries_go_upload url: /platform/chainctl/chainctl-docs/chainctl_libraries_go_upload/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages.md index 14e88f8f3f..5a5b2f052e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries packages" slug: chainctl_libraries_packages url: /platform/chainctl/chainctl-docs/chainctl_libraries_packages/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_blocked.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_blocked.md index 7e069cd89c..be9a263894 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_blocked.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_blocked.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries packages blocked" slug: chainctl_libraries_packages_blocked url: /platform/chainctl/chainctl-docs/chainctl_libraries_packages_blocked/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_count.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_count.md index 60b3978992..f0ef52ca84 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_count.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_count.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries packages count" slug: chainctl_libraries_packages_count url: /platform/chainctl/chainctl-docs/chainctl_libraries_packages_count/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_list.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_list.md index bc7977886c..c7980afa6a 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries packages list" slug: chainctl_libraries_packages_list url: /platform/chainctl/chainctl-docs/chainctl_libraries_packages_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_malware.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_malware.md index deca620837..95dedfd0a2 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_malware.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_malware.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries packages malware" slug: chainctl_libraries_packages_malware url: /platform/chainctl/chainctl-docs/chainctl_libraries_packages_malware/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_malware_list.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_malware_list.md index 48884fd595..0c91574b72 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_malware_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_malware_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries packages malware list" slug: chainctl_libraries_packages_malware_list url: /platform/chainctl/chainctl-docs/chainctl_libraries_packages_malware_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_versions.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_versions.md index 336047a97f..bad89fe7b4 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_versions.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_packages_versions.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries packages versions" slug: chainctl_libraries_packages_versions url: /platform/chainctl/chainctl-docs/chainctl_libraries_packages_versions/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy.md index 7c689593ad..c26959a114 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy" slug: chainctl_libraries_policy url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding.md index fe4a09e8f1..2454fc62c8 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy binding" slug: chainctl_libraries_policy_binding url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_create.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_create.md index f2c2f9548a..836b3970bb 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy binding create" slug: chainctl_libraries_policy_binding_create url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_delete.md index aeecc9e1c6..aa1aaae1a2 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy binding delete" slug: chainctl_libraries_policy_binding_delete url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_list.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_list.md index 958ff1d57e..cecc52bd91 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy binding list" slug: chainctl_libraries_policy_binding_list url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_update.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_update.md index 3b57c5fa5e..5fd6d4aa14 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_update.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_update.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy binding update" slug: chainctl_libraries_policy_binding_update url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_binding_update/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_create.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_create.md index dbbbed9c7c..0bdb1f4532 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy create" slug: chainctl_libraries_policy_create url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_delete.md index 93b0e0686b..2d45ac2ced 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy delete" slug: chainctl_libraries_policy_delete url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_describe.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_describe.md index 0795884c50..bcb0e5539a 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_describe.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy describe" slug: chainctl_libraries_policy_describe url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_describe/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_disable.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_disable.md index a5e9a17c85..95463d8c56 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_disable.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_disable.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy disable" slug: chainctl_libraries_policy_disable url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_disable/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_enable.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_enable.md index 5d7822044c..6c98fe5a42 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_enable.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_enable.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy enable" slug: chainctl_libraries_policy_enable url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_enable/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_list.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_list.md index 40b6f0e83a..a56879ccf7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy list" slug: chainctl_libraries_policy_list url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_update.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_update.md index 47d1c288bc..e23854356a 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_update.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_policy_update.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries policy update" slug: chainctl_libraries_policy_update url: /platform/chainctl/chainctl-docs/chainctl_libraries_policy_update/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_remediate.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_remediate.md index 7162a69686..6f0bde2ace 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_remediate.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_remediate.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries remediate" slug: chainctl_libraries_remediate url: /platform/chainctl/chainctl-docs/chainctl_libraries_remediate/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_storage.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_storage.md index ef1c691ee7..6a2986811e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_storage.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_storage.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries storage" slug: chainctl_libraries_storage url: /platform/chainctl/chainctl-docs/chainctl_libraries_storage/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_storage_list.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_storage_list.md index 16c08a4cdf..1777fd75bf 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_storage_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_storage_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries storage list" slug: chainctl_libraries_storage_list url: /platform/chainctl/chainctl-docs/chainctl_libraries_storage_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_update-hashes.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_update-hashes.md index 2075f8d2aa..584ac61689 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_update-hashes.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_update-hashes.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries update-hashes" slug: chainctl_libraries_update-hashes url: /platform/chainctl/chainctl-docs/chainctl_libraries_update-hashes/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_libraries_verify.md b/content/platform/chainctl/chainctl-docs/chainctl_libraries_verify.md index 53a85bc76c..49692747b7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_libraries_verify.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_libraries_verify.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl libraries verify" slug: chainctl_libraries_verify url: /platform/chainctl/chainctl-docs/chainctl_libraries_verify/ @@ -69,9 +69,9 @@ Remediated (CVE-patched) Java artifacts, whose versions carry a "-0.cgr." s (e.g. 3.5.0-0.cgr.2), are resolved from the java-remediated repository; other Java artifacts are resolved from the java repository. -Downloading SBOMs and attestations with --output-attestations is supported for -Java artifacts only. The flag has no effect for other ecosystems, and nothing is -written for them. +With --output-attestations, available SBOMs and attestations are saved under +each verified artifact's repository path in --output-dir. Unsupported inputs +produce no companion files. ``` chainctl libraries verify [path...] [flags] @@ -92,7 +92,7 @@ chainctl libraries verify [path...] [flags] # Analyze with JSON output chainctl libraries verify -o json build/libs/*.jar - # Download the SBOM and SLSA attestation alongside verification (Java artifacts only) + # Download available SBOMs and attestations alongside verification chainctl libraries verify commons-lang3-3.17.0.jar --output-attestations --output-dir ./attestations # Analyze container images @@ -128,8 +128,8 @@ chainctl libraries verify [path...] [flags] --ecosystems-url string URL for the Ecosystems Proxy (defaults to https://libraries.cgr.dev) --no-color Disable colored output -o, --output string Output format (text, json, yaml) (default "text") - --output-attestations Download the SBOM, SLSA attestation, and CycloneDX SBOMs into --output-dir. Java artifacts only; ignored for all other ecosystems - --output-dir string Base directory for files downloaded by --output-attestations, laid out under each Java artifact's Maven repository path. No effect without --output-attestations (default ".") + --output-attestations Download available SBOMs and attestations for verified artifacts into --output-dir; ignored for unsupported ecosystems + --output-dir string Base directory for files downloaded by --output-attestations, laid out under each artifact's repository path. No effect without --output-attestations (default ".") --parent string Parent organization for authentication --verbose Enable verbose output ``` diff --git a/content/platform/chainctl/chainctl-docs/chainctl_packages.md b/content/platform/chainctl/chainctl-docs/chainctl_packages.md index b97e644efd..70305d43b7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_packages.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_packages.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl packages" slug: chainctl_packages url: /platform/chainctl/chainctl-docs/chainctl_packages/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_packages_versions.md b/content/platform/chainctl/chainctl-docs/chainctl_packages_versions.md index 1d0adb1625..5fea8969e5 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_packages_versions.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_packages_versions.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl packages versions" slug: chainctl_packages_versions url: /platform/chainctl/chainctl-docs/chainctl_packages_versions/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_packages_versions_list.md b/content/platform/chainctl/chainctl-docs/chainctl_packages_versions_list.md index 597a185bf6..1285b2b05c 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_packages_versions_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_packages_versions_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl packages versions list" slug: chainctl_packages_versions_list url: /platform/chainctl/chainctl-docs/chainctl_packages_versions_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy.md b/content/platform/chainctl/chainctl-docs/chainctl_policy.md index fc60341095..fe30101ef2 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy" slug: chainctl_policy url: /platform/chainctl/chainctl-docs/chainctl_policy/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_binding.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_binding.md index ba8d19ca3d..9436bde17e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_binding.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_binding.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy binding" slug: chainctl_policy_binding url: /platform/chainctl/chainctl-docs/chainctl_policy_binding/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_create.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_create.md index 507ae5abcb..0ff313c4ba 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy binding create" slug: chainctl_policy_binding_create url: /platform/chainctl/chainctl-docs/chainctl_policy_binding_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_delete.md index cd4b6334b5..b31e69400e 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy binding delete" slug: chainctl_policy_binding_delete url: /platform/chainctl/chainctl-docs/chainctl_policy_binding_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_list.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_list.md index 742a2400f7..7bf11231c9 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_binding_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy binding list" slug: chainctl_policy_binding_list url: /platform/chainctl/chainctl-docs/chainctl_policy_binding_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_check.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_check.md index b4b32ab6fa..1d96019be1 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_check.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_check.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy check" slug: chainctl_policy_check url: /platform/chainctl/chainctl-docs/chainctl_policy_check/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_custom.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_custom.md index 9b823c347b..91c3bd5d91 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_custom.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_custom.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy custom" slug: chainctl_policy_custom url: /platform/chainctl/chainctl-docs/chainctl_policy_custom/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_create.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_create.md index af5aafb647..96439d4d81 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy custom create" slug: chainctl_policy_custom_create url: /platform/chainctl/chainctl-docs/chainctl_policy_custom_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_delete.md index 1c8dcb6c38..9f253a2b30 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy custom delete" slug: chainctl_policy_custom_delete url: /platform/chainctl/chainctl-docs/chainctl_policy_custom_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_update.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_update.md index ba5e6b0884..5b5c23913f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_update.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_update.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy custom update" slug: chainctl_policy_custom_update url: /platform/chainctl/chainctl-docs/chainctl_policy_custom_update/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_validate.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_validate.md index 9dc75ff4f2..05c185fef0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_validate.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_custom_validate.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy custom validate" slug: chainctl_policy_custom_validate url: /platform/chainctl/chainctl-docs/chainctl_policy_custom_validate/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_decision.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_decision.md index d26b02c478..578e2582a4 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_decision.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_decision.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy decision" slug: chainctl_policy_decision url: /platform/chainctl/chainctl-docs/chainctl_policy_decision/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_decision_list.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_decision_list.md index c9ffd87086..821b2077a2 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_decision_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_decision_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy decision list" slug: chainctl_policy_decision_list url: /platform/chainctl/chainctl-docs/chainctl_policy_decision_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_describe.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_describe.md index e11809883b..fed8a7ec9c 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_describe.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy describe" slug: chainctl_policy_describe url: /platform/chainctl/chainctl-docs/chainctl_policy_describe/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_disable.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_disable.md index 0fb77eb068..a101d87797 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_disable.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_disable.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy disable" slug: chainctl_policy_disable url: /platform/chainctl/chainctl-docs/chainctl_policy_disable/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_enable.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_enable.md index 5f8bba02c0..ee4cf19bdd 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_enable.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_enable.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy enable" slug: chainctl_policy_enable url: /platform/chainctl/chainctl-docs/chainctl_policy_enable/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_list.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_list.md index 7760fb109a..9035ed6125 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy list" slug: chainctl_policy_list url: /platform/chainctl/chainctl-docs/chainctl_policy_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_override.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_override.md index c3357c0dd7..dd37688ad3 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_override.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_override.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy override" slug: chainctl_policy_override url: /platform/chainctl/chainctl-docs/chainctl_policy_override/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_override_create.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_override_create.md index dbcacdb30c..2663596654 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_override_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_override_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy override create" slug: chainctl_policy_override_create url: /platform/chainctl/chainctl-docs/chainctl_policy_override_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_override_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_override_delete.md index d0faf02cc3..0a16594b8b 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_override_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_override_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy override delete" slug: chainctl_policy_override_delete url: /platform/chainctl/chainctl-docs/chainctl_policy_override_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_policy_override_list.md b/content/platform/chainctl/chainctl-docs/chainctl_policy_override_list.md index 68520a0195..aa30193489 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_policy_override_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_policy_override_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl policy override list" slug: chainctl_policy_override_list url: /platform/chainctl/chainctl-docs/chainctl_policy_override_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills.md b/content/platform/chainctl/chainctl-docs/chainctl_skills.md index 5d50f8ccf3..55ddf63519 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills" slug: chainctl_skills url: /platform/chainctl/chainctl-docs/chainctl_skills/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_accept-terms.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_accept-terms.md index 032944b8ee..bdd5387aa4 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_accept-terms.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_accept-terms.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills accept-terms" slug: chainctl_skills_accept-terms url: /platform/chainctl/chainctl-docs/chainctl_skills_accept-terms/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_delete.md index c61e106005..8662171cbe 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills delete" slug: chainctl_skills_delete url: /platform/chainctl/chainctl-docs/chainctl_skills_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_describe.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_describe.md index 8b4e7b392e..6c449b880d 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_describe.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills describe" slug: chainctl_skills_describe url: /platform/chainctl/chainctl-docs/chainctl_skills_describe/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements.md index 2dc9f6545a..bc5f056bf7 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills entitlements" slug: chainctl_skills_entitlements url: /platform/chainctl/chainctl-docs/chainctl_skills_entitlements/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_create.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_create.md index 41411292c9..ff6185a807 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_create.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_create.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills entitlements create" slug: chainctl_skills_entitlements_create url: /platform/chainctl/chainctl-docs/chainctl_skills_entitlements_create/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_delete.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_delete.md index 6645a795e0..6c28af651a 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_delete.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills entitlements delete" slug: chainctl_skills_entitlements_delete url: /platform/chainctl/chainctl-docs/chainctl_skills_entitlements_delete/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_list.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_list.md index c70a76bbe8..ece927bbbe 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_entitlements_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills entitlements list" slug: chainctl_skills_entitlements_list url: /platform/chainctl/chainctl-docs/chainctl_skills_entitlements_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_harden.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_harden.md index 759ac52c3a..b4375fd705 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_harden.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_harden.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills harden" slug: chainctl_skills_harden url: /platform/chainctl/chainctl-docs/chainctl_skills_harden/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_install.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_install.md index 09a7a03d3e..3dbff9e16f 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_install.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_install.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills install" slug: chainctl_skills_install url: /platform/chainctl/chainctl-docs/chainctl_skills_install/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_list.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_list.md index da149c9cec..1667a50272 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_list.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_list.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills list" slug: chainctl_skills_list url: /platform/chainctl/chainctl-docs/chainctl_skills_list/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_pull.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_pull.md index a36208dbb6..0236f0f256 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_pull.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_pull.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills pull" slug: chainctl_skills_pull url: /platform/chainctl/chainctl-docs/chainctl_skills_pull/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_push.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_push.md index 221fc79976..981aeeb2f6 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_push.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_push.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills push" slug: chainctl_skills_push url: /platform/chainctl/chainctl-docs/chainctl_skills_push/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_registry.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_registry.md index 45dbdcd51b..ffa93ade53 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_registry.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_registry.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills registry" slug: chainctl_skills_registry url: /platform/chainctl/chainctl-docs/chainctl_skills_registry/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_registry_install.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_registry_install.md index 24da261ad4..65973ba7a0 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_registry_install.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_registry_install.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills registry install" slug: chainctl_skills_registry_install url: /platform/chainctl/chainctl-docs/chainctl_skills_registry_install/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_registry_publish.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_registry_publish.md index aaceb654c9..c76709ffc2 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_registry_publish.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_registry_publish.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills registry publish" slug: chainctl_skills_registry_publish url: /platform/chainctl/chainctl-docs/chainctl_skills_registry_publish/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_status.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_status.md index 49653465de..012cbd2420 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_status.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_status.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills status" slug: chainctl_skills_status url: /platform/chainctl/chainctl-docs/chainctl_skills_status/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_uninstall.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_uninstall.md index 03aa2d10a0..d83e3f5f21 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_uninstall.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_uninstall.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills uninstall" slug: chainctl_skills_uninstall url: /platform/chainctl/chainctl-docs/chainctl_skills_uninstall/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_validate.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_validate.md index 38061d369c..00df2403fa 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_validate.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_validate.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills validate" slug: chainctl_skills_validate url: /platform/chainctl/chainctl-docs/chainctl_skills_validate/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_verify.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_verify.md index 1dc66a9a8b..5c5a6dbec1 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_verify.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_verify.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills verify" slug: chainctl_skills_verify url: /platform/chainctl/chainctl-docs/chainctl_skills_verify/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_skills_versions.md b/content/platform/chainctl/chainctl-docs/chainctl_skills_versions.md index 097693dcf8..704a911dc6 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_skills_versions.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_skills_versions.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl skills versions" slug: chainctl_skills_versions url: /platform/chainctl/chainctl-docs/chainctl_skills_versions/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_starter.md b/content/platform/chainctl/chainctl-docs/chainctl_starter.md index 3e5bc1ec12..cd50af6b63 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_starter.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_starter.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl starter" slug: chainctl_starter url: /platform/chainctl/chainctl-docs/chainctl_starter/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_starter_add-images.md b/content/platform/chainctl/chainctl-docs/chainctl_starter_add-images.md index 2b7d2d56d4..c482cb5a37 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_starter_add-images.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_starter_add-images.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl starter add-images" slug: chainctl_starter_add-images url: /platform/chainctl/chainctl-docs/chainctl_starter_add-images/ @@ -17,7 +17,7 @@ Add catalog images to your catalog starter organization. Add catalog images to your catalog starter organization. -The target organization is the single verified kind=starter org the +The target organization is the single kind=starter org the caller's identity is bound to — auto-discovered, no flags needed. Images are resolved against the catalog by exact name match. The server diff --git a/content/platform/chainctl/chainctl-docs/chainctl_starter_init.md b/content/platform/chainctl/chainctl-docs/chainctl_starter_init.md index bb7207daa6..3128686241 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_starter_init.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_starter_init.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl starter init" slug: chainctl_starter_init url: /platform/chainctl/chainctl-docs/chainctl_starter_init/ @@ -28,7 +28,10 @@ This command is interactive. It will: 1. Prompt you to authenticate with a supported identity provider. 2. Register a new Chainguard identity for your email address. - 3. Create a new starter organization tied to your email domain. + 3. Create a new starter organization. With a business email address it + is named after your email domain. With a personal email address you + name it yourself, at a prompt or with --name, and its registry and + package paths use its ID instead of the name. Once your organization exists, the Chainguard platform will automatically entitle it to choose images to be added. It should be ready within a @@ -36,8 +39,9 @@ few minutes. Authentication requirements: - * You must use a business email address. Personal email providers (Gmail, - Yahoo, etc.) are not eligible. + * Use a business email address to get an organization named after your + company's domain. Where personal email providers (Gmail, Yahoo, etc.) + are accepted, the organization isn't tied to any domain. * Authentication must use one of: - Email and password; or - Google, only if your business uses a Google Workspace account @@ -51,6 +55,12 @@ to request access. chainctl starter init [flags] ``` +### Options + +``` + --name string Name of the organization, when you sign up with a personal email address. It can't look like a domain name. Ignored for an organization named after your email domain. +``` + ### Options inherited from parent commands ``` diff --git a/content/platform/chainctl/chainctl-docs/chainctl_starter_request-access.md b/content/platform/chainctl/chainctl-docs/chainctl_starter_request-access.md index f442d255a9..2d2a3f18a8 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_starter_request-access.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_starter_request-access.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl starter request-access" slug: chainctl_starter_request-access url: /platform/chainctl/chainctl-docs/chainctl_starter_request-access/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_starter_status.md b/content/platform/chainctl/chainctl-docs/chainctl_starter_status.md index c8ae71c61a..5408e95f1c 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_starter_status.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_starter_status.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl starter status" slug: chainctl_starter_status url: /platform/chainctl/chainctl-docs/chainctl_starter_status/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_update.md b/content/platform/chainctl/chainctl-docs/chainctl_update.md index fe26fa7431..a3bf0fb4e5 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_update.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_update.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl update" slug: chainctl_update url: /platform/chainctl/chainctl-docs/chainctl_update/ diff --git a/content/platform/chainctl/chainctl-docs/chainctl_version.md b/content/platform/chainctl/chainctl-docs/chainctl_version.md index 67e82cf983..4021df2658 100644 --- a/content/platform/chainctl/chainctl-docs/chainctl_version.md +++ b/content/platform/chainctl/chainctl-docs/chainctl_version.md @@ -1,5 +1,5 @@ --- -date: 2026-10-08T18:22:10Z +date: 2026-10-12T15:51:44Z title: "chainctl version" slug: chainctl_version url: /platform/chainctl/chainctl-docs/chainctl_version/ diff --git a/static/api-v1.json b/static/api-v1.json index 5509299880..b962b4a82c 100644 --- a/static/api-v1.json +++ b/static/api-v1.json @@ -1900,7 +1900,11 @@ "description": "CheckEligibilityResponse is the response message for CheckEligibility.", "properties": { "eligible": { - "description": "Indicates if the domain of the caller's email address is eligible\nfor email-domain-gated Groups flows.", + "description": "eligible reports whether the domain of the caller's email address may\ncreate a self-serve Starter organization. A personal-mail domain can be\neligible: unverified_starter is then set too, and the organization the\ncaller creates is unverified. Such a domain stays ineligible for\nLookupGroup and RequestGroupAccess, so read unverified_starter before\noffering those flows.", + "type": "boolean" + }, + "unverifiedStarter": { + "description": "unverified_starter is set with eligible when the caller's email domain is\na personal-mail provider: a Starter organization the caller creates is\nunverified, takes a name the caller chooses, and is never found by email\ndomain.", "type": "boolean" } }, @@ -1925,6 +1929,10 @@ "description": "identity_provider_uidp is the UIDP of the IdentityProvider this mapping belongs to.", "type": "string" }, + "privilegedRole": { + "description": "privileged_role reports whether role_uidp names a privileged role: the\nbuilt-in owner or support role. SCIM provisioning never creates persistent\nrole bindings from such a mapping, so its members hold the role only\nthrough capabilities granted at sign-in, which expire with the session.\nOutput only: derived from the role on every read; a value supplied on\nCreate is ignored. It reads false if that lookup fails, so false is not\nproof the role is unprivileged.", + "type": "boolean" + }, "roleUidp": { "description": "role_uidp is the UIDP of the Chainguard Role to grant.", "type": "string" @@ -6314,6 +6322,17 @@ }, "chainguard.platform.registry.EntitlementImage": { "properties": { + "countsTowardSwapQuota": { + "description": "Whether the removal recorded by delete_time is charged against the\norganization's rolling swap budget. A property of the removal, not of the\nimage: re-adding the image clears it along with delete_time, so a live image\nalways reads false. Removals that are not charged include those made by\ndeleting the whole entitlement, which removes all of its images, by internal\nreconcilers, or by Chainguard staff acting on the organization's behalf.\nAlways false on ListEntitlementImages.", + "readOnly": true, + "type": "boolean" + }, + "deleteTime": { + "description": "delete_time is when the image was removed from the entitlement. It is set\nonly on a removed image, which ListEntitlementCatalogImages returns when\nasked with include_deleted. Always unset on ListEntitlementImages.", + "format": "date-time", + "readOnly": true, + "type": "string" + }, "externalImageGroupId": { "description": "Identifier for the image group in whatever external system defined it\n(Salesforce/SFDC, GitHub, or another source).", "readOnly": true, @@ -11660,7 +11679,7 @@ }, "/iam/v1/groups:checkEligibility": { "get": { - "description": "CheckEligibility reports whether the caller passes the same eligibility\ngates applied by LookupGroup and RequestGroupAccess. A response of\neligible=true does not guarantee those calls succeed for other reasons\n(no matching org, already requested, etc.).", + "description": "CheckEligibility reports whether the caller's email domain may use the\nself-serve Groups flows. A personal-mail domain may only create an\nunverified Starter organization (see\nCheckEligibilityResponse.unverified_starter); LookupGroup and\nRequestGroupAccess refuse it. A response of eligible=true does not\nguarantee those calls succeed for other reasons (no matching org,\nalready requested, etc.).", "operationId": "Groups_CheckEligibility", "responses": { "200": { @@ -16772,6 +16791,14 @@ "pattern": ".+", "type": "string" } + }, + { + "description": "include_deleted also returns images removed from the entitlement, each with\ndelete_time set. Honored only by ListEntitlementCatalogImages;\nListEntitlementImages accepts and ignores it.", + "in": "query", + "name": "includeDeleted", + "schema": { + "type": "boolean" + } } ], "responses": { @@ -16816,6 +16843,14 @@ "pattern": ".+", "type": "string" } + }, + { + "description": "include_deleted also returns images removed from the entitlement, each with\ndelete_time set. Honored only by ListEntitlementCatalogImages;\nListEntitlementImages accepts and ignores it.", + "in": "query", + "name": "includeDeleted", + "schema": { + "type": "boolean" + } } ], "responses": { diff --git a/static/api-v2.json b/static/api-v2.json index 6418992f9e..faaa5e00cd 100644 --- a/static/api-v2.json +++ b/static/api-v2.json @@ -3,7 +3,7 @@ "schemas": { "chainguard.capabilities.Capability": { "default": "UNKNOWN", - "description": "Capability is an enumeration of the Chainguard IAM capabilities.\n\n - CAP_TENANT_VULN_REPORTS_LIST: TODO(colin): deprecate this cap once the legacy endpoint is removed\n - CAP_REPO_BLOBS_GET: repo.blobs.get is a capability required to pull container images.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with images vs pulling the image itself.\n - CAP_REPO_CREATE: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_CREATE as a transitional grant for write access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_WRITE, drop the dual-accept in cassie.\n - CAP_REPO_LIST: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_LIST as a transitional grant for read access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_READ, drop the dual-accept in cassie.\n - CAP_REPO_INTERNAL_ADMIN: repo.internal.admin allows administering internal-only repository fields\n(catalog tier, bundles, aliases, active tags, README, and sync settings)\nthat are otherwise read-only to customers.\n - CAP_APK_BLOBS_GET: apk.blobs.get is a capability required to pull APKs.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with APKs vs pulling the APK itself.\n - CAP_BUILD_REPORT_LIST: Custom Image Build\n - CAP_LIBRARIES_ENTITLEMENTS_CREATE: Global libraries capabilities\n - CAP_LIBRARIES_PYTHON_LIST: Ecosystems specific capabilities\n - CAP_LIBRARIES_CACHE_INVALIDATE: Cache invalidation capability for the libraries cache (covers all ecosystems).\nGranted to org owners and account admins; not to regular developer members.\n - CAP_LIBRARIES_CACHE_LIST: Read capability for the libraries resolution cache (status and entry\nlisting). Separate from CAP_LIBRARIES_ENTITLEMENTS_LIST on purpose: an\norg's dependency-consumption history is sensitive data.\n - CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE: Rebuilder API capabilities\n - CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_CREATE: AWS Marketplace Subscriptions (Chainguard Libraries on AWS Security Hub Extended)\n - CAP_LIBRARIES_REQUEST_GROUPS_CREATE: Library build requests: an organization asks Chainguard to build specific\nlibrary versions and tracks what it already has.\n\nSeparate from the libraries.rebuilder.* capabilities above, which are\ninternal_only and are never grantable to a customer organization.\n - CAP_LIBRARIES_REQUEST_GROUPS_LIST: list covers every read on a request group: the groups themselves, their\nitems, and the per-library view of them.\n - CAP_LIBRARIES_REQUEST_GROUPS_DELETE: delete covers draft groups only; removing a submitted group needs\ndelete_submitted.\n - CAP_LIBRARIES_REQUEST_GROUPS_SUBMIT: submit promotes a draft and carries the CVE-remediation opt-in for the group.\nIt is its own capability because submitting is restricted to owners, which a\nfield mask on update could not express.\n - CAP_LIBRARIES_REQUEST_GROUPS_ITEMS_UPDATE: items.update covers draft item editing: remove, restore and per-item update.\n - CAP_LIBRARIES_REQUEST_GROUPS_REFRESH_COVERAGE: Re-running a group's coverage check is expensive, and submitted groups are\nrefreshed automatically, so it is reserved for Chainguard support.\n - CAP_LIBRARIES_REMOTE_REGISTRIES_CREATE: Remote registries: an org's configured upstream registries for virtual\nrepositories. Creating or deleting one changes where the org's builds\npull dependencies from, so both are owner-only alongside the library\npolicy capabilities; list is ordinary member read.\n - CAP_LIBRARIES_STORAGE_USAGE_GET: Storage usage: how much storage an org's own uploads consume in each\nlanguage ecosystem. Owner-only because it is org-wide accounting (and the\nbasis for upcoming quotas), not something every member needs to see.\n - CAP_REGISTRY_ENTITLEMENTS_LIST: Registry Entitlements\n - CAP_REGISTRY_SETTINGS_LIST: Registry Settings\n - CAP_REGISTRY_OVERLAYS_LIST: Registry Overlays (tag-scoped Custom Assembly)\n - CAP_REGISTRY_DEPLOYMENTS_CREATE: Registry Deployments\n - CAP_POLICIES_POLICY_CREATE: Policies\n - CAP_POLICIES_OVERRIDE_CREATE: Policy overrides waive enforcement for a specific artifact. These are\nseparate capabilities from binding management so they can be granted\nindependently. By default create and delete are held by org owners (like\nbinding management) and listing is available to viewers.\n - CAP_TERMS_ACCEPT: Terms\n - CAP_GULFSTREAM: This is orthogonal enough that we should leave\nit somewhat separate, so add new capabilities above.\nTODO(mattmoor): Think about whether we can encode specific\ncontroller capabilities into our access control here?\ne.g. could each logical controller/webhook be its own\ncapability?\n - CAP_GUARDENER_DFC_CONVERT: Guardener\n - CAP_GUARDENER_ASSOCIATION_MANAGE: guardener.association.manage gates self-service linking/unlinking of a\nGitHub org to a Chainguard group (the GroupAccountAssociations record).\n - CAP_GUARDENER_ASSOCIATION_LIST: guardener.association.list gates read-only listing of the GitHub org\ninstallations linked to a Chainguard group (the read counterpart to\nguardener.association.manage).\n - CAP_GUARDENER_ENTITLEMENT_MANAGE: guardener.entitlement.manage gates the support-only surface for configuring a\ngroup's guardener entitlement (e.g. which repo visibility scope guardener\nresponds to). It is internal_only: it can never be granted by a role\navailable to customer organizations.\n - CAP_GUARDENER_ENTITLEMENT_LIST: guardener.entitlement.list gates read-only access to a group's guardener\nentitlement. Unlike guardener.entitlement.manage it is not internal_only, so\nnormal viewers can see the settings that apply to their group.\n - CAP_GUARDENER_ACTIONS_MIGRATE: Guardener actions migrator — on-demand enqueue of a repository's GitHub\nActions migration (opens a pull request), tracked via a long-running\noperation. Mutating, so distinct from the read-only actions catalog cap.\n - CAP_GUARDENER_SCAN_LIST: guardener.scan.list gates listing summaries of the dependency scans\nguardener builds for the group's linked repositories.\n - CAP_GUARDENER_SCAN_GET: guardener.scan.get gates reading one dependency scan by id (its declared\nartifacts and their relationships).\n - CAP_GUARDENER_IMAGES_MIGRATE: Authorizes requesting and reading repository image migrations.\n - CAP_MCP_TOOL_CALL: MCP tool calls\n - CAP_SKILLS_PUBLISH: Skills registry — publishing skill artifacts to skills.cgr.dev\n - CAP_SKILLS_ENTITLEMENTS_CREATE: Skills registry entitlements\n - CAP_SKILLS_LIST: Skills catalog metadata table (description / license / category) backing\nListSkills/GetSkill and search. One org-agnostic set: per-org isolation is\nthe UIDP scope on each RPC, not separate caps. These gate the catalog\ntable's CRUD only; publishing skill artifacts to the registry stays\nCAP_SKILLS_PUBLISH and entitlements stay CAP_SKILLS_ENTITLEMENTS_*.\n\nskills.list is customer-facing (read the catalog for orgs you can access).\nThe writes are internal_only: the catalog is populated by the Chainguard\npublish pipeline, not by customer orgs, so a customer role can never be\ngranted them (a role carrying them must also grant CAP_INTERNAL).\nskills.write is a single create-or-update cap: UpdateSkill is one\nAIP-134 create-or-update RPC, so there is no separate create vs update.\n - CAP_SKILLS_HARDEN_READ: Skills harden — access to the Skills harden API, split per RPC so read,\nsubmit, and cancel can be granted independently. Customer-facing: an org\nmember holds these on the target group named by `chainctl skills harden\n--group`.\n read -\u003e GetHardenOperation\n write -\u003e HardenSkill (submit)\n cancel -\u003e CancelHardenOperation\nThese let a customer kick off and track a harden; they do NOT let the caller\nwrite the hardened output. Publishing the hardened artifact and recording the\njob result into the skills registry/catalog is done by internal identities\nvia the internal_only skills.write cap, and the pipeline's record-result RPC\nis gated on CAP_INTERNAL — so a customer can never push into the hardened\narea directly.\n - CAP_ARGOS_DOCUMENTS_CREATE: Argos — client-side encrypted document records.\n - CAP_ARGOS_DOCUMENTATION_READ: Argos — documentation visibility. Grants read access to Argos API\ndocumentation.\n - CAP_ARGOS_OSV_READ: Argos — Private OSV API (customer-facing OSV query surface).\n - CAP_ARGOS_COALITION_MEMBER: Argos — identity types. Mutually exclusive: an identity holding both is\ntreated as a mitigation partner (the more restrictive of the two) for any\nAPI call which varies the return value based on identity type.\n - CAP_ARGOS_PARTNER_CAPABILITY_REQUEST: Argos — mitigation partner capabilities. request lets a partner submit\nits capabilities and interests; approve lets staff review them.\n - CAP_LIBRARIES_POLICY_CREATE: Libraries Policy Gates — customer-facing policies and bindings that\nconfigure the cooldown and malware gates applied to upstream package pulls,\nplus the block events recorded when a pull is withheld.\n - CAP_BUILDAPI_BUILD_CREATE: Build API\n - CAP_CASSIE_CAS_READ: Cassie REAPI cache surface. CAS (blobs + ByteStream) and the ActionCache\nare separately gated: a caller may read or write action results without\nany authority over the underlying content blobs, and vice versa.\n - CAP_LOGGIE_LOGS_READ: Loggie: the live-log service. Readers tailing a stream hold logs.read;\na producer appending to its streams holds logs.write; the orchestrator\nissuing streams holds logs.create. Appending also requires the stream's\nsigned write name, so a logs.write holder can only append to streams it\nwas handed.\n - CAP_REX_EXECUTIONS_CREATE: Rex: the remote-execution service. The edge authorizes submitting an\nexecution; the scheduler authorizes a worker joining the pool; the\nexecutions query surface authorizes cross-run reads at the instance.\n - CAP_REX_CLASS_USE: Gated platform classes. USE authorizes submitting an execution that\ndemands a gated class; SERVE authorizes a worker pool advertising one.\nBoth are evaluated at the class's own UIDP node, never at the instance.\n - CAP_ACTIONS_LIST: Actions catalog — the read-only catalog of Chainguard-published GitHub\nActions and the upstreams they mirror. Writes are internal (importer only).\n - CAP_ACTIONS_DEPENDENCIES_UPDATE: Recording the dependency edges of a composite action's revision, i.e. the\n`uses:` steps of its action.yml. Internal only: the edges are derived by\nthe hardening pipeline that reads the action.yml, and are not something a\ncustomer asserts about the shared graph.\n - CAP_ACTIONS_DEPENDENCIES_LIST: Reading the dependency graph. Internal only: reads are fenced to groups the\ncaller holds a capability in, which no customer does for these actions.\n - CAP_SANDBOX_RUN_CREATE: Sandbox: the ACID sandbox Runs control plane (the WorkflowRuns API,\nai-cicd/sandbox). Customer-grantable — an org's members run, watch, and\ncancel workflow runs in the org's own instance — via the sandbox.user\nrole, and held by Owners. The SANDBOX service principal's internal\nsandbox.service_agent role carries the same capabilities.\n - CAP_SANDBOX_INSTALLATIONS_RESOLVE: Resolving a guardener GitHub App installation to the root group it is\nlinked to. Internal only: the answer names another customer's\norganization, so it is held by the sandbox GitHub reconciler alone and\nchecked at the acid-sandbox group, never at a customer group.\n - CAP_ENTITLEMENTS_FEATURES_LIST: Central Entitlements Service FEATURE entitlements (product features such\nas sandbox_checks). Reading an organization's FEATURE rows. Internal only:\nit is held by the SANDBOX service principal's sandbox.service_agent role,\nwhich reads the org's rows to admit work. It is separate from\nregistry.entitlements.list so the SANDBOX principal cannot read image\nentitlements.\n - CAP_ENTITLEMENTS_FEATURES_MANAGE: Writing and deleting an organization's FEATURE rows as Chainguard\n(the INTERNAL and CONSOLE_ADMIN sources). Internal only: it is the support\nsurface for backfill, trial extension and the kill switch, held through the\nsupport role.\n - CAP_SANDBOX_SESSION_CREATE: Sandbox develop sessions (the Sessions API, ai-cicd/sandbox): resident\ndevelopment sessions opened with `chainctl develop`. session.create opens\nsessions and lets the caller see and manage its own; it is\ncustomer-grantable via the sandbox.user role. session.list sees and\nmanages (renames, deletes) every user's sessions in the instance — an\nadministrative power held by Owners, not by sandbox.user.\n - CAP_SANDBOX_IDENTITY_CREATE: Sandbox develop session identities: the GCP (and later other cloud)\nidentities a session may act as. identity.create defines, updates, and\ndeletes the caller's own personal identities, via the sandbox.user role.\nidentity.use consents a shared identity into one's session; it is checked\nat the shared identity's groups, so it has its own role\n(sandbox.identity.user) that an owner binds at the groups they choose.\nidentity.admin defines shared identities and sees every identity in the\ninstance; Owners hold it.\n - CAP_TELEMETRY_CONTAINERS_LIST: Telemetry: read access to the container images a group's linked\nrepositories declare, as observed by the telemetry reconciler.\nprotolint:disable:next ENUM_FIELD_NAMES_PREFIX MAX_LINE_LENGTH\n - CAP_BILLING_MANAGE: Billing: buying and paying for a self-serve plan for an org. Starting a\ncheckout leads to a charge and, once the first invoice is paid, to the\npurchaser becoming the org's owner, so it is held by owner and\nlimited_owner only.", + "description": "Capability is an enumeration of the Chainguard IAM capabilities.\n\n - CAP_IAM_GROUPS_RENAME: Renames an unverified organization that has a plan kind, and nothing\nelse: no other field, no folder, no verified organization, whose name\nis its domain. groups.update covers renames everywhere else.\n - CAP_TENANT_VULN_REPORTS_LIST: TODO(colin): deprecate this cap once the legacy endpoint is removed\n - CAP_REPO_BLOBS_GET: repo.blobs.get is a capability required to pull container images.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with images vs pulling the image itself.\n - CAP_REPO_CREATE: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_CREATE as a transitional grant for write access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_WRITE, drop the dual-accept in cassie.\n - CAP_REPO_LIST: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_LIST as a transitional grant for read access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_READ, drop the dual-accept in cassie.\n - CAP_REPO_INTERNAL_ADMIN: repo.internal.admin allows administering internal-only repository fields\n(catalog tier, bundles, aliases, active tags, README, and sync settings)\nthat are otherwise read-only to customers.\n - CAP_APK_BLOBS_GET: apk.blobs.get is a capability required to pull APKs.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with APKs vs pulling the APK itself.\n - CAP_BUILD_REPORT_LIST: Custom Image Build\n - CAP_LIBRARIES_ENTITLEMENTS_CREATE: Global libraries capabilities\n - CAP_LIBRARIES_PYTHON_LIST: Ecosystems specific capabilities\n - CAP_LIBRARIES_CACHE_INVALIDATE: Cache invalidation capability for the libraries cache (covers all ecosystems).\nGranted to org owners and account admins; not to regular developer members.\n - CAP_LIBRARIES_CACHE_LIST: Read capability for the libraries resolution cache (status and entry\nlisting). Separate from CAP_LIBRARIES_ENTITLEMENTS_LIST on purpose: an\norg's dependency-consumption history is sensitive data.\n - CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE: Rebuilder API capabilities\n - CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_CREATE: AWS Marketplace Subscriptions (Chainguard Libraries on AWS Security Hub Extended)\n - CAP_LIBRARIES_REQUEST_GROUPS_CREATE: Library build requests: an organization asks Chainguard to build specific\nlibrary versions and tracks what it already has.\n\nSeparate from the libraries.rebuilder.* capabilities above, which are\ninternal_only and are never grantable to a customer organization.\n - CAP_LIBRARIES_REQUEST_GROUPS_LIST: list covers every read on a request group: the groups themselves, their\nitems, and the per-library view of them.\n - CAP_LIBRARIES_REQUEST_GROUPS_DELETE: delete covers draft groups only; removing a submitted group needs\ndelete_submitted.\n - CAP_LIBRARIES_REQUEST_GROUPS_SUBMIT: submit promotes a draft and carries the CVE-remediation opt-in for the group.\nIt is its own capability because submitting is restricted to owners, which a\nfield mask on update could not express.\n - CAP_LIBRARIES_REQUEST_GROUPS_ITEMS_UPDATE: items.update covers draft item editing: remove, restore and per-item update.\n - CAP_LIBRARIES_REQUEST_GROUPS_REFRESH_COVERAGE: Re-running a group's coverage check is expensive, and submitted groups are\nrefreshed automatically, so it is reserved for Chainguard support.\n - CAP_LIBRARIES_REMOTE_REGISTRIES_CREATE: Remote registries: an org's configured upstream registries for virtual\nrepositories. Creating or deleting one changes where the org's builds\npull dependencies from, so both are owner-only alongside the library\npolicy capabilities; list is ordinary member read.\n - CAP_LIBRARIES_STORAGE_USAGE_GET: Storage usage: how much storage an org's own uploads consume in each\nlanguage ecosystem. Owner-only because it is org-wide accounting (and the\nbasis for upcoming quotas), not something every member needs to see.\n - CAP_LIBRARIES_MALWARE_STATUS_UPDATE: Malware status: stamps the per-version scanned/malicious flags on upstream\nrows in serve-v2. An unscanned upstream version is withheld until it is\nstamped, so whoever holds this decides what reaches customers unscanned;\nit is internal_only so only Chainguard's scan pipeline can hold it.\n - CAP_REGISTRY_ENTITLEMENTS_LIST: Registry Entitlements\n - CAP_REGISTRY_SETTINGS_LIST: Registry Settings\n - CAP_REGISTRY_OVERLAYS_LIST: Registry Overlays (tag-scoped Custom Assembly)\n - CAP_REGISTRY_DEPLOYMENTS_CREATE: Registry Deployments\n - CAP_POLICIES_POLICY_CREATE: Policies\n - CAP_POLICIES_OVERRIDE_CREATE: Policy overrides waive enforcement for a specific artifact. These are\nseparate capabilities from binding management so they can be granted\nindependently. By default create and delete are held by org owners (like\nbinding management) and listing is available to viewers.\n - CAP_TERMS_ACCEPT: Terms\n - CAP_GULFSTREAM: This is orthogonal enough that we should leave\nit somewhat separate, so add new capabilities above.\nTODO(mattmoor): Think about whether we can encode specific\ncontroller capabilities into our access control here?\ne.g. could each logical controller/webhook be its own\ncapability?\n - CAP_GUARDENER_DFC_CONVERT: Guardener\n - CAP_GUARDENER_ASSOCIATION_MANAGE: guardener.association.manage gates self-service linking/unlinking of a\nGitHub org to a Chainguard group (the GroupAccountAssociations record).\n - CAP_GUARDENER_ASSOCIATION_LIST: guardener.association.list gates read-only listing of the GitHub org\ninstallations linked to a Chainguard group (the read counterpart to\nguardener.association.manage).\n - CAP_GUARDENER_ENTITLEMENT_MANAGE: guardener.entitlement.manage gates the support-only surface for configuring a\ngroup's guardener entitlement (e.g. which repo visibility scope guardener\nresponds to). It is internal_only: it can never be granted by a role\navailable to customer organizations.\n - CAP_GUARDENER_ENTITLEMENT_LIST: guardener.entitlement.list gates read-only access to a group's guardener\nentitlement. Unlike guardener.entitlement.manage it is not internal_only, so\nnormal viewers can see the settings that apply to their group.\n - CAP_GUARDENER_ACTIONS_MIGRATE: Guardener actions migrator — on-demand enqueue of a repository's GitHub\nActions migration (opens a pull request), tracked via a long-running\noperation. Mutating, so distinct from the read-only actions catalog cap.\n - CAP_GUARDENER_SCAN_LIST: guardener.scan.list gates listing summaries of the dependency scans\nguardener builds for the group's linked repositories.\n - CAP_GUARDENER_SCAN_GET: guardener.scan.get gates reading one dependency scan by id (its declared\nartifacts and their relationships).\n - CAP_GUARDENER_IMAGES_MIGRATE: Authorizes requesting and reading repository image migrations.\n - CAP_MCP_TOOL_CALL: MCP tool calls\n - CAP_SKILLS_PUBLISH: Skills registry — publishing skill artifacts to skills.cgr.dev\n - CAP_SKILLS_ENTITLEMENTS_CREATE: Skills registry entitlements\n - CAP_SKILLS_LIST: Skills catalog metadata table (description / license / category) backing\nListSkills/GetSkill and search. One org-agnostic set: per-org isolation is\nthe UIDP scope on each RPC, not separate caps. These gate the catalog\ntable's CRUD only; publishing skill artifacts to the registry stays\nCAP_SKILLS_PUBLISH and entitlements stay CAP_SKILLS_ENTITLEMENTS_*.\n\nskills.list is customer-facing (read the catalog for orgs you can access).\nThe writes are internal_only: the catalog is populated by the Chainguard\npublish pipeline, not by customer orgs, so a customer role can never be\ngranted them (a role carrying them must also grant CAP_INTERNAL).\nskills.write is a single create-or-update cap: UpdateSkill is one\nAIP-134 create-or-update RPC, so there is no separate create vs update.\n - CAP_SKILLS_HARDEN_READ: Skills harden — access to the Skills harden API, split per RPC so read,\nsubmit, and cancel can be granted independently. Customer-facing: an org\nmember holds these on the target group named by `chainctl skills harden\n--group`.\n read -\u003e GetHardenOperation\n write -\u003e HardenSkill (submit)\n cancel -\u003e CancelHardenOperation\nThese let a customer kick off and track a harden; they do NOT let the caller\nwrite the hardened output. Publishing the hardened artifact and recording the\njob result into the skills registry/catalog is done by internal identities\nvia the internal_only skills.write cap, and the pipeline's record-result RPC\nis gated on CAP_INTERNAL — so a customer can never push into the hardened\narea directly.\n - CAP_ARGOS_DOCUMENTS_CREATE: Argos — client-side encrypted document records.\n - CAP_ARGOS_DOCUMENTATION_READ: Argos — documentation visibility. Grants read access to Argos API\ndocumentation.\n - CAP_ARGOS_OSV_READ: Argos — Private OSV API (customer-facing OSV query surface).\n - CAP_ARGOS_COALITION_MEMBER: Argos — identity types. Mutually exclusive: an identity holding both is\ntreated as a mitigation partner (the more restrictive of the two) for any\nAPI call which varies the return value based on identity type.\n - CAP_ARGOS_PARTNER_CAPABILITY_REQUEST: Argos — mitigation partner capabilities. request lets a partner submit\nits capabilities and interests; approve lets staff review them.\n - CAP_LIBRARIES_POLICY_CREATE: Libraries Policy Gates — customer-facing policies and bindings that\nconfigure the cooldown and malware gates applied to upstream package pulls,\nplus the block events recorded when a pull is withheld.\n - CAP_BUILDAPI_BUILD_CREATE: Build API\n - CAP_CASSIE_CAS_READ: Cassie REAPI cache surface. CAS (blobs + ByteStream) and the ActionCache\nare separately gated: a caller may read or write action results without\nany authority over the underlying content blobs, and vice versa.\n - CAP_LOGGIE_LOGS_READ: Loggie: the live-log service. Readers tailing a stream hold logs.read;\na producer appending to its streams holds logs.write; the orchestrator\nissuing streams holds logs.create. Appending also requires the stream's\nsigned write name, so a logs.write holder can only append to streams it\nwas handed.\n - CAP_REX_EXECUTIONS_CREATE: Rex: the remote-execution service. The edge authorizes submitting an\nexecution; the scheduler authorizes a worker joining the pool; the\nexecutions query surface authorizes cross-run reads at the instance.\n - CAP_REX_CLASS_USE: Gated platform classes. USE authorizes submitting an execution that\ndemands a gated class; SERVE authorizes a worker pool advertising one.\nBoth are evaluated at the class's own UIDP node, never at the instance.\n - CAP_ACTIONS_LIST: Actions catalog — the read-only catalog of Chainguard-published GitHub\nActions and the upstreams they mirror. Writes are internal (importer only).\n - CAP_ACTIONS_DEPENDENCIES_UPDATE: Recording the dependency edges of a composite action's revision, i.e. the\n`uses:` steps of its action.yml. Internal only: the edges are derived by\nthe hardening pipeline that reads the action.yml, and are not something a\ncustomer asserts about the shared graph.\n - CAP_ACTIONS_DEPENDENCIES_LIST: Reading the dependency graph. Internal only: reads are fenced to groups the\ncaller holds a capability in, which no customer does for these actions.\n - CAP_SANDBOX_RUN_CREATE: Sandbox: the ACID sandbox Runs control plane (the WorkflowRuns API,\nai-cicd/sandbox). Customer-grantable — an org's members run, watch, and\ncancel workflow runs in the org's own instance — via the sandbox.user\nrole, and held by Owners. The SANDBOX service principal's internal\nsandbox.service_agent role carries the same capabilities.\n - CAP_SANDBOX_INSTALLATIONS_RESOLVE: Resolving a guardener GitHub App installation to the root group it is\nlinked to. Internal only: the answer names another customer's\norganization, so it is held by the sandbox GitHub reconciler alone and\nchecked at the acid-sandbox group, never at a customer group.\n - CAP_ENTITLEMENTS_FEATURES_LIST: Central Entitlements Service FEATURE entitlements (product features such\nas sandbox_checks). Reading an organization's FEATURE rows. Internal only:\nit is held by the SANDBOX service principal's sandbox.service_agent role,\nwhich reads the org's rows to admit work. It is separate from\nregistry.entitlements.list so the SANDBOX principal cannot read image\nentitlements.\n - CAP_ENTITLEMENTS_FEATURES_MANAGE: Writing and deleting an organization's FEATURE rows as Chainguard\n(the INTERNAL and CONSOLE_ADMIN sources). Internal only: it is the support\nsurface for backfill, trial extension and the kill switch, held through the\nsupport role.\n - CAP_SANDBOX_SESSION_CREATE: Sandbox develop sessions (the Sessions API, ai-cicd/sandbox): resident\ndevelopment sessions opened with `chainctl develop`. session.create opens\nsessions and lets the caller see and manage its own; it is\ncustomer-grantable via the sandbox.user role. session.list sees and\nmanages (renames, deletes) every user's sessions in the instance — an\nadministrative power held by Owners, not by sandbox.user.\n - CAP_SANDBOX_IDENTITY_CREATE: Sandbox develop session identities: the GCP (and later other cloud)\nidentities a session may act as. identity.create defines, updates, and\ndeletes the caller's own personal identities, via the sandbox.user role.\nidentity.use consents a shared identity into one's session; it is checked\nat the shared identity's groups, so it has its own role\n(sandbox.identity.user) that an owner binds at the groups they choose.\nidentity.admin defines shared identities and sees every identity in the\ninstance; Owners hold it.\n - CAP_TELEMETRY_CONTAINERS_LIST: Telemetry: read access to the container images a group's linked\nrepositories declare, as observed by the telemetry reconciler.\nprotolint:disable:next ENUM_FIELD_NAMES_PREFIX MAX_LINE_LENGTH\n - CAP_BILLING_MANAGE: Billing: buying and paying for a self-serve plan for an org. Starting a\ncheckout leads to a charge and, once the first invoice is paid, to the\npurchaser becoming the org's owner, so it is held by owner and\nlimited_owner only.", "enum": [ "UNKNOWN", "CAP_INTERNAL", @@ -11,6 +11,7 @@ "CAP_IAM_GROUPS_UPDATE", "CAP_IAM_GROUPS_LIST", "CAP_IAM_GROUPS_DELETE", + "CAP_IAM_GROUPS_RENAME", "CAP_IAM_GROUP_INVITES_CREATE", "CAP_IAM_GROUP_INVITES_LIST", "CAP_IAM_GROUP_INVITES_DELETE", @@ -135,6 +136,7 @@ "CAP_LIBRARIES_REMOTE_REGISTRIES_LIST", "CAP_LIBRARIES_REMOTE_REGISTRIES_DELETE", "CAP_LIBRARIES_STORAGE_USAGE_GET", + "CAP_LIBRARIES_MALWARE_STATUS_UPDATE", "CAP_REGISTRY_ENTITLEMENTS_LIST", "CAP_REGISTRY_ENTITLEMENTS_CREATE", "CAP_REGISTRY_ENTITLEMENTS_DELETE", @@ -1201,7 +1203,11 @@ "description": "CheckEligibilityResponse is the response message for CheckEligibility.", "properties": { "eligible": { - "description": "Indicates if the domain of the caller's email address is eligible\nfor email-domain-gated Groups flows.", + "description": "eligible reports whether the domain of the caller's email address may\ncreate a self-serve Starter organization. A personal-mail domain can be\neligible: unverified_starter is then set too, and the organization the\ncaller creates is unverified. Such a domain stays ineligible for\nLookupGroup and RequestGroupAccess, so read unverified_starter before\noffering those flows.", + "type": "boolean" + }, + "unverifiedStarter": { + "description": "unverified_starter is set with eligible when the caller's email domain is\na personal-mail provider: a Starter organization the caller creates is\nunverified, takes a name the caller chooses, and is never found by email\ndomain.", "type": "boolean" } }, @@ -1257,6 +1263,11 @@ "readOnly": true, "type": "string" }, + "privilegedRole": { + "description": "Whether role_uid names a privileged role: the built-in owner or support\nrole. SCIM provisioning never creates persistent role bindings from such a\nmapping, so its members hold the role only through capabilities granted at\nsign-in, which expire with the session. Derived from the role on every\nread; a value supplied on create is ignored. It reads false if that lookup\nfails, so false is not proof the role is unprivileged.", + "readOnly": true, + "type": "boolean" + }, "roleUid": { "description": "UIDP of the Chainguard role to grant to members of the external group.", "type": "string" @@ -6290,7 +6301,7 @@ }, "/iam/v2/groups:checkEligibility": { "get": { - "description": "CheckEligibility reports whether the caller passes the same eligibility\ngates applied by LookupGroup and RequestGroupAccess. A response of\neligible=true does not guarantee those calls succeed for other reasons\n(no matching org, already requested, etc.).", + "description": "CheckEligibility reports whether the caller's email domain may use the\nself-serve Groups flows. A personal-mail domain may only create an\nunverified Starter organization (see\nCheckEligibilityResponse.unverified_starter); LookupGroup and\nRequestGroupAccess refuse it. A response of eligible=true does not\nguarantee those calls succeed for other reasons (no matching org,\nalready requested, etc.).", "operationId": "GroupsService_CheckEligibility", "responses": { "200": { diff --git a/static/api-v2beta1.json b/static/api-v2beta1.json index d092826fae..8cd3059532 100644 --- a/static/api-v2beta1.json +++ b/static/api-v2beta1.json @@ -3,7 +3,7 @@ "schemas": { "chainguard.capabilities.Capability": { "default": "UNKNOWN", - "description": "Capability is an enumeration of the Chainguard IAM capabilities.\n\n - CAP_TENANT_VULN_REPORTS_LIST: TODO(colin): deprecate this cap once the legacy endpoint is removed\n - CAP_REPO_BLOBS_GET: repo.blobs.get is a capability required to pull container images.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with images vs pulling the image itself.\n - CAP_REPO_CREATE: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_CREATE as a transitional grant for write access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_WRITE, drop the dual-accept in cassie.\n - CAP_REPO_LIST: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_LIST as a transitional grant for read access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_READ, drop the dual-accept in cassie.\n - CAP_REPO_INTERNAL_ADMIN: repo.internal.admin allows administering internal-only repository fields\n(catalog tier, bundles, aliases, active tags, README, and sync settings)\nthat are otherwise read-only to customers.\n - CAP_APK_BLOBS_GET: apk.blobs.get is a capability required to pull APKs.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with APKs vs pulling the APK itself.\n - CAP_BUILD_REPORT_LIST: Custom Image Build\n - CAP_LIBRARIES_ENTITLEMENTS_CREATE: Global libraries capabilities\n - CAP_LIBRARIES_PYTHON_LIST: Ecosystems specific capabilities\n - CAP_LIBRARIES_CACHE_INVALIDATE: Cache invalidation capability for the libraries cache (covers all ecosystems).\nGranted to org owners and account admins; not to regular developer members.\n - CAP_LIBRARIES_CACHE_LIST: Read capability for the libraries resolution cache (status and entry\nlisting). Separate from CAP_LIBRARIES_ENTITLEMENTS_LIST on purpose: an\norg's dependency-consumption history is sensitive data.\n - CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE: Rebuilder API capabilities\n - CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_CREATE: AWS Marketplace Subscriptions (Chainguard Libraries on AWS Security Hub Extended)\n - CAP_LIBRARIES_REQUEST_GROUPS_CREATE: Library build requests: an organization asks Chainguard to build specific\nlibrary versions and tracks what it already has.\n\nSeparate from the libraries.rebuilder.* capabilities above, which are\ninternal_only and are never grantable to a customer organization.\n - CAP_LIBRARIES_REQUEST_GROUPS_LIST: list covers every read on a request group: the groups themselves, their\nitems, and the per-library view of them.\n - CAP_LIBRARIES_REQUEST_GROUPS_DELETE: delete covers draft groups only; removing a submitted group needs\ndelete_submitted.\n - CAP_LIBRARIES_REQUEST_GROUPS_SUBMIT: submit promotes a draft and carries the CVE-remediation opt-in for the group.\nIt is its own capability because submitting is restricted to owners, which a\nfield mask on update could not express.\n - CAP_LIBRARIES_REQUEST_GROUPS_ITEMS_UPDATE: items.update covers draft item editing: remove, restore and per-item update.\n - CAP_LIBRARIES_REQUEST_GROUPS_REFRESH_COVERAGE: Re-running a group's coverage check is expensive, and submitted groups are\nrefreshed automatically, so it is reserved for Chainguard support.\n - CAP_LIBRARIES_REMOTE_REGISTRIES_CREATE: Remote registries: an org's configured upstream registries for virtual\nrepositories. Creating or deleting one changes where the org's builds\npull dependencies from, so both are owner-only alongside the library\npolicy capabilities; list is ordinary member read.\n - CAP_LIBRARIES_STORAGE_USAGE_GET: Storage usage: how much storage an org's own uploads consume in each\nlanguage ecosystem. Owner-only because it is org-wide accounting (and the\nbasis for upcoming quotas), not something every member needs to see.\n - CAP_REGISTRY_ENTITLEMENTS_LIST: Registry Entitlements\n - CAP_REGISTRY_SETTINGS_LIST: Registry Settings\n - CAP_REGISTRY_OVERLAYS_LIST: Registry Overlays (tag-scoped Custom Assembly)\n - CAP_REGISTRY_DEPLOYMENTS_CREATE: Registry Deployments\n - CAP_POLICIES_POLICY_CREATE: Policies\n - CAP_POLICIES_OVERRIDE_CREATE: Policy overrides waive enforcement for a specific artifact. These are\nseparate capabilities from binding management so they can be granted\nindependently. By default create and delete are held by org owners (like\nbinding management) and listing is available to viewers.\n - CAP_TERMS_ACCEPT: Terms\n - CAP_GULFSTREAM: This is orthogonal enough that we should leave\nit somewhat separate, so add new capabilities above.\nTODO(mattmoor): Think about whether we can encode specific\ncontroller capabilities into our access control here?\ne.g. could each logical controller/webhook be its own\ncapability?\n - CAP_GUARDENER_DFC_CONVERT: Guardener\n - CAP_GUARDENER_ASSOCIATION_MANAGE: guardener.association.manage gates self-service linking/unlinking of a\nGitHub org to a Chainguard group (the GroupAccountAssociations record).\n - CAP_GUARDENER_ASSOCIATION_LIST: guardener.association.list gates read-only listing of the GitHub org\ninstallations linked to a Chainguard group (the read counterpart to\nguardener.association.manage).\n - CAP_GUARDENER_ENTITLEMENT_MANAGE: guardener.entitlement.manage gates the support-only surface for configuring a\ngroup's guardener entitlement (e.g. which repo visibility scope guardener\nresponds to). It is internal_only: it can never be granted by a role\navailable to customer organizations.\n - CAP_GUARDENER_ENTITLEMENT_LIST: guardener.entitlement.list gates read-only access to a group's guardener\nentitlement. Unlike guardener.entitlement.manage it is not internal_only, so\nnormal viewers can see the settings that apply to their group.\n - CAP_GUARDENER_ACTIONS_MIGRATE: Guardener actions migrator — on-demand enqueue of a repository's GitHub\nActions migration (opens a pull request), tracked via a long-running\noperation. Mutating, so distinct from the read-only actions catalog cap.\n - CAP_GUARDENER_SCAN_LIST: guardener.scan.list gates listing summaries of the dependency scans\nguardener builds for the group's linked repositories.\n - CAP_GUARDENER_SCAN_GET: guardener.scan.get gates reading one dependency scan by id (its declared\nartifacts and their relationships).\n - CAP_GUARDENER_IMAGES_MIGRATE: Authorizes requesting and reading repository image migrations.\n - CAP_MCP_TOOL_CALL: MCP tool calls\n - CAP_SKILLS_PUBLISH: Skills registry — publishing skill artifacts to skills.cgr.dev\n - CAP_SKILLS_ENTITLEMENTS_CREATE: Skills registry entitlements\n - CAP_SKILLS_LIST: Skills catalog metadata table (description / license / category) backing\nListSkills/GetSkill and search. One org-agnostic set: per-org isolation is\nthe UIDP scope on each RPC, not separate caps. These gate the catalog\ntable's CRUD only; publishing skill artifacts to the registry stays\nCAP_SKILLS_PUBLISH and entitlements stay CAP_SKILLS_ENTITLEMENTS_*.\n\nskills.list is customer-facing (read the catalog for orgs you can access).\nThe writes are internal_only: the catalog is populated by the Chainguard\npublish pipeline, not by customer orgs, so a customer role can never be\ngranted them (a role carrying them must also grant CAP_INTERNAL).\nskills.write is a single create-or-update cap: UpdateSkill is one\nAIP-134 create-or-update RPC, so there is no separate create vs update.\n - CAP_SKILLS_HARDEN_READ: Skills harden — access to the Skills harden API, split per RPC so read,\nsubmit, and cancel can be granted independently. Customer-facing: an org\nmember holds these on the target group named by `chainctl skills harden\n--group`.\n read -\u003e GetHardenOperation\n write -\u003e HardenSkill (submit)\n cancel -\u003e CancelHardenOperation\nThese let a customer kick off and track a harden; they do NOT let the caller\nwrite the hardened output. Publishing the hardened artifact and recording the\njob result into the skills registry/catalog is done by internal identities\nvia the internal_only skills.write cap, and the pipeline's record-result RPC\nis gated on CAP_INTERNAL — so a customer can never push into the hardened\narea directly.\n - CAP_ARGOS_DOCUMENTS_CREATE: Argos — client-side encrypted document records.\n - CAP_ARGOS_DOCUMENTATION_READ: Argos — documentation visibility. Grants read access to Argos API\ndocumentation.\n - CAP_ARGOS_OSV_READ: Argos — Private OSV API (customer-facing OSV query surface).\n - CAP_ARGOS_COALITION_MEMBER: Argos — identity types. Mutually exclusive: an identity holding both is\ntreated as a mitigation partner (the more restrictive of the two) for any\nAPI call which varies the return value based on identity type.\n - CAP_ARGOS_PARTNER_CAPABILITY_REQUEST: Argos — mitigation partner capabilities. request lets a partner submit\nits capabilities and interests; approve lets staff review them.\n - CAP_LIBRARIES_POLICY_CREATE: Libraries Policy Gates — customer-facing policies and bindings that\nconfigure the cooldown and malware gates applied to upstream package pulls,\nplus the block events recorded when a pull is withheld.\n - CAP_BUILDAPI_BUILD_CREATE: Build API\n - CAP_CASSIE_CAS_READ: Cassie REAPI cache surface. CAS (blobs + ByteStream) and the ActionCache\nare separately gated: a caller may read or write action results without\nany authority over the underlying content blobs, and vice versa.\n - CAP_LOGGIE_LOGS_READ: Loggie: the live-log service. Readers tailing a stream hold logs.read;\na producer appending to its streams holds logs.write; the orchestrator\nissuing streams holds logs.create. Appending also requires the stream's\nsigned write name, so a logs.write holder can only append to streams it\nwas handed.\n - CAP_REX_EXECUTIONS_CREATE: Rex: the remote-execution service. The edge authorizes submitting an\nexecution; the scheduler authorizes a worker joining the pool; the\nexecutions query surface authorizes cross-run reads at the instance.\n - CAP_REX_CLASS_USE: Gated platform classes. USE authorizes submitting an execution that\ndemands a gated class; SERVE authorizes a worker pool advertising one.\nBoth are evaluated at the class's own UIDP node, never at the instance.\n - CAP_ACTIONS_LIST: Actions catalog — the read-only catalog of Chainguard-published GitHub\nActions and the upstreams they mirror. Writes are internal (importer only).\n - CAP_ACTIONS_DEPENDENCIES_UPDATE: Recording the dependency edges of a composite action's revision, i.e. the\n`uses:` steps of its action.yml. Internal only: the edges are derived by\nthe hardening pipeline that reads the action.yml, and are not something a\ncustomer asserts about the shared graph.\n - CAP_ACTIONS_DEPENDENCIES_LIST: Reading the dependency graph. Internal only: reads are fenced to groups the\ncaller holds a capability in, which no customer does for these actions.\n - CAP_SANDBOX_RUN_CREATE: Sandbox: the ACID sandbox Runs control plane (the WorkflowRuns API,\nai-cicd/sandbox). Customer-grantable — an org's members run, watch, and\ncancel workflow runs in the org's own instance — via the sandbox.user\nrole, and held by Owners. The SANDBOX service principal's internal\nsandbox.service_agent role carries the same capabilities.\n - CAP_SANDBOX_INSTALLATIONS_RESOLVE: Resolving a guardener GitHub App installation to the root group it is\nlinked to. Internal only: the answer names another customer's\norganization, so it is held by the sandbox GitHub reconciler alone and\nchecked at the acid-sandbox group, never at a customer group.\n - CAP_ENTITLEMENTS_FEATURES_LIST: Central Entitlements Service FEATURE entitlements (product features such\nas sandbox_checks). Reading an organization's FEATURE rows. Internal only:\nit is held by the SANDBOX service principal's sandbox.service_agent role,\nwhich reads the org's rows to admit work. It is separate from\nregistry.entitlements.list so the SANDBOX principal cannot read image\nentitlements.\n - CAP_ENTITLEMENTS_FEATURES_MANAGE: Writing and deleting an organization's FEATURE rows as Chainguard\n(the INTERNAL and CONSOLE_ADMIN sources). Internal only: it is the support\nsurface for backfill, trial extension and the kill switch, held through the\nsupport role.\n - CAP_SANDBOX_SESSION_CREATE: Sandbox develop sessions (the Sessions API, ai-cicd/sandbox): resident\ndevelopment sessions opened with `chainctl develop`. session.create opens\nsessions and lets the caller see and manage its own; it is\ncustomer-grantable via the sandbox.user role. session.list sees and\nmanages (renames, deletes) every user's sessions in the instance — an\nadministrative power held by Owners, not by sandbox.user.\n - CAP_SANDBOX_IDENTITY_CREATE: Sandbox develop session identities: the GCP (and later other cloud)\nidentities a session may act as. identity.create defines, updates, and\ndeletes the caller's own personal identities, via the sandbox.user role.\nidentity.use consents a shared identity into one's session; it is checked\nat the shared identity's groups, so it has its own role\n(sandbox.identity.user) that an owner binds at the groups they choose.\nidentity.admin defines shared identities and sees every identity in the\ninstance; Owners hold it.\n - CAP_TELEMETRY_CONTAINERS_LIST: Telemetry: read access to the container images a group's linked\nrepositories declare, as observed by the telemetry reconciler.\nprotolint:disable:next ENUM_FIELD_NAMES_PREFIX MAX_LINE_LENGTH\n - CAP_BILLING_MANAGE: Billing: buying and paying for a self-serve plan for an org. Starting a\ncheckout leads to a charge and, once the first invoice is paid, to the\npurchaser becoming the org's owner, so it is held by owner and\nlimited_owner only.", + "description": "Capability is an enumeration of the Chainguard IAM capabilities.\n\n - CAP_IAM_GROUPS_RENAME: Renames an unverified organization that has a plan kind, and nothing\nelse: no other field, no folder, no verified organization, whose name\nis its domain. groups.update covers renames everywhere else.\n - CAP_TENANT_VULN_REPORTS_LIST: TODO(colin): deprecate this cap once the legacy endpoint is removed\n - CAP_REPO_BLOBS_GET: repo.blobs.get is a capability required to pull container images.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with images vs pulling the image itself.\n - CAP_REPO_CREATE: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_CREATE as a transitional grant for write access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_WRITE, drop the dual-accept in cassie.\n - CAP_REPO_LIST: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_LIST as a transitional grant for read access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_READ, drop the dual-accept in cassie.\n - CAP_REPO_INTERNAL_ADMIN: repo.internal.admin allows administering internal-only repository fields\n(catalog tier, bundles, aliases, active tags, README, and sync settings)\nthat are otherwise read-only to customers.\n - CAP_APK_BLOBS_GET: apk.blobs.get is a capability required to pull APKs.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with APKs vs pulling the APK itself.\n - CAP_BUILD_REPORT_LIST: Custom Image Build\n - CAP_LIBRARIES_ENTITLEMENTS_CREATE: Global libraries capabilities\n - CAP_LIBRARIES_PYTHON_LIST: Ecosystems specific capabilities\n - CAP_LIBRARIES_CACHE_INVALIDATE: Cache invalidation capability for the libraries cache (covers all ecosystems).\nGranted to org owners and account admins; not to regular developer members.\n - CAP_LIBRARIES_CACHE_LIST: Read capability for the libraries resolution cache (status and entry\nlisting). Separate from CAP_LIBRARIES_ENTITLEMENTS_LIST on purpose: an\norg's dependency-consumption history is sensitive data.\n - CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE: Rebuilder API capabilities\n - CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_CREATE: AWS Marketplace Subscriptions (Chainguard Libraries on AWS Security Hub Extended)\n - CAP_LIBRARIES_REQUEST_GROUPS_CREATE: Library build requests: an organization asks Chainguard to build specific\nlibrary versions and tracks what it already has.\n\nSeparate from the libraries.rebuilder.* capabilities above, which are\ninternal_only and are never grantable to a customer organization.\n - CAP_LIBRARIES_REQUEST_GROUPS_LIST: list covers every read on a request group: the groups themselves, their\nitems, and the per-library view of them.\n - CAP_LIBRARIES_REQUEST_GROUPS_DELETE: delete covers draft groups only; removing a submitted group needs\ndelete_submitted.\n - CAP_LIBRARIES_REQUEST_GROUPS_SUBMIT: submit promotes a draft and carries the CVE-remediation opt-in for the group.\nIt is its own capability because submitting is restricted to owners, which a\nfield mask on update could not express.\n - CAP_LIBRARIES_REQUEST_GROUPS_ITEMS_UPDATE: items.update covers draft item editing: remove, restore and per-item update.\n - CAP_LIBRARIES_REQUEST_GROUPS_REFRESH_COVERAGE: Re-running a group's coverage check is expensive, and submitted groups are\nrefreshed automatically, so it is reserved for Chainguard support.\n - CAP_LIBRARIES_REMOTE_REGISTRIES_CREATE: Remote registries: an org's configured upstream registries for virtual\nrepositories. Creating or deleting one changes where the org's builds\npull dependencies from, so both are owner-only alongside the library\npolicy capabilities; list is ordinary member read.\n - CAP_LIBRARIES_STORAGE_USAGE_GET: Storage usage: how much storage an org's own uploads consume in each\nlanguage ecosystem. Owner-only because it is org-wide accounting (and the\nbasis for upcoming quotas), not something every member needs to see.\n - CAP_LIBRARIES_MALWARE_STATUS_UPDATE: Malware status: stamps the per-version scanned/malicious flags on upstream\nrows in serve-v2. An unscanned upstream version is withheld until it is\nstamped, so whoever holds this decides what reaches customers unscanned;\nit is internal_only so only Chainguard's scan pipeline can hold it.\n - CAP_REGISTRY_ENTITLEMENTS_LIST: Registry Entitlements\n - CAP_REGISTRY_SETTINGS_LIST: Registry Settings\n - CAP_REGISTRY_OVERLAYS_LIST: Registry Overlays (tag-scoped Custom Assembly)\n - CAP_REGISTRY_DEPLOYMENTS_CREATE: Registry Deployments\n - CAP_POLICIES_POLICY_CREATE: Policies\n - CAP_POLICIES_OVERRIDE_CREATE: Policy overrides waive enforcement for a specific artifact. These are\nseparate capabilities from binding management so they can be granted\nindependently. By default create and delete are held by org owners (like\nbinding management) and listing is available to viewers.\n - CAP_TERMS_ACCEPT: Terms\n - CAP_GULFSTREAM: This is orthogonal enough that we should leave\nit somewhat separate, so add new capabilities above.\nTODO(mattmoor): Think about whether we can encode specific\ncontroller capabilities into our access control here?\ne.g. could each logical controller/webhook be its own\ncapability?\n - CAP_GUARDENER_DFC_CONVERT: Guardener\n - CAP_GUARDENER_ASSOCIATION_MANAGE: guardener.association.manage gates self-service linking/unlinking of a\nGitHub org to a Chainguard group (the GroupAccountAssociations record).\n - CAP_GUARDENER_ASSOCIATION_LIST: guardener.association.list gates read-only listing of the GitHub org\ninstallations linked to a Chainguard group (the read counterpart to\nguardener.association.manage).\n - CAP_GUARDENER_ENTITLEMENT_MANAGE: guardener.entitlement.manage gates the support-only surface for configuring a\ngroup's guardener entitlement (e.g. which repo visibility scope guardener\nresponds to). It is internal_only: it can never be granted by a role\navailable to customer organizations.\n - CAP_GUARDENER_ENTITLEMENT_LIST: guardener.entitlement.list gates read-only access to a group's guardener\nentitlement. Unlike guardener.entitlement.manage it is not internal_only, so\nnormal viewers can see the settings that apply to their group.\n - CAP_GUARDENER_ACTIONS_MIGRATE: Guardener actions migrator — on-demand enqueue of a repository's GitHub\nActions migration (opens a pull request), tracked via a long-running\noperation. Mutating, so distinct from the read-only actions catalog cap.\n - CAP_GUARDENER_SCAN_LIST: guardener.scan.list gates listing summaries of the dependency scans\nguardener builds for the group's linked repositories.\n - CAP_GUARDENER_SCAN_GET: guardener.scan.get gates reading one dependency scan by id (its declared\nartifacts and their relationships).\n - CAP_GUARDENER_IMAGES_MIGRATE: Authorizes requesting and reading repository image migrations.\n - CAP_MCP_TOOL_CALL: MCP tool calls\n - CAP_SKILLS_PUBLISH: Skills registry — publishing skill artifacts to skills.cgr.dev\n - CAP_SKILLS_ENTITLEMENTS_CREATE: Skills registry entitlements\n - CAP_SKILLS_LIST: Skills catalog metadata table (description / license / category) backing\nListSkills/GetSkill and search. One org-agnostic set: per-org isolation is\nthe UIDP scope on each RPC, not separate caps. These gate the catalog\ntable's CRUD only; publishing skill artifacts to the registry stays\nCAP_SKILLS_PUBLISH and entitlements stay CAP_SKILLS_ENTITLEMENTS_*.\n\nskills.list is customer-facing (read the catalog for orgs you can access).\nThe writes are internal_only: the catalog is populated by the Chainguard\npublish pipeline, not by customer orgs, so a customer role can never be\ngranted them (a role carrying them must also grant CAP_INTERNAL).\nskills.write is a single create-or-update cap: UpdateSkill is one\nAIP-134 create-or-update RPC, so there is no separate create vs update.\n - CAP_SKILLS_HARDEN_READ: Skills harden — access to the Skills harden API, split per RPC so read,\nsubmit, and cancel can be granted independently. Customer-facing: an org\nmember holds these on the target group named by `chainctl skills harden\n--group`.\n read -\u003e GetHardenOperation\n write -\u003e HardenSkill (submit)\n cancel -\u003e CancelHardenOperation\nThese let a customer kick off and track a harden; they do NOT let the caller\nwrite the hardened output. Publishing the hardened artifact and recording the\njob result into the skills registry/catalog is done by internal identities\nvia the internal_only skills.write cap, and the pipeline's record-result RPC\nis gated on CAP_INTERNAL — so a customer can never push into the hardened\narea directly.\n - CAP_ARGOS_DOCUMENTS_CREATE: Argos — client-side encrypted document records.\n - CAP_ARGOS_DOCUMENTATION_READ: Argos — documentation visibility. Grants read access to Argos API\ndocumentation.\n - CAP_ARGOS_OSV_READ: Argos — Private OSV API (customer-facing OSV query surface).\n - CAP_ARGOS_COALITION_MEMBER: Argos — identity types. Mutually exclusive: an identity holding both is\ntreated as a mitigation partner (the more restrictive of the two) for any\nAPI call which varies the return value based on identity type.\n - CAP_ARGOS_PARTNER_CAPABILITY_REQUEST: Argos — mitigation partner capabilities. request lets a partner submit\nits capabilities and interests; approve lets staff review them.\n - CAP_LIBRARIES_POLICY_CREATE: Libraries Policy Gates — customer-facing policies and bindings that\nconfigure the cooldown and malware gates applied to upstream package pulls,\nplus the block events recorded when a pull is withheld.\n - CAP_BUILDAPI_BUILD_CREATE: Build API\n - CAP_CASSIE_CAS_READ: Cassie REAPI cache surface. CAS (blobs + ByteStream) and the ActionCache\nare separately gated: a caller may read or write action results without\nany authority over the underlying content blobs, and vice versa.\n - CAP_LOGGIE_LOGS_READ: Loggie: the live-log service. Readers tailing a stream hold logs.read;\na producer appending to its streams holds logs.write; the orchestrator\nissuing streams holds logs.create. Appending also requires the stream's\nsigned write name, so a logs.write holder can only append to streams it\nwas handed.\n - CAP_REX_EXECUTIONS_CREATE: Rex: the remote-execution service. The edge authorizes submitting an\nexecution; the scheduler authorizes a worker joining the pool; the\nexecutions query surface authorizes cross-run reads at the instance.\n - CAP_REX_CLASS_USE: Gated platform classes. USE authorizes submitting an execution that\ndemands a gated class; SERVE authorizes a worker pool advertising one.\nBoth are evaluated at the class's own UIDP node, never at the instance.\n - CAP_ACTIONS_LIST: Actions catalog — the read-only catalog of Chainguard-published GitHub\nActions and the upstreams they mirror. Writes are internal (importer only).\n - CAP_ACTIONS_DEPENDENCIES_UPDATE: Recording the dependency edges of a composite action's revision, i.e. the\n`uses:` steps of its action.yml. Internal only: the edges are derived by\nthe hardening pipeline that reads the action.yml, and are not something a\ncustomer asserts about the shared graph.\n - CAP_ACTIONS_DEPENDENCIES_LIST: Reading the dependency graph. Internal only: reads are fenced to groups the\ncaller holds a capability in, which no customer does for these actions.\n - CAP_SANDBOX_RUN_CREATE: Sandbox: the ACID sandbox Runs control plane (the WorkflowRuns API,\nai-cicd/sandbox). Customer-grantable — an org's members run, watch, and\ncancel workflow runs in the org's own instance — via the sandbox.user\nrole, and held by Owners. The SANDBOX service principal's internal\nsandbox.service_agent role carries the same capabilities.\n - CAP_SANDBOX_INSTALLATIONS_RESOLVE: Resolving a guardener GitHub App installation to the root group it is\nlinked to. Internal only: the answer names another customer's\norganization, so it is held by the sandbox GitHub reconciler alone and\nchecked at the acid-sandbox group, never at a customer group.\n - CAP_ENTITLEMENTS_FEATURES_LIST: Central Entitlements Service FEATURE entitlements (product features such\nas sandbox_checks). Reading an organization's FEATURE rows. Internal only:\nit is held by the SANDBOX service principal's sandbox.service_agent role,\nwhich reads the org's rows to admit work. It is separate from\nregistry.entitlements.list so the SANDBOX principal cannot read image\nentitlements.\n - CAP_ENTITLEMENTS_FEATURES_MANAGE: Writing and deleting an organization's FEATURE rows as Chainguard\n(the INTERNAL and CONSOLE_ADMIN sources). Internal only: it is the support\nsurface for backfill, trial extension and the kill switch, held through the\nsupport role.\n - CAP_SANDBOX_SESSION_CREATE: Sandbox develop sessions (the Sessions API, ai-cicd/sandbox): resident\ndevelopment sessions opened with `chainctl develop`. session.create opens\nsessions and lets the caller see and manage its own; it is\ncustomer-grantable via the sandbox.user role. session.list sees and\nmanages (renames, deletes) every user's sessions in the instance — an\nadministrative power held by Owners, not by sandbox.user.\n - CAP_SANDBOX_IDENTITY_CREATE: Sandbox develop session identities: the GCP (and later other cloud)\nidentities a session may act as. identity.create defines, updates, and\ndeletes the caller's own personal identities, via the sandbox.user role.\nidentity.use consents a shared identity into one's session; it is checked\nat the shared identity's groups, so it has its own role\n(sandbox.identity.user) that an owner binds at the groups they choose.\nidentity.admin defines shared identities and sees every identity in the\ninstance; Owners hold it.\n - CAP_TELEMETRY_CONTAINERS_LIST: Telemetry: read access to the container images a group's linked\nrepositories declare, as observed by the telemetry reconciler.\nprotolint:disable:next ENUM_FIELD_NAMES_PREFIX MAX_LINE_LENGTH\n - CAP_BILLING_MANAGE: Billing: buying and paying for a self-serve plan for an org. Starting a\ncheckout leads to a charge and, once the first invoice is paid, to the\npurchaser becoming the org's owner, so it is held by owner and\nlimited_owner only.", "enum": [ "UNKNOWN", "CAP_INTERNAL", @@ -11,6 +11,7 @@ "CAP_IAM_GROUPS_UPDATE", "CAP_IAM_GROUPS_LIST", "CAP_IAM_GROUPS_DELETE", + "CAP_IAM_GROUPS_RENAME", "CAP_IAM_GROUP_INVITES_CREATE", "CAP_IAM_GROUP_INVITES_LIST", "CAP_IAM_GROUP_INVITES_DELETE", @@ -135,6 +136,7 @@ "CAP_LIBRARIES_REMOTE_REGISTRIES_LIST", "CAP_LIBRARIES_REMOTE_REGISTRIES_DELETE", "CAP_LIBRARIES_STORAGE_USAGE_GET", + "CAP_LIBRARIES_MALWARE_STATUS_UPDATE", "CAP_REGISTRY_ENTITLEMENTS_LIST", "CAP_REGISTRY_ENTITLEMENTS_CREATE", "CAP_REGISTRY_ENTITLEMENTS_DELETE", @@ -1255,7 +1257,11 @@ "description": "CheckEligibilityResponse is the response message for CheckEligibility.", "properties": { "eligible": { - "description": "Indicates if the domain of the caller's email address is eligible\nfor email-domain-gated Groups flows.", + "description": "eligible reports whether the domain of the caller's email address may\ncreate a self-serve Starter organization. A personal-mail domain can be\neligible: unverified_starter is then set too, and the organization the\ncaller creates is unverified. Such a domain stays ineligible for\nLookupGroup and RequestGroupAccess, so read unverified_starter before\noffering those flows.", + "type": "boolean" + }, + "unverifiedStarter": { + "description": "unverified_starter is set with eligible when the caller's email domain is\na personal-mail provider: a Starter organization the caller creates is\nunverified, takes a name the caller chooses, and is never found by email\ndomain.", "type": "boolean" } }, @@ -1311,6 +1317,11 @@ "readOnly": true, "type": "string" }, + "privilegedRole": { + "description": "Whether role_uid names a privileged role: the built-in owner or support\nrole. SCIM provisioning never creates persistent role bindings from such a\nmapping, so its members hold the role only through capabilities granted at\nsign-in, which expire with the session. Derived from the role on every\nread; a value supplied on create is ignored. It reads false if that lookup\nfails, so false is not proof the role is unprivileged.", + "readOnly": true, + "type": "boolean" + }, "roleUid": { "description": "UIDP of the Chainguard role to grant to members of the external group.", "type": "string" @@ -3033,7 +3044,7 @@ }, "chainguard.platform.libraries.v2beta1.CVERemediationStatus": { "default": "CVE_REMEDIATION_STATUS_UNSPECIFIED", - "description": "CVERemediationStatus is the aggregate remediation status of one version.\n\nFully orthogonal to Availability, and populated only for an opted-in group.\n\n - CVE_REMEDIATION_STATUS_UNSPECIFIED: Unspecified remediation status.\n - CVE_REMEDIATION_STATUS_SCAN_QUEUED: Queued for review, or not yet resolvable to a version we hold. Distinct from\nNO_HIGH_CRITICAL_CVES: this means no answer yet, not a clean answer.\n - CVE_REMEDIATION_STATUS_NO_HIGH_CRITICAL_CVES: Cross-referenced against advisory data, and no High or Critical CVEs apply.\n - CVE_REMEDIATION_STATUS_REVIEWING: CVEs identified; remediation not started.\n - CVE_REMEDIATION_STATUS_IN_PROGRESS: Remediation underway on at least one CVE.\n - CVE_REMEDIATION_STATUS_COMPLETE: Remediation finished with at least one CVE remediated.\n - CVE_REMEDIATION_STATUS_WONT_REMEDIATE: Every CVE on this version was ruled out of scope. The decision on\nCVERemediation says which kind of out-of-scope.\n - CVE_REMEDIATION_STATUS_FIX_AVAILABLE: A fix exists that the caller can move to now, and Chainguard has not\ndelivered a build of the pinned version. fix_version names the target\nwhere one can be named.\n\nDistinct from REVIEWING, which says remediation has not started and would\nhide an upgrade available today, and from COMPLETE, which claims a build\nChainguard shipped. Reached when an untriaged CVE already records a fix\ntarget, or when an advisory named a fix at or above the pinned version\nthat Chainguard never ingested.\n\nAdded after the other values. proto3 enums are open, so a client generated\nfrom an earlier copy of this file keeps the number as an unrecognized\nvalue and its switches fall through to their default branch -- it does not\nread as UNSPECIFIED. A client parsing the JSON surface strictly errors on\nthe unknown name instead. Treat an unrecognized value as not computed.\n\nA version that reports this today reported REVIEWING before the value\nexisted.", + "description": "CVERemediationStatus is the aggregate remediation status of one version.\n\nFully orthogonal to Availability, and populated only for an opted-in group.\n\n - CVE_REMEDIATION_STATUS_UNSPECIFIED: Unspecified remediation status.\n - CVE_REMEDIATION_STATUS_SCAN_QUEUED: Queued for review, or not yet resolvable to a version we hold. Distinct from\nNO_HIGH_CRITICAL_CVES: this means no answer yet, not a clean answer.\n - CVE_REMEDIATION_STATUS_NO_HIGH_CRITICAL_CVES: Cross-referenced against advisory data, and no High or Critical CVEs apply.\n - CVE_REMEDIATION_STATUS_REVIEWING: CVEs identified; remediation not started.\n - CVE_REMEDIATION_STATUS_IN_PROGRESS: Remediation underway on at least one CVE.\n - CVE_REMEDIATION_STATUS_COMPLETE: Remediation finished with at least one CVE remediated.\n - CVE_REMEDIATION_STATUS_WONT_REMEDIATE: Every CVE on this version was ruled out of scope. The decision on\nCVERemediation says which kind of out-of-scope.\n - CVE_REMEDIATION_STATUS_FIX_AVAILABLE: A fix exists that the caller can move to now, and Chainguard has not\nremediated the pinned version.\n\nNo target is named at this level: CVERemediation aggregates a version's\nCVEs and carries no version field, so there is nothing here a caller could\nmistake for somewhere to go. The per-CVE read names the target, in\nRequestedLibraryVersionCVE.upstream_fix_version.\n\nDistinct from REVIEWING, which says remediation has not started and would\nhide an upgrade available today, and from COMPLETE, which claims a build\nChainguard shipped. Reached when an untriaged CVE already records a fix\ntarget, or when an advisory named a fix at or above the pinned version\nthat Chainguard never ingested.\n\nAdded after the other values. proto3 enums are open, so a client generated\nfrom an earlier copy of this file keeps the number as an unrecognized\nvalue and its switches fall through to their default branch -- it does not\nread as UNSPECIFIED. A client parsing the JSON surface strictly errors on\nthe unknown name instead. Treat an unrecognized value as not computed.\n\nA version that reports this today reported REVIEWING before the value\nexisted.", "enum": [ "CVE_REMEDIATION_STATUS_UNSPECIFIED", "CVE_REMEDIATION_STATUS_SCAN_QUEUED", @@ -3108,7 +3119,7 @@ }, "chainguard.platform.libraries.v2beta1.CVEStatus": { "default": "CVE_STATUS_UNSPECIFIED", - "description": "CVEStatus is the remediation state of one CVE on one version.\n\nDeliberately not CVERemediationStatus, which is the aggregate ladder over a\nwhole version and has a different vocabulary. The two share only IN_PROGRESS,\nso one enum serving both would report a per-CVE state in words that mean\nsomething else at the version level.\n\n - CVE_STATUS_UNSPECIFIED: Unspecified state.\n - CVE_STATUS_PENDING: Recorded by the cross-reference and not yet triaged.\n - CVE_STATUS_TRIAGED: A reviewer has decided how to remediate; work has not started.\n - CVE_STATUS_IN_PROGRESS: A rebuild or backport is underway.\n - CVE_STATUS_COMPLETED: Chainguard delivered a build carrying the fix, and remediated_version\nnames it.\n\nDelivery, not the existence of a fix somewhere. The stored status alone\ndoes not establish it: a row completes as soon as an advisory names a fix\nat or above the affected version, and that fix may be one Chainguard never\ningested. Such a row reports FIX_AVAILABLE instead, so this value never\nappears without a remediated_version beside it.\n - CVE_STATUS_EXCLUDED: Ruled out of scope. decision says which kind of out-of-scope, and is the\nfield to render: \"not affected\" and \"no fix planned\" mean opposite things\nto the reader.\n - CVE_STATUS_SUPERSEDED: No active request group references this version any more, so the row is no\nlonger maintained. Reported rather than hidden, because a caller that\npinned the version earlier may still be running it.\n - CVE_STATUS_FIX_AVAILABLE: An advisory names a fix, but Chainguard has not delivered a build carrying\nit. remediated_version is empty: there is no Chainguard build to name.\n\nIts own value rather than COMPLETED, which would claim a remediation\nnobody shipped, and rather than IN_PROGRESS or TRIAGED, which say\nremediation has not landed yet while hiding that the CVE is resolved by\nmoving to a later upstream version today.", + "description": "CVEStatus is the remediation state of one CVE on one version.\n\nDeliberately not CVERemediationStatus, which is the aggregate ladder over a\nwhole version and has a different vocabulary. The two share only IN_PROGRESS,\nso one enum serving both would report a per-CVE state in words that mean\nsomething else at the version level.\n\n - CVE_STATUS_UNSPECIFIED: Unspecified state.\n - CVE_STATUS_PENDING: Recorded by the cross-reference and not yet triaged.\n - CVE_STATUS_TRIAGED: A reviewer has decided how to remediate; work has not started.\n - CVE_STATUS_IN_PROGRESS: A rebuild or backport is underway.\n - CVE_STATUS_COMPLETED: Chainguard delivered a remediation carrying the fix, and\nremediated_version names it.\n\nDelivery, not the existence of a fix somewhere. The stored status alone\ndoes not establish it: a row completes as soon as an advisory names a fix\nat or above the affected version, and that fix may be one Chainguard never\ningested. Such a row reports FIX_AVAILABLE instead, so this value never\nappears without a remediated_version beside it.\n - CVE_STATUS_EXCLUDED: Ruled out of scope. decision says which kind of out-of-scope, and is the\nfield to render: \"not affected\" and \"no fix planned\" mean opposite things\nto the reader.\n - CVE_STATUS_SUPERSEDED: No active request group references this version any more, so the row is no\nlonger maintained. Reported rather than hidden, because a caller that\npinned the version earlier may still be running it.\n - CVE_STATUS_FIX_AVAILABLE: An advisory names a fix, but Chainguard has not remediated the pinned\nversion. remediated_version is empty: there is no Chainguard remediation\nto name.\n\nNot \"no Chainguard build\": we may well build the release that carries the\nfix, and a plain rebuild of it is content-equivalent to upstream's, so it\nremediates nothing we did. upstream_fix_version names that release, and is\nthe field to read for an upgrade target.\n\nThat release can be the one the caller already pins, where an advisory\nrecords the pinned version itself as fixed. Read that as \"nothing to do\"\nrather than as an upgrade: the value says only that no Chainguard\nremediation exists, and for that shape none is needed. Compare\nupstream_fix_version against the version asked about before presenting it\nas an action.\n\nIts own value rather than COMPLETED, which would claim a remediation\nnobody shipped, and rather than IN_PROGRESS or TRIAGED, which say\nremediation has not landed yet while hiding that the CVE is resolved by\nmoving to a later upstream version today.", "enum": [ "CVE_STATUS_UNSPECIFIED", "CVE_STATUS_PENDING", @@ -3907,7 +3918,7 @@ }, "chainguard.platform.libraries.v2beta1.RequestedLibraryCVEStatus": { "default": "REQUESTED_LIBRARY_CVE_STATUS_UNSPECIFIED", - "description": "RequestedLibraryCVEStatus is the remediation ladder across a library's versions.\n\nOnly meaningful where a contributing group opted in.\n\n - REQUESTED_LIBRARY_CVE_STATUS_UNSPECIFIED: Unspecified remediation status.\n - REQUESTED_LIBRARY_CVE_STATUS_REVIEWING: No version in scope is past being queued, or a cross-referenced one still\nhas untriaged CVEs. One un-cross-referenced version in scope makes the\nlibrary REVIEWING rather than clean: the alternative would report an\nunfinished check as a clean bill of health.\n - REQUESTED_LIBRARY_CVE_STATUS_IN_PROGRESS: Remediation underway on at least one version in scope.\n - REQUESTED_LIBRARY_CVE_STATUS_NO_HIGH_CRITICAL_CVES: Every version in scope came back cross-referenced and clean, and none is\nstill queued.\n - REQUESTED_LIBRARY_CVE_STATUS_COMPLETE: At least one CVE remediated, with nothing in progress and no version in\nscope still queued.\n\nRead it as \"nothing outstanding on the versions you asked us to scan, as\nfar as the last cross-reference knows\" -- not as a durable property of the\nlibrary, and not as a statement about versions outside the scope.\n\nNew upstream versions appear and new CVEs are disclosed against versions\nalready pinned, so a library has no permanent finished state, and this\nvalue can go back to REVIEWING without anything regressing.\n\nA version nobody has cross-referenced holds this value off, for the reason\nit holds off NO_HIGH_CRITICAL_CVES: both claim full coverage of the scope,\nand an unexamined version in it is where that coverage is missing.\n\nremediated_cve_count is reported whatever the status, so a REVIEWING\nlibrary still says how many CVEs were fixed.\n - REQUESTED_LIBRARY_CVE_STATUS_WONT_REMEDIATE: Every CVE on the versions in scope was ruled out of scope. A version in\nscope with no CVEs does not hold this back -- it has none to leave\nunexcluded -- but one that was never cross-referenced does.\n - REQUESTED_LIBRARY_CVE_STATUS_FIX_AVAILABLE: At least one version in scope has a CVE with a fix the caller can move to,\nand Chainguard has not delivered a build of that pinned version.\n\nThe target is not named here. Different pinned versions upgrade to\ndifferent targets, so one library-level version would be wrong for most of\nthem -- the per-version read is where a target belongs.\n\nAdded after the other values. proto3 enums are open, so a client generated\nfrom an earlier copy of this file keeps the number as an unrecognized\nvalue and its switches fall through to their default branch -- it does not\nread as UNSPECIFIED. A client parsing the JSON surface strictly errors on\nthe unknown name instead. Treat an unrecognized value as not computed.", + "description": "RequestedLibraryCVEStatus is the remediation ladder across a library's versions.\n\nOnly meaningful where a contributing group opted in.\n\n - REQUESTED_LIBRARY_CVE_STATUS_UNSPECIFIED: Unspecified remediation status.\n - REQUESTED_LIBRARY_CVE_STATUS_REVIEWING: No version in scope is past being queued, or a cross-referenced one still\nhas untriaged CVEs. One un-cross-referenced version in scope makes the\nlibrary REVIEWING rather than clean: the alternative would report an\nunfinished check as a clean bill of health.\n - REQUESTED_LIBRARY_CVE_STATUS_IN_PROGRESS: Remediation underway on at least one version in scope.\n - REQUESTED_LIBRARY_CVE_STATUS_NO_HIGH_CRITICAL_CVES: Every version in scope came back cross-referenced and clean, and none is\nstill queued.\n - REQUESTED_LIBRARY_CVE_STATUS_COMPLETE: At least one CVE remediated, with nothing in progress and no version in\nscope still queued.\n\nRead it as \"nothing outstanding on the versions you asked us to scan, as\nfar as the last cross-reference knows\" -- not as a durable property of the\nlibrary, and not as a statement about versions outside the scope.\n\nNew upstream versions appear and new CVEs are disclosed against versions\nalready pinned, so a library has no permanent finished state, and this\nvalue can go back to REVIEWING without anything regressing.\n\nA version nobody has cross-referenced holds this value off, for the reason\nit holds off NO_HIGH_CRITICAL_CVES: both claim full coverage of the scope,\nand an unexamined version in it is where that coverage is missing.\n\nremediated_cve_count is reported whatever the status, so a REVIEWING\nlibrary still says how many CVEs were fixed.\n - REQUESTED_LIBRARY_CVE_STATUS_WONT_REMEDIATE: Every CVE on the versions in scope was ruled out of scope. A version in\nscope with no CVEs does not hold this back -- it has none to leave\nunexcluded -- but one that was never cross-referenced does.\n - REQUESTED_LIBRARY_CVE_STATUS_FIX_AVAILABLE: At least one version in scope has a CVE with a fix the caller can move to,\nand Chainguard has not remediated that pinned version.\n\nThe target is not named here. Different pinned versions upgrade to\ndifferent targets, so one library-level version would be wrong for most of\nthem -- the per-version read is where a target belongs.\n\nAdded after the other values. proto3 enums are open, so a client generated\nfrom an earlier copy of this file keeps the number as an unrecognized\nvalue and its switches fall through to their default branch -- it does not\nread as UNSPECIFIED. A client parsing the JSON surface strictly errors on\nthe unknown name instead. Treat an unrecognized value as not computed.", "enum": [ "REQUESTED_LIBRARY_CVE_STATUS_UNSPECIFIED", "REQUESTED_LIBRARY_CVE_STATUS_REVIEWING", @@ -4024,7 +4035,7 @@ "readOnly": true }, "remediatedVersion": { - "description": "The earliest Chainguard build carrying the fix, e.g. \"0.115.0+cgr.1\". May\nmove to an earlier version as older backports land, never to a later one.\n\nEmpty means no Chainguard build is recorded against this CVE. It does not\nmean no fix exists: an upstream release may carry one, and status\nFIX_AVAILABLE says so where we know. Rendering an empty value as \"no fix\"\nis the one reading that stops a customer investigating.\n\nThis field does not yet carry the upstream upgrade target, and does not yet\nreport a fix target that landed on the malware block list as blocked. Until\nit does, treat it as evidence of a Chainguard build and not as the complete\nanswer about where a fix exists.", + "description": "The earliest Chainguard remediation carrying the fix, e.g.\n\"0.115.0+cgr.1\". May move to an earlier version as older backports land,\nnever to a later one.\n\nAlways a cgr cut, never a plain rebuild. A rebuild of an upstream release\nis built from upstream's source and carries whatever that release carries,\nso naming one here would credit Chainguard with a fix upstream made. The\nupstream release that resolves the CVE is upstream_fix_version.\n\nEmpty means no Chainguard remediation is recorded against this CVE. It\ndoes not mean no fix exists: an upstream release may carry one, and status\nFIX_AVAILABLE says so where we know. Rendering an empty value as \"no fix\"\nis the one reading that stops a customer investigating.\n\nThis field does not yet report a fix target that landed on the malware\nblock list as blocked, so treat it as evidence of a Chainguard remediation\nand not as the complete answer about where a fix exists.", "readOnly": true, "type": "string" }, @@ -4045,6 +4056,11 @@ ], "description": "Remediation state of this CVE on this version.", "readOnly": true + }, + "upstreamFixVersion": { + "description": "The version the upstream advisory names as fixed, e.g. \"3.9.2\". Upstream's\nclaim, recorded as received and not verified by Chainguard.\n\nNever a remediation Chainguard performed: remediated_version is the only\nfield that names one. Presenting this value as a Chainguard fix credits us\nwith upstream's work, and the two populations differ by an order of\nmagnitude -- upstream has fixed far more CVEs than we have cut a build for.\n\nRead both to answer \"how do I resolve this CVE\": this field says which\nupstream release resolves it, remediated_version says whether Chainguard\nalready remediated the version the caller pinned.\n\nEmpty where upstream recorded no fix, which covers a CVE upstream has not\nfixed and one whose advisory names no version.", + "readOnly": true, + "type": "string" } }, "type": "object" @@ -4637,10 +4653,10 @@ "type": "object" }, "chainguard.platform.registry.v2beta1.OverlayBinding": { - "description": "OverlayBinding binds one overlay to one repo — or, when all_repos is\nset, to every repo in an organization — under a tag selector. Its UID\nis a UIDP under the resource it attaches to: the repo, or the\norganization (root group) for all-repos bindings. Bindings have no\nname; audit rendering comes from the repo (or the all-repos marker),\nthe selector, and the expanded overlay content.", + "description": "OverlayBinding binds one overlay to one repo — or, when all_repos is\nset, to every repo under an organization or folder — under a tag\nselector. Its UID is a UIDP under the resource it attaches to: the\nrepo, or the group (the organization's root group, or a folder at any\ndepth) for all-repos bindings. Bindings have no name; audit rendering\ncomes from the repo (or the all-repos marker), the selector, and the\nexpanded overlay content.", "properties": { "allRepos": { - "description": "AllRepos marks a binding that applies to every repo in the\norganization — current and future — instead of a single repo. Such a\nbinding's UID is a UIDP under the organization (root group) and\n`repo` is empty; the tag selector still scopes which tags are\ncustomized on each repo. Immutable, like the repo reference:\nchanging a binding's scope is delete plus create.", + "description": "AllRepos marks a binding that applies to every repo under its\nparent group — the whole organization, or a folder's subtree —\ncurrent and future, instead of a single repo. Such a binding's UID\nis a UIDP under that group and `repo` is empty; the tag selector\nstill scopes which tags are customized on each repo. Immutable,\nlike the repo reference: changing a binding's scope is delete plus\ncreate.", "readOnly": true, "type": "boolean" }, @@ -4681,7 +4697,7 @@ "description": "CreateOverlayBindingRequest is the request message for attaching an\noverlay to a repo.\n", "properties": { "allRepos": { - "description": "AllRepos, when true, attaches the overlay to every repo in the\norganization named by `parent` — including repos created after the\nbinding exists — instead of a single repo. `parent` must then be the\norganization's root group UIDP; a non-root parent fails\nInvalidArgument. The tag selector still scopes which tags are\ncustomized on each repo. At create time an all-repos binding is\nchecked against the organization's other all-repos bindings only —\nat most one all-repos binding per (organization, overlay) pair\n(AlreadyExists), and co-matching selectors must reference overlays\nwhose configs merge commutatively (FailedPrecondition) — never\nagainst individual repos' bindings: the two scopes compose in\nseparate precedence layers at rebuild time (see TagSelector). Repos\nwhose legacy custom_overlay is set keep the legacy behavior and skip\nall-repos bindings at rebuild time.", + "description": "AllRepos, when true, attaches the overlay to every repo under the\ngroup named by `parent` — including repos created after the binding\nexists — instead of a single repo. `parent` must then be a group\nUIDP: the organization's root group (the binding covers the whole\norg) or a folder at any depth (the binding covers the folder's\nsubtree). A parent that is not a live group — a repo UIDP, a\ndeleted folder, a typo — fails InvalidArgument: the API confirms\nthe group against the IAM store before creating. The caller's\nauthorization on parent is settled by the request's iam_scope\nauthorization.\nThe tag selector still scopes which tags are customized on each\nrepo. At create time an all-repos binding is checked against the\nother all-repos bindings of the SAME group only — at most one\nall-repos binding per (group, overlay) pair (AlreadyExists), and\nco-matching selectors must reference overlays whose configs merge\ncommutatively (FailedPrecondition) — never against individual\nrepos' bindings or other scopes' all-repos bindings: scopes compose\nin depth-ordered precedence layers at rebuild time (see\nTagSelector). Repos whose legacy custom_overlay is set keep the\nlegacy behavior and skip all-repos bindings at rebuild time.", "type": "boolean" }, "overlay": { @@ -4899,7 +4915,7 @@ "type": "object" }, "chainguard.platform.registry.v2beta1.TagSelector": { - "description": "1. The repo's KIND_ALL bindings.\n 2. KIND_VARIANT bindings whose variant_type matches the tag (today\n only VARIANT_TYPE_DEV, matching the \"-dev\" tag suffix).\n 3. KIND_EXACT bindings whose `tags` include the tag.\n\nLayers merge later-wins for scalar fields; packages accumulate. A later\nlayer is more specific. The Guarded Entrypoint fields\n(guarded_entrypoint, preflight, command_override, fail_mode) state how\nthey layer on each field of CustomOverlay. All three layers can stack on\na single tag (e.g. `latest-dev`). Within one layer, co-matching bindings\nmerge commutatively: the bind-time compatibility check (see\nCreateOverlayBindingRequest.tag_selector) guarantees their overlays'\nconfigs never set the same field to different values.\n\nWhen the organization has all-repos bindings (see\nCreateOverlayBindingRequest.all_repos), their three kind layers apply\nBELOW the repo's own: all-repos ALL, VARIANT, EXACT compose first, then\nthe repo-scoped layers on top — a repo-scoped binding always wins\nscalar conflicts against an all-repos binding, so all-repos bindings\nact as organization-wide defaults that each repo's own bindings can\noverride. Packages still accumulate across all six layers. Scope\nlayers never co-match each other: the bind-time compatibility check\nruns among all-repos bindings of the organization and among the repo's\nown bindings, never across the two scopes.", + "description": "1. The repo's KIND_ALL bindings.\n 2. KIND_VARIANT bindings whose variant_type matches the tag (today\n only VARIANT_TYPE_DEV, matching the \"-dev\" tag suffix).\n 3. KIND_EXACT bindings whose `tags` include the tag.\n\nLayers merge later-wins for scalar fields; packages accumulate. A later\nlayer is more specific. The Guarded Entrypoint fields\n(guarded_entrypoint, preflight, command_override, fail_mode) state how\nthey layer on each field of CustomOverlay. All three layers can stack on\na single tag (e.g. `latest-dev`). Within one layer, co-matching bindings\nmerge commutatively: the bind-time compatibility check (see\nCreateOverlayBindingRequest.tag_selector) guarantees their overlays'\nconfigs never set the same field to different values.\n\nWhen a repo's ancestor groups have all-repos bindings (see\nCreateOverlayBindingRequest.all_repos), each scope's three kind\nlayers apply BELOW the repo's own, ordered by depth: the\norganization's all-repos ALL, VARIANT, EXACT compose first, then each\nenclosing folder's layers shallowest to deepest, then the repo-scoped\nlayers on top — a deeper scope wins scalar conflicts against a\nshallower one and a repo-scoped binding wins against any all-repos\nbinding, so all-repos bindings act as organization- or folder-wide\ndefaults that narrower scopes can override. Packages still accumulate\nacross every layer. Scope layers never co-match each other: the\nbind-time compatibility check runs among the all-repos bindings of\none group and among the repo's own bindings, never across scopes.", "properties": { "kind": { "allOf": [ @@ -7760,7 +7776,7 @@ }, "/iam/v2beta1/groups:checkEligibility": { "get": { - "description": "CheckEligibility reports whether the caller passes the same eligibility\ngates applied by LookupGroup and RequestGroupAccess. A response of\neligible=true does not guarantee those calls succeed for other reasons\n(no matching org, already requested, etc.).", + "description": "CheckEligibility reports whether the caller's email domain may use the\nself-serve Groups flows. A personal-mail domain may only create an\nunverified Starter organization (see\nCheckEligibilityResponse.unverified_starter); LookupGroup and\nRequestGroupAccess refuse it. A response of eligible=true does not\nguarantee those calls succeed for other reasons (no matching org,\nalready requested, etc.).", "operationId": "GroupsService_CheckEligibility", "responses": { "200": { @@ -10682,7 +10698,7 @@ } }, { - "description": "Filter by CVE-remediation status.\n\n - CVE_REMEDIATION_STATUS_UNSPECIFIED: Unspecified remediation status.\n - CVE_REMEDIATION_STATUS_SCAN_QUEUED: Queued for review, or not yet resolvable to a version we hold. Distinct from\nNO_HIGH_CRITICAL_CVES: this means no answer yet, not a clean answer.\n - CVE_REMEDIATION_STATUS_NO_HIGH_CRITICAL_CVES: Cross-referenced against advisory data, and no High or Critical CVEs apply.\n - CVE_REMEDIATION_STATUS_REVIEWING: CVEs identified; remediation not started.\n - CVE_REMEDIATION_STATUS_IN_PROGRESS: Remediation underway on at least one CVE.\n - CVE_REMEDIATION_STATUS_COMPLETE: Remediation finished with at least one CVE remediated.\n - CVE_REMEDIATION_STATUS_WONT_REMEDIATE: Every CVE on this version was ruled out of scope. The decision on\nCVERemediation says which kind of out-of-scope.\n - CVE_REMEDIATION_STATUS_FIX_AVAILABLE: A fix exists that the caller can move to now, and Chainguard has not\ndelivered a build of the pinned version. fix_version names the target\nwhere one can be named.\n\nDistinct from REVIEWING, which says remediation has not started and would\nhide an upgrade available today, and from COMPLETE, which claims a build\nChainguard shipped. Reached when an untriaged CVE already records a fix\ntarget, or when an advisory named a fix at or above the pinned version\nthat Chainguard never ingested.\n\nAdded after the other values. proto3 enums are open, so a client generated\nfrom an earlier copy of this file keeps the number as an unrecognized\nvalue and its switches fall through to their default branch -- it does not\nread as UNSPECIFIED. A client parsing the JSON surface strictly errors on\nthe unknown name instead. Treat an unrecognized value as not computed.\n\nA version that reports this today reported REVIEWING before the value\nexisted.", + "description": "Filter by CVE-remediation status.\n\n - CVE_REMEDIATION_STATUS_UNSPECIFIED: Unspecified remediation status.\n - CVE_REMEDIATION_STATUS_SCAN_QUEUED: Queued for review, or not yet resolvable to a version we hold. Distinct from\nNO_HIGH_CRITICAL_CVES: this means no answer yet, not a clean answer.\n - CVE_REMEDIATION_STATUS_NO_HIGH_CRITICAL_CVES: Cross-referenced against advisory data, and no High or Critical CVEs apply.\n - CVE_REMEDIATION_STATUS_REVIEWING: CVEs identified; remediation not started.\n - CVE_REMEDIATION_STATUS_IN_PROGRESS: Remediation underway on at least one CVE.\n - CVE_REMEDIATION_STATUS_COMPLETE: Remediation finished with at least one CVE remediated.\n - CVE_REMEDIATION_STATUS_WONT_REMEDIATE: Every CVE on this version was ruled out of scope. The decision on\nCVERemediation says which kind of out-of-scope.\n - CVE_REMEDIATION_STATUS_FIX_AVAILABLE: A fix exists that the caller can move to now, and Chainguard has not\nremediated the pinned version.\n\nNo target is named at this level: CVERemediation aggregates a version's\nCVEs and carries no version field, so there is nothing here a caller could\nmistake for somewhere to go. The per-CVE read names the target, in\nRequestedLibraryVersionCVE.upstream_fix_version.\n\nDistinct from REVIEWING, which says remediation has not started and would\nhide an upgrade available today, and from COMPLETE, which claims a build\nChainguard shipped. Reached when an untriaged CVE already records a fix\ntarget, or when an advisory named a fix at or above the pinned version\nthat Chainguard never ingested.\n\nAdded after the other values. proto3 enums are open, so a client generated\nfrom an earlier copy of this file keeps the number as an unrecognized\nvalue and its switches fall through to their default branch -- it does not\nread as UNSPECIFIED. A client parsing the JSON surface strictly errors on\nthe unknown name instead. Treat an unrecognized value as not computed.\n\nA version that reports this today reported REVIEWING before the value\nexisted.", "in": "query", "name": "cveRemediationStatus", "schema": { @@ -11119,7 +11135,7 @@ } }, { - "description": "Filter by computed CVE-remediation status.\n\n - REQUESTED_LIBRARY_CVE_STATUS_UNSPECIFIED: Unspecified remediation status.\n - REQUESTED_LIBRARY_CVE_STATUS_REVIEWING: No version in scope is past being queued, or a cross-referenced one still\nhas untriaged CVEs. One un-cross-referenced version in scope makes the\nlibrary REVIEWING rather than clean: the alternative would report an\nunfinished check as a clean bill of health.\n - REQUESTED_LIBRARY_CVE_STATUS_IN_PROGRESS: Remediation underway on at least one version in scope.\n - REQUESTED_LIBRARY_CVE_STATUS_NO_HIGH_CRITICAL_CVES: Every version in scope came back cross-referenced and clean, and none is\nstill queued.\n - REQUESTED_LIBRARY_CVE_STATUS_COMPLETE: At least one CVE remediated, with nothing in progress and no version in\nscope still queued.\n\nRead it as \"nothing outstanding on the versions you asked us to scan, as\nfar as the last cross-reference knows\" -- not as a durable property of the\nlibrary, and not as a statement about versions outside the scope.\n\nNew upstream versions appear and new CVEs are disclosed against versions\nalready pinned, so a library has no permanent finished state, and this\nvalue can go back to REVIEWING without anything regressing.\n\nA version nobody has cross-referenced holds this value off, for the reason\nit holds off NO_HIGH_CRITICAL_CVES: both claim full coverage of the scope,\nand an unexamined version in it is where that coverage is missing.\n\nremediated_cve_count is reported whatever the status, so a REVIEWING\nlibrary still says how many CVEs were fixed.\n - REQUESTED_LIBRARY_CVE_STATUS_WONT_REMEDIATE: Every CVE on the versions in scope was ruled out of scope. A version in\nscope with no CVEs does not hold this back -- it has none to leave\nunexcluded -- but one that was never cross-referenced does.\n - REQUESTED_LIBRARY_CVE_STATUS_FIX_AVAILABLE: At least one version in scope has a CVE with a fix the caller can move to,\nand Chainguard has not delivered a build of that pinned version.\n\nThe target is not named here. Different pinned versions upgrade to\ndifferent targets, so one library-level version would be wrong for most of\nthem -- the per-version read is where a target belongs.\n\nAdded after the other values. proto3 enums are open, so a client generated\nfrom an earlier copy of this file keeps the number as an unrecognized\nvalue and its switches fall through to their default branch -- it does not\nread as UNSPECIFIED. A client parsing the JSON surface strictly errors on\nthe unknown name instead. Treat an unrecognized value as not computed.", + "description": "Filter by computed CVE-remediation status.\n\n - REQUESTED_LIBRARY_CVE_STATUS_UNSPECIFIED: Unspecified remediation status.\n - REQUESTED_LIBRARY_CVE_STATUS_REVIEWING: No version in scope is past being queued, or a cross-referenced one still\nhas untriaged CVEs. One un-cross-referenced version in scope makes the\nlibrary REVIEWING rather than clean: the alternative would report an\nunfinished check as a clean bill of health.\n - REQUESTED_LIBRARY_CVE_STATUS_IN_PROGRESS: Remediation underway on at least one version in scope.\n - REQUESTED_LIBRARY_CVE_STATUS_NO_HIGH_CRITICAL_CVES: Every version in scope came back cross-referenced and clean, and none is\nstill queued.\n - REQUESTED_LIBRARY_CVE_STATUS_COMPLETE: At least one CVE remediated, with nothing in progress and no version in\nscope still queued.\n\nRead it as \"nothing outstanding on the versions you asked us to scan, as\nfar as the last cross-reference knows\" -- not as a durable property of the\nlibrary, and not as a statement about versions outside the scope.\n\nNew upstream versions appear and new CVEs are disclosed against versions\nalready pinned, so a library has no permanent finished state, and this\nvalue can go back to REVIEWING without anything regressing.\n\nA version nobody has cross-referenced holds this value off, for the reason\nit holds off NO_HIGH_CRITICAL_CVES: both claim full coverage of the scope,\nand an unexamined version in it is where that coverage is missing.\n\nremediated_cve_count is reported whatever the status, so a REVIEWING\nlibrary still says how many CVEs were fixed.\n - REQUESTED_LIBRARY_CVE_STATUS_WONT_REMEDIATE: Every CVE on the versions in scope was ruled out of scope. A version in\nscope with no CVEs does not hold this back -- it has none to leave\nunexcluded -- but one that was never cross-referenced does.\n - REQUESTED_LIBRARY_CVE_STATUS_FIX_AVAILABLE: At least one version in scope has a CVE with a fix the caller can move to,\nand Chainguard has not remediated that pinned version.\n\nThe target is not named here. Different pinned versions upgrade to\ndifferent targets, so one library-level version would be wrong for most of\nthem -- the per-version read is where a target belongs.\n\nAdded after the other values. proto3 enums are open, so a client generated\nfrom an earlier copy of this file keeps the number as an unrecognized\nvalue and its switches fall through to their default branch -- it does not\nread as UNSPECIFIED. A client parsing the JSON surface strictly errors on\nthe unknown name instead. Treat an unrecognized value as not computed.", "in": "query", "name": "cveStatus", "schema": { @@ -11371,7 +11387,7 @@ } }, { - "description": "Filter by CVE-remediation status.\n\n - CVE_REMEDIATION_STATUS_UNSPECIFIED: Unspecified remediation status.\n - CVE_REMEDIATION_STATUS_SCAN_QUEUED: Queued for review, or not yet resolvable to a version we hold. Distinct from\nNO_HIGH_CRITICAL_CVES: this means no answer yet, not a clean answer.\n - CVE_REMEDIATION_STATUS_NO_HIGH_CRITICAL_CVES: Cross-referenced against advisory data, and no High or Critical CVEs apply.\n - CVE_REMEDIATION_STATUS_REVIEWING: CVEs identified; remediation not started.\n - CVE_REMEDIATION_STATUS_IN_PROGRESS: Remediation underway on at least one CVE.\n - CVE_REMEDIATION_STATUS_COMPLETE: Remediation finished with at least one CVE remediated.\n - CVE_REMEDIATION_STATUS_WONT_REMEDIATE: Every CVE on this version was ruled out of scope. The decision on\nCVERemediation says which kind of out-of-scope.\n - CVE_REMEDIATION_STATUS_FIX_AVAILABLE: A fix exists that the caller can move to now, and Chainguard has not\ndelivered a build of the pinned version. fix_version names the target\nwhere one can be named.\n\nDistinct from REVIEWING, which says remediation has not started and would\nhide an upgrade available today, and from COMPLETE, which claims a build\nChainguard shipped. Reached when an untriaged CVE already records a fix\ntarget, or when an advisory named a fix at or above the pinned version\nthat Chainguard never ingested.\n\nAdded after the other values. proto3 enums are open, so a client generated\nfrom an earlier copy of this file keeps the number as an unrecognized\nvalue and its switches fall through to their default branch -- it does not\nread as UNSPECIFIED. A client parsing the JSON surface strictly errors on\nthe unknown name instead. Treat an unrecognized value as not computed.\n\nA version that reports this today reported REVIEWING before the value\nexisted.", + "description": "Filter by CVE-remediation status.\n\n - CVE_REMEDIATION_STATUS_UNSPECIFIED: Unspecified remediation status.\n - CVE_REMEDIATION_STATUS_SCAN_QUEUED: Queued for review, or not yet resolvable to a version we hold. Distinct from\nNO_HIGH_CRITICAL_CVES: this means no answer yet, not a clean answer.\n - CVE_REMEDIATION_STATUS_NO_HIGH_CRITICAL_CVES: Cross-referenced against advisory data, and no High or Critical CVEs apply.\n - CVE_REMEDIATION_STATUS_REVIEWING: CVEs identified; remediation not started.\n - CVE_REMEDIATION_STATUS_IN_PROGRESS: Remediation underway on at least one CVE.\n - CVE_REMEDIATION_STATUS_COMPLETE: Remediation finished with at least one CVE remediated.\n - CVE_REMEDIATION_STATUS_WONT_REMEDIATE: Every CVE on this version was ruled out of scope. The decision on\nCVERemediation says which kind of out-of-scope.\n - CVE_REMEDIATION_STATUS_FIX_AVAILABLE: A fix exists that the caller can move to now, and Chainguard has not\nremediated the pinned version.\n\nNo target is named at this level: CVERemediation aggregates a version's\nCVEs and carries no version field, so there is nothing here a caller could\nmistake for somewhere to go. The per-CVE read names the target, in\nRequestedLibraryVersionCVE.upstream_fix_version.\n\nDistinct from REVIEWING, which says remediation has not started and would\nhide an upgrade available today, and from COMPLETE, which claims a build\nChainguard shipped. Reached when an untriaged CVE already records a fix\ntarget, or when an advisory named a fix at or above the pinned version\nthat Chainguard never ingested.\n\nAdded after the other values. proto3 enums are open, so a client generated\nfrom an earlier copy of this file keeps the number as an unrecognized\nvalue and its switches fall through to their default branch -- it does not\nread as UNSPECIFIED. A client parsing the JSON surface strictly errors on\nthe unknown name instead. Treat an unrecognized value as not computed.\n\nA version that reports this today reported REVIEWING before the value\nexisted.", "in": "query", "name": "cveRemediationStatus", "schema": { @@ -11768,7 +11784,7 @@ "description": "The binding to update. The uid identifies the binding; tag_selector\nis its only mutable field. The repo, the all_repos scope, and the\noverlay reference are immutable (OUTPUT_ONLY): moving or re-scoping\na binding is delete on the old scope plus create on the new one.", "properties": { "allRepos": { - "description": "AllRepos marks a binding that applies to every repo in the\norganization — current and future — instead of a single repo. Such a\nbinding's UID is a UIDP under the organization (root group) and\n`repo` is empty; the tag selector still scopes which tags are\ncustomized on each repo. Immutable, like the repo reference:\nchanging a binding's scope is delete plus create.", + "description": "AllRepos marks a binding that applies to every repo under its\nparent group — the whole organization, or a folder's subtree —\ncurrent and future, instead of a single repo. Such a binding's UID\nis a UIDP under that group and `repo` is empty; the tag selector\nstill scopes which tags are customized on each repo. Immutable,\nlike the repo reference: changing a binding's scope is delete plus\ncreate.", "readOnly": true, "type": "boolean" }, @@ -11838,7 +11854,7 @@ "operationId": "OverlayBindingsService_CreateOverlayBinding", "parameters": [ { - "description": "The UIDP of the repo to attach to — or, when all_repos is set, the\nUIDP of the organization (root group) whose repos the binding\napplies to.", + "description": "The UIDP of the repo to attach to — or, when all_repos is set, the\nUIDP of the group whose repos the binding applies to: the\norganization's root group for an org-wide binding, or a folder at\nany depth to scope the binding to that folder's subtree.", "in": "path", "name": "uid", "required": true, @@ -12169,7 +12185,7 @@ "operationId": "OverlaysService_CreateOverlay", "parameters": [ { - "description": "The group UIDP under which the Overlay is created.", + "description": "The organization's root group UIDP under which the Overlay is\ncreated. Overlays are organization-level resources — one definition\nreferencable from every binding scope — so a folder or repo parent\nfails InvalidArgument; bindings, not overlays, carry the scope.", "in": "path", "name": "uid", "required": true, diff --git a/static/api.json b/static/api.json index 9f333c9c3d..d622b91acb 100644 --- a/static/api.json +++ b/static/api.json @@ -3,7 +3,7 @@ "schemas": { "chainguard.capabilities.Capability": { "default": "UNKNOWN", - "description": "Capability is an enumeration of the Chainguard IAM capabilities.\n\n - CAP_TENANT_VULN_REPORTS_LIST: TODO(colin): deprecate this cap once the legacy endpoint is removed\n - CAP_REPO_BLOBS_GET: repo.blobs.get is a capability required to pull container images.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with images vs pulling the image itself.\n - CAP_REPO_CREATE: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_CREATE as a transitional grant for write access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_WRITE, drop the dual-accept in cassie.\n - CAP_REPO_LIST: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_LIST as a transitional grant for read access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_READ, drop the dual-accept in cassie.\n - CAP_REPO_INTERNAL_ADMIN: repo.internal.admin allows administering internal-only repository fields\n(catalog tier, bundles, aliases, active tags, README, and sync settings)\nthat are otherwise read-only to customers.\n - CAP_APK_BLOBS_GET: apk.blobs.get is a capability required to pull APKs.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with APKs vs pulling the APK itself.\n - CAP_BUILD_REPORT_LIST: Custom Image Build\n - CAP_LIBRARIES_ENTITLEMENTS_CREATE: Global libraries capabilities\n - CAP_LIBRARIES_PYTHON_LIST: Ecosystems specific capabilities\n - CAP_LIBRARIES_CACHE_INVALIDATE: Cache invalidation capability for the libraries cache (covers all ecosystems).\nGranted to org owners and account admins; not to regular developer members.\n - CAP_LIBRARIES_CACHE_LIST: Read capability for the libraries resolution cache (status and entry\nlisting). Separate from CAP_LIBRARIES_ENTITLEMENTS_LIST on purpose: an\norg's dependency-consumption history is sensitive data.\n - CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE: Rebuilder API capabilities\n - CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_CREATE: AWS Marketplace Subscriptions (Chainguard Libraries on AWS Security Hub Extended)\n - CAP_LIBRARIES_REQUEST_GROUPS_CREATE: Library build requests: an organization asks Chainguard to build specific\nlibrary versions and tracks what it already has.\n\nSeparate from the libraries.rebuilder.* capabilities above, which are\ninternal_only and are never grantable to a customer organization.\n - CAP_LIBRARIES_REQUEST_GROUPS_LIST: list covers every read on a request group: the groups themselves, their\nitems, and the per-library view of them.\n - CAP_LIBRARIES_REQUEST_GROUPS_DELETE: delete covers draft groups only; removing a submitted group needs\ndelete_submitted.\n - CAP_LIBRARIES_REQUEST_GROUPS_SUBMIT: submit promotes a draft and carries the CVE-remediation opt-in for the group.\nIt is its own capability because submitting is restricted to owners, which a\nfield mask on update could not express.\n - CAP_LIBRARIES_REQUEST_GROUPS_ITEMS_UPDATE: items.update covers draft item editing: remove, restore and per-item update.\n - CAP_LIBRARIES_REQUEST_GROUPS_REFRESH_COVERAGE: Re-running a group's coverage check is expensive, and submitted groups are\nrefreshed automatically, so it is reserved for Chainguard support.\n - CAP_LIBRARIES_REMOTE_REGISTRIES_CREATE: Remote registries: an org's configured upstream registries for virtual\nrepositories. Creating or deleting one changes where the org's builds\npull dependencies from, so both are owner-only alongside the library\npolicy capabilities; list is ordinary member read.\n - CAP_LIBRARIES_STORAGE_USAGE_GET: Storage usage: how much storage an org's own uploads consume in each\nlanguage ecosystem. Owner-only because it is org-wide accounting (and the\nbasis for upcoming quotas), not something every member needs to see.\n - CAP_REGISTRY_ENTITLEMENTS_LIST: Registry Entitlements\n - CAP_REGISTRY_SETTINGS_LIST: Registry Settings\n - CAP_REGISTRY_OVERLAYS_LIST: Registry Overlays (tag-scoped Custom Assembly)\n - CAP_REGISTRY_DEPLOYMENTS_CREATE: Registry Deployments\n - CAP_POLICIES_POLICY_CREATE: Policies\n - CAP_POLICIES_OVERRIDE_CREATE: Policy overrides waive enforcement for a specific artifact. These are\nseparate capabilities from binding management so they can be granted\nindependently. By default create and delete are held by org owners (like\nbinding management) and listing is available to viewers.\n - CAP_TERMS_ACCEPT: Terms\n - CAP_GULFSTREAM: This is orthogonal enough that we should leave\nit somewhat separate, so add new capabilities above.\nTODO(mattmoor): Think about whether we can encode specific\ncontroller capabilities into our access control here?\ne.g. could each logical controller/webhook be its own\ncapability?\n - CAP_GUARDENER_DFC_CONVERT: Guardener\n - CAP_GUARDENER_ASSOCIATION_MANAGE: guardener.association.manage gates self-service linking/unlinking of a\nGitHub org to a Chainguard group (the GroupAccountAssociations record).\n - CAP_GUARDENER_ASSOCIATION_LIST: guardener.association.list gates read-only listing of the GitHub org\ninstallations linked to a Chainguard group (the read counterpart to\nguardener.association.manage).\n - CAP_GUARDENER_ENTITLEMENT_MANAGE: guardener.entitlement.manage gates the support-only surface for configuring a\ngroup's guardener entitlement (e.g. which repo visibility scope guardener\nresponds to). It is internal_only: it can never be granted by a role\navailable to customer organizations.\n - CAP_GUARDENER_ENTITLEMENT_LIST: guardener.entitlement.list gates read-only access to a group's guardener\nentitlement. Unlike guardener.entitlement.manage it is not internal_only, so\nnormal viewers can see the settings that apply to their group.\n - CAP_GUARDENER_ACTIONS_MIGRATE: Guardener actions migrator — on-demand enqueue of a repository's GitHub\nActions migration (opens a pull request), tracked via a long-running\noperation. Mutating, so distinct from the read-only actions catalog cap.\n - CAP_GUARDENER_SCAN_LIST: guardener.scan.list gates listing summaries of the dependency scans\nguardener builds for the group's linked repositories.\n - CAP_GUARDENER_SCAN_GET: guardener.scan.get gates reading one dependency scan by id (its declared\nartifacts and their relationships).\n - CAP_GUARDENER_IMAGES_MIGRATE: Authorizes requesting and reading repository image migrations.\n - CAP_MCP_TOOL_CALL: MCP tool calls\n - CAP_SKILLS_PUBLISH: Skills registry — publishing skill artifacts to skills.cgr.dev\n - CAP_SKILLS_ENTITLEMENTS_CREATE: Skills registry entitlements\n - CAP_SKILLS_LIST: Skills catalog metadata table (description / license / category) backing\nListSkills/GetSkill and search. One org-agnostic set: per-org isolation is\nthe UIDP scope on each RPC, not separate caps. These gate the catalog\ntable's CRUD only; publishing skill artifacts to the registry stays\nCAP_SKILLS_PUBLISH and entitlements stay CAP_SKILLS_ENTITLEMENTS_*.\n\nskills.list is customer-facing (read the catalog for orgs you can access).\nThe writes are internal_only: the catalog is populated by the Chainguard\npublish pipeline, not by customer orgs, so a customer role can never be\ngranted them (a role carrying them must also grant CAP_INTERNAL).\nskills.write is a single create-or-update cap: UpdateSkill is one\nAIP-134 create-or-update RPC, so there is no separate create vs update.\n - CAP_SKILLS_HARDEN_READ: Skills harden — access to the Skills harden API, split per RPC so read,\nsubmit, and cancel can be granted independently. Customer-facing: an org\nmember holds these on the target group named by `chainctl skills harden\n--group`.\n read -\u003e GetHardenOperation\n write -\u003e HardenSkill (submit)\n cancel -\u003e CancelHardenOperation\nThese let a customer kick off and track a harden; they do NOT let the caller\nwrite the hardened output. Publishing the hardened artifact and recording the\njob result into the skills registry/catalog is done by internal identities\nvia the internal_only skills.write cap, and the pipeline's record-result RPC\nis gated on CAP_INTERNAL — so a customer can never push into the hardened\narea directly.\n - CAP_ARGOS_DOCUMENTS_CREATE: Argos — client-side encrypted document records.\n - CAP_ARGOS_DOCUMENTATION_READ: Argos — documentation visibility. Grants read access to Argos API\ndocumentation.\n - CAP_ARGOS_OSV_READ: Argos — Private OSV API (customer-facing OSV query surface).\n - CAP_ARGOS_COALITION_MEMBER: Argos — identity types. Mutually exclusive: an identity holding both is\ntreated as a mitigation partner (the more restrictive of the two) for any\nAPI call which varies the return value based on identity type.\n - CAP_ARGOS_PARTNER_CAPABILITY_REQUEST: Argos — mitigation partner capabilities. request lets a partner submit\nits capabilities and interests; approve lets staff review them.\n - CAP_LIBRARIES_POLICY_CREATE: Libraries Policy Gates — customer-facing policies and bindings that\nconfigure the cooldown and malware gates applied to upstream package pulls,\nplus the block events recorded when a pull is withheld.\n - CAP_BUILDAPI_BUILD_CREATE: Build API\n - CAP_CASSIE_CAS_READ: Cassie REAPI cache surface. CAS (blobs + ByteStream) and the ActionCache\nare separately gated: a caller may read or write action results without\nany authority over the underlying content blobs, and vice versa.\n - CAP_LOGGIE_LOGS_READ: Loggie: the live-log service. Readers tailing a stream hold logs.read;\na producer appending to its streams holds logs.write; the orchestrator\nissuing streams holds logs.create. Appending also requires the stream's\nsigned write name, so a logs.write holder can only append to streams it\nwas handed.\n - CAP_REX_EXECUTIONS_CREATE: Rex: the remote-execution service. The edge authorizes submitting an\nexecution; the scheduler authorizes a worker joining the pool; the\nexecutions query surface authorizes cross-run reads at the instance.\n - CAP_REX_CLASS_USE: Gated platform classes. USE authorizes submitting an execution that\ndemands a gated class; SERVE authorizes a worker pool advertising one.\nBoth are evaluated at the class's own UIDP node, never at the instance.\n - CAP_ACTIONS_LIST: Actions catalog — the read-only catalog of Chainguard-published GitHub\nActions and the upstreams they mirror. Writes are internal (importer only).\n - CAP_ACTIONS_DEPENDENCIES_UPDATE: Recording the dependency edges of a composite action's revision, i.e. the\n`uses:` steps of its action.yml. Internal only: the edges are derived by\nthe hardening pipeline that reads the action.yml, and are not something a\ncustomer asserts about the shared graph.\n - CAP_ACTIONS_DEPENDENCIES_LIST: Reading the dependency graph. Internal only: reads are fenced to groups the\ncaller holds a capability in, which no customer does for these actions.\n - CAP_SANDBOX_RUN_CREATE: Sandbox: the ACID sandbox Runs control plane (the WorkflowRuns API,\nai-cicd/sandbox). Customer-grantable — an org's members run, watch, and\ncancel workflow runs in the org's own instance — via the sandbox.user\nrole, and held by Owners. The SANDBOX service principal's internal\nsandbox.service_agent role carries the same capabilities.\n - CAP_SANDBOX_INSTALLATIONS_RESOLVE: Resolving a guardener GitHub App installation to the root group it is\nlinked to. Internal only: the answer names another customer's\norganization, so it is held by the sandbox GitHub reconciler alone and\nchecked at the acid-sandbox group, never at a customer group.\n - CAP_ENTITLEMENTS_FEATURES_LIST: Central Entitlements Service FEATURE entitlements (product features such\nas sandbox_checks). Reading an organization's FEATURE rows. Internal only:\nit is held by the SANDBOX service principal's sandbox.service_agent role,\nwhich reads the org's rows to admit work. It is separate from\nregistry.entitlements.list so the SANDBOX principal cannot read image\nentitlements.\n - CAP_ENTITLEMENTS_FEATURES_MANAGE: Writing and deleting an organization's FEATURE rows as Chainguard\n(the INTERNAL and CONSOLE_ADMIN sources). Internal only: it is the support\nsurface for backfill, trial extension and the kill switch, held through the\nsupport role.\n - CAP_SANDBOX_SESSION_CREATE: Sandbox develop sessions (the Sessions API, ai-cicd/sandbox): resident\ndevelopment sessions opened with `chainctl develop`. session.create opens\nsessions and lets the caller see and manage its own; it is\ncustomer-grantable via the sandbox.user role. session.list sees and\nmanages (renames, deletes) every user's sessions in the instance — an\nadministrative power held by Owners, not by sandbox.user.\n - CAP_SANDBOX_IDENTITY_CREATE: Sandbox develop session identities: the GCP (and later other cloud)\nidentities a session may act as. identity.create defines, updates, and\ndeletes the caller's own personal identities, via the sandbox.user role.\nidentity.use consents a shared identity into one's session; it is checked\nat the shared identity's groups, so it has its own role\n(sandbox.identity.user) that an owner binds at the groups they choose.\nidentity.admin defines shared identities and sees every identity in the\ninstance; Owners hold it.\n - CAP_TELEMETRY_CONTAINERS_LIST: Telemetry: read access to the container images a group's linked\nrepositories declare, as observed by the telemetry reconciler.\nprotolint:disable:next ENUM_FIELD_NAMES_PREFIX MAX_LINE_LENGTH\n - CAP_BILLING_MANAGE: Billing: buying and paying for a self-serve plan for an org. Starting a\ncheckout leads to a charge and, once the first invoice is paid, to the\npurchaser becoming the org's owner, so it is held by owner and\nlimited_owner only.", + "description": "Capability is an enumeration of the Chainguard IAM capabilities.\n\n - CAP_IAM_GROUPS_RENAME: Renames an unverified organization that has a plan kind, and nothing\nelse: no other field, no folder, no verified organization, whose name\nis its domain. groups.update covers renames everywhere else.\n - CAP_TENANT_VULN_REPORTS_LIST: TODO(colin): deprecate this cap once the legacy endpoint is removed\n - CAP_REPO_BLOBS_GET: repo.blobs.get is a capability required to pull container images.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with images vs pulling the image itself.\n - CAP_REPO_CREATE: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_CREATE as a transitional grant for write access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_WRITE, drop the dual-accept in cassie.\n - CAP_REPO_LIST: TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also\naccept CAP_REPO_LIST as a transitional grant for read access to\nits REAPI cache surface. Once consumers have migrated to\nCAP_CASSIE_CAS_READ, drop the dual-accept in cassie.\n - CAP_REPO_INTERNAL_ADMIN: repo.internal.admin allows administering internal-only repository fields\n(catalog tier, bundles, aliases, active tags, README, and sync settings)\nthat are otherwise read-only to customers.\n - CAP_APK_BLOBS_GET: apk.blobs.get is a capability required to pull APKs.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with APKs vs pulling the APK itself.\n - CAP_BUILD_REPORT_LIST: Custom Image Build\n - CAP_LIBRARIES_ENTITLEMENTS_CREATE: Global libraries capabilities\n - CAP_LIBRARIES_PYTHON_LIST: Ecosystems specific capabilities\n - CAP_LIBRARIES_CACHE_INVALIDATE: Cache invalidation capability for the libraries cache (covers all ecosystems).\nGranted to org owners and account admins; not to regular developer members.\n - CAP_LIBRARIES_CACHE_LIST: Read capability for the libraries resolution cache (status and entry\nlisting). Separate from CAP_LIBRARIES_ENTITLEMENTS_LIST on purpose: an\norg's dependency-consumption history is sensitive data.\n - CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE: Rebuilder API capabilities\n - CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_CREATE: AWS Marketplace Subscriptions (Chainguard Libraries on AWS Security Hub Extended)\n - CAP_LIBRARIES_REQUEST_GROUPS_CREATE: Library build requests: an organization asks Chainguard to build specific\nlibrary versions and tracks what it already has.\n\nSeparate from the libraries.rebuilder.* capabilities above, which are\ninternal_only and are never grantable to a customer organization.\n - CAP_LIBRARIES_REQUEST_GROUPS_LIST: list covers every read on a request group: the groups themselves, their\nitems, and the per-library view of them.\n - CAP_LIBRARIES_REQUEST_GROUPS_DELETE: delete covers draft groups only; removing a submitted group needs\ndelete_submitted.\n - CAP_LIBRARIES_REQUEST_GROUPS_SUBMIT: submit promotes a draft and carries the CVE-remediation opt-in for the group.\nIt is its own capability because submitting is restricted to owners, which a\nfield mask on update could not express.\n - CAP_LIBRARIES_REQUEST_GROUPS_ITEMS_UPDATE: items.update covers draft item editing: remove, restore and per-item update.\n - CAP_LIBRARIES_REQUEST_GROUPS_REFRESH_COVERAGE: Re-running a group's coverage check is expensive, and submitted groups are\nrefreshed automatically, so it is reserved for Chainguard support.\n - CAP_LIBRARIES_REMOTE_REGISTRIES_CREATE: Remote registries: an org's configured upstream registries for virtual\nrepositories. Creating or deleting one changes where the org's builds\npull dependencies from, so both are owner-only alongside the library\npolicy capabilities; list is ordinary member read.\n - CAP_LIBRARIES_STORAGE_USAGE_GET: Storage usage: how much storage an org's own uploads consume in each\nlanguage ecosystem. Owner-only because it is org-wide accounting (and the\nbasis for upcoming quotas), not something every member needs to see.\n - CAP_LIBRARIES_MALWARE_STATUS_UPDATE: Malware status: stamps the per-version scanned/malicious flags on upstream\nrows in serve-v2. An unscanned upstream version is withheld until it is\nstamped, so whoever holds this decides what reaches customers unscanned;\nit is internal_only so only Chainguard's scan pipeline can hold it.\n - CAP_REGISTRY_ENTITLEMENTS_LIST: Registry Entitlements\n - CAP_REGISTRY_SETTINGS_LIST: Registry Settings\n - CAP_REGISTRY_OVERLAYS_LIST: Registry Overlays (tag-scoped Custom Assembly)\n - CAP_REGISTRY_DEPLOYMENTS_CREATE: Registry Deployments\n - CAP_POLICIES_POLICY_CREATE: Policies\n - CAP_POLICIES_OVERRIDE_CREATE: Policy overrides waive enforcement for a specific artifact. These are\nseparate capabilities from binding management so they can be granted\nindependently. By default create and delete are held by org owners (like\nbinding management) and listing is available to viewers.\n - CAP_TERMS_ACCEPT: Terms\n - CAP_GULFSTREAM: This is orthogonal enough that we should leave\nit somewhat separate, so add new capabilities above.\nTODO(mattmoor): Think about whether we can encode specific\ncontroller capabilities into our access control here?\ne.g. could each logical controller/webhook be its own\ncapability?\n - CAP_GUARDENER_DFC_CONVERT: Guardener\n - CAP_GUARDENER_ASSOCIATION_MANAGE: guardener.association.manage gates self-service linking/unlinking of a\nGitHub org to a Chainguard group (the GroupAccountAssociations record).\n - CAP_GUARDENER_ASSOCIATION_LIST: guardener.association.list gates read-only listing of the GitHub org\ninstallations linked to a Chainguard group (the read counterpart to\nguardener.association.manage).\n - CAP_GUARDENER_ENTITLEMENT_MANAGE: guardener.entitlement.manage gates the support-only surface for configuring a\ngroup's guardener entitlement (e.g. which repo visibility scope guardener\nresponds to). It is internal_only: it can never be granted by a role\navailable to customer organizations.\n - CAP_GUARDENER_ENTITLEMENT_LIST: guardener.entitlement.list gates read-only access to a group's guardener\nentitlement. Unlike guardener.entitlement.manage it is not internal_only, so\nnormal viewers can see the settings that apply to their group.\n - CAP_GUARDENER_ACTIONS_MIGRATE: Guardener actions migrator — on-demand enqueue of a repository's GitHub\nActions migration (opens a pull request), tracked via a long-running\noperation. Mutating, so distinct from the read-only actions catalog cap.\n - CAP_GUARDENER_SCAN_LIST: guardener.scan.list gates listing summaries of the dependency scans\nguardener builds for the group's linked repositories.\n - CAP_GUARDENER_SCAN_GET: guardener.scan.get gates reading one dependency scan by id (its declared\nartifacts and their relationships).\n - CAP_GUARDENER_IMAGES_MIGRATE: Authorizes requesting and reading repository image migrations.\n - CAP_MCP_TOOL_CALL: MCP tool calls\n - CAP_SKILLS_PUBLISH: Skills registry — publishing skill artifacts to skills.cgr.dev\n - CAP_SKILLS_ENTITLEMENTS_CREATE: Skills registry entitlements\n - CAP_SKILLS_LIST: Skills catalog metadata table (description / license / category) backing\nListSkills/GetSkill and search. One org-agnostic set: per-org isolation is\nthe UIDP scope on each RPC, not separate caps. These gate the catalog\ntable's CRUD only; publishing skill artifacts to the registry stays\nCAP_SKILLS_PUBLISH and entitlements stay CAP_SKILLS_ENTITLEMENTS_*.\n\nskills.list is customer-facing (read the catalog for orgs you can access).\nThe writes are internal_only: the catalog is populated by the Chainguard\npublish pipeline, not by customer orgs, so a customer role can never be\ngranted them (a role carrying them must also grant CAP_INTERNAL).\nskills.write is a single create-or-update cap: UpdateSkill is one\nAIP-134 create-or-update RPC, so there is no separate create vs update.\n - CAP_SKILLS_HARDEN_READ: Skills harden — access to the Skills harden API, split per RPC so read,\nsubmit, and cancel can be granted independently. Customer-facing: an org\nmember holds these on the target group named by `chainctl skills harden\n--group`.\n read -\u003e GetHardenOperation\n write -\u003e HardenSkill (submit)\n cancel -\u003e CancelHardenOperation\nThese let a customer kick off and track a harden; they do NOT let the caller\nwrite the hardened output. Publishing the hardened artifact and recording the\njob result into the skills registry/catalog is done by internal identities\nvia the internal_only skills.write cap, and the pipeline's record-result RPC\nis gated on CAP_INTERNAL — so a customer can never push into the hardened\narea directly.\n - CAP_ARGOS_DOCUMENTS_CREATE: Argos — client-side encrypted document records.\n - CAP_ARGOS_DOCUMENTATION_READ: Argos — documentation visibility. Grants read access to Argos API\ndocumentation.\n - CAP_ARGOS_OSV_READ: Argos — Private OSV API (customer-facing OSV query surface).\n - CAP_ARGOS_COALITION_MEMBER: Argos — identity types. Mutually exclusive: an identity holding both is\ntreated as a mitigation partner (the more restrictive of the two) for any\nAPI call which varies the return value based on identity type.\n - CAP_ARGOS_PARTNER_CAPABILITY_REQUEST: Argos — mitigation partner capabilities. request lets a partner submit\nits capabilities and interests; approve lets staff review them.\n - CAP_LIBRARIES_POLICY_CREATE: Libraries Policy Gates — customer-facing policies and bindings that\nconfigure the cooldown and malware gates applied to upstream package pulls,\nplus the block events recorded when a pull is withheld.\n - CAP_BUILDAPI_BUILD_CREATE: Build API\n - CAP_CASSIE_CAS_READ: Cassie REAPI cache surface. CAS (blobs + ByteStream) and the ActionCache\nare separately gated: a caller may read or write action results without\nany authority over the underlying content blobs, and vice versa.\n - CAP_LOGGIE_LOGS_READ: Loggie: the live-log service. Readers tailing a stream hold logs.read;\na producer appending to its streams holds logs.write; the orchestrator\nissuing streams holds logs.create. Appending also requires the stream's\nsigned write name, so a logs.write holder can only append to streams it\nwas handed.\n - CAP_REX_EXECUTIONS_CREATE: Rex: the remote-execution service. The edge authorizes submitting an\nexecution; the scheduler authorizes a worker joining the pool; the\nexecutions query surface authorizes cross-run reads at the instance.\n - CAP_REX_CLASS_USE: Gated platform classes. USE authorizes submitting an execution that\ndemands a gated class; SERVE authorizes a worker pool advertising one.\nBoth are evaluated at the class's own UIDP node, never at the instance.\n - CAP_ACTIONS_LIST: Actions catalog — the read-only catalog of Chainguard-published GitHub\nActions and the upstreams they mirror. Writes are internal (importer only).\n - CAP_ACTIONS_DEPENDENCIES_UPDATE: Recording the dependency edges of a composite action's revision, i.e. the\n`uses:` steps of its action.yml. Internal only: the edges are derived by\nthe hardening pipeline that reads the action.yml, and are not something a\ncustomer asserts about the shared graph.\n - CAP_ACTIONS_DEPENDENCIES_LIST: Reading the dependency graph. Internal only: reads are fenced to groups the\ncaller holds a capability in, which no customer does for these actions.\n - CAP_SANDBOX_RUN_CREATE: Sandbox: the ACID sandbox Runs control plane (the WorkflowRuns API,\nai-cicd/sandbox). Customer-grantable — an org's members run, watch, and\ncancel workflow runs in the org's own instance — via the sandbox.user\nrole, and held by Owners. The SANDBOX service principal's internal\nsandbox.service_agent role carries the same capabilities.\n - CAP_SANDBOX_INSTALLATIONS_RESOLVE: Resolving a guardener GitHub App installation to the root group it is\nlinked to. Internal only: the answer names another customer's\norganization, so it is held by the sandbox GitHub reconciler alone and\nchecked at the acid-sandbox group, never at a customer group.\n - CAP_ENTITLEMENTS_FEATURES_LIST: Central Entitlements Service FEATURE entitlements (product features such\nas sandbox_checks). Reading an organization's FEATURE rows. Internal only:\nit is held by the SANDBOX service principal's sandbox.service_agent role,\nwhich reads the org's rows to admit work. It is separate from\nregistry.entitlements.list so the SANDBOX principal cannot read image\nentitlements.\n - CAP_ENTITLEMENTS_FEATURES_MANAGE: Writing and deleting an organization's FEATURE rows as Chainguard\n(the INTERNAL and CONSOLE_ADMIN sources). Internal only: it is the support\nsurface for backfill, trial extension and the kill switch, held through the\nsupport role.\n - CAP_SANDBOX_SESSION_CREATE: Sandbox develop sessions (the Sessions API, ai-cicd/sandbox): resident\ndevelopment sessions opened with `chainctl develop`. session.create opens\nsessions and lets the caller see and manage its own; it is\ncustomer-grantable via the sandbox.user role. session.list sees and\nmanages (renames, deletes) every user's sessions in the instance — an\nadministrative power held by Owners, not by sandbox.user.\n - CAP_SANDBOX_IDENTITY_CREATE: Sandbox develop session identities: the GCP (and later other cloud)\nidentities a session may act as. identity.create defines, updates, and\ndeletes the caller's own personal identities, via the sandbox.user role.\nidentity.use consents a shared identity into one's session; it is checked\nat the shared identity's groups, so it has its own role\n(sandbox.identity.user) that an owner binds at the groups they choose.\nidentity.admin defines shared identities and sees every identity in the\ninstance; Owners hold it.\n - CAP_TELEMETRY_CONTAINERS_LIST: Telemetry: read access to the container images a group's linked\nrepositories declare, as observed by the telemetry reconciler.\nprotolint:disable:next ENUM_FIELD_NAMES_PREFIX MAX_LINE_LENGTH\n - CAP_BILLING_MANAGE: Billing: buying and paying for a self-serve plan for an org. Starting a\ncheckout leads to a charge and, once the first invoice is paid, to the\npurchaser becoming the org's owner, so it is held by owner and\nlimited_owner only.", "enum": [ "UNKNOWN", "CAP_INTERNAL", @@ -11,6 +11,7 @@ "CAP_IAM_GROUPS_UPDATE", "CAP_IAM_GROUPS_LIST", "CAP_IAM_GROUPS_DELETE", + "CAP_IAM_GROUPS_RENAME", "CAP_IAM_GROUP_INVITES_CREATE", "CAP_IAM_GROUP_INVITES_LIST", "CAP_IAM_GROUP_INVITES_DELETE", @@ -135,6 +136,7 @@ "CAP_LIBRARIES_REMOTE_REGISTRIES_LIST", "CAP_LIBRARIES_REMOTE_REGISTRIES_DELETE", "CAP_LIBRARIES_STORAGE_USAGE_GET", + "CAP_LIBRARIES_MALWARE_STATUS_UPDATE", "CAP_REGISTRY_ENTITLEMENTS_LIST", "CAP_REGISTRY_ENTITLEMENTS_CREATE", "CAP_REGISTRY_ENTITLEMENTS_DELETE", @@ -2750,7 +2752,11 @@ "description": "CheckEligibilityResponse is the response message for CheckEligibility.", "properties": { "eligible": { - "description": "Indicates if the domain of the caller's email address is eligible\nfor email-domain-gated Groups flows.", + "description": "eligible reports whether the domain of the caller's email address may\ncreate a self-serve Starter organization. A personal-mail domain can be\neligible: unverified_starter is then set too, and the organization the\ncaller creates is unverified. Such a domain stays ineligible for\nLookupGroup and RequestGroupAccess, so read unverified_starter before\noffering those flows.", + "type": "boolean" + }, + "unverifiedStarter": { + "description": "unverified_starter is set with eligible when the caller's email domain is\na personal-mail provider: a Starter organization the caller creates is\nunverified, takes a name the caller chooses, and is never found by email\ndomain.", "type": "boolean" } }, @@ -2775,6 +2781,10 @@ "description": "identity_provider_uidp is the UIDP of the IdentityProvider this mapping belongs to.", "type": "string" }, + "privilegedRole": { + "description": "privileged_role reports whether role_uidp names a privileged role: the\nbuilt-in owner or support role. SCIM provisioning never creates persistent\nrole bindings from such a mapping, so its members hold the role only\nthrough capabilities granted at sign-in, which expire with the session.\nOutput only: derived from the role on every read; a value supplied on\nCreate is ignored. It reads false if that lookup fails, so false is not\nproof the role is unprivileged.", + "type": "boolean" + }, "roleUidp": { "description": "role_uidp is the UIDP of the Chainguard Role to grant.", "type": "string" @@ -4356,7 +4366,11 @@ "description": "CheckEligibilityResponse is the response message for CheckEligibility.", "properties": { "eligible": { - "description": "Indicates if the domain of the caller's email address is eligible\nfor email-domain-gated Groups flows.", + "description": "eligible reports whether the domain of the caller's email address may\ncreate a self-serve Starter organization. A personal-mail domain can be\neligible: unverified_starter is then set too, and the organization the\ncaller creates is unverified. Such a domain stays ineligible for\nLookupGroup and RequestGroupAccess, so read unverified_starter before\noffering those flows.", + "type": "boolean" + }, + "unverifiedStarter": { + "description": "unverified_starter is set with eligible when the caller's email domain is\na personal-mail provider: a Starter organization the caller creates is\nunverified, takes a name the caller chooses, and is never found by email\ndomain.", "type": "boolean" } }, @@ -4412,6 +4426,11 @@ "readOnly": true, "type": "string" }, + "privilegedRole": { + "description": "Whether role_uid names a privileged role: the built-in owner or support\nrole. SCIM provisioning never creates persistent role bindings from such a\nmapping, so its members hold the role only through capabilities granted at\nsign-in, which expire with the session. Derived from the role on every\nread; a value supplied on create is ignored. It reads false if that lookup\nfails, so false is not proof the role is unprivileged.", + "readOnly": true, + "type": "boolean" + }, "roleUid": { "description": "UIDP of the Chainguard role to grant to members of the external group.", "type": "string" @@ -9137,6 +9156,17 @@ }, "chainguard.platform.registry.EntitlementImage": { "properties": { + "countsTowardSwapQuota": { + "description": "Whether the removal recorded by delete_time is charged against the\norganization's rolling swap budget. A property of the removal, not of the\nimage: re-adding the image clears it along with delete_time, so a live image\nalways reads false. Removals that are not charged include those made by\ndeleting the whole entitlement, which removes all of its images, by internal\nreconcilers, or by Chainguard staff acting on the organization's behalf.\nAlways false on ListEntitlementImages.", + "readOnly": true, + "type": "boolean" + }, + "deleteTime": { + "description": "delete_time is when the image was removed from the entitlement. It is set\nonly on a removed image, which ListEntitlementCatalogImages returns when\nasked with include_deleted. Always unset on ListEntitlementImages.", + "format": "date-time", + "readOnly": true, + "type": "string" + }, "externalImageGroupId": { "description": "Identifier for the image group in whatever external system defined it\n(Salesforce/SFDC, GitHub, or another source).", "readOnly": true, @@ -16449,7 +16479,7 @@ }, "/iam/v1/groups:checkEligibility": { "get": { - "description": "CheckEligibility reports whether the caller passes the same eligibility\ngates applied by LookupGroup and RequestGroupAccess. A response of\neligible=true does not guarantee those calls succeed for other reasons\n(no matching org, already requested, etc.).", + "description": "CheckEligibility reports whether the caller's email domain may use the\nself-serve Groups flows. A personal-mail domain may only create an\nunverified Starter organization (see\nCheckEligibilityResponse.unverified_starter); LookupGroup and\nRequestGroupAccess refuse it. A response of eligible=true does not\nguarantee those calls succeed for other reasons (no matching org,\nalready requested, etc.).", "operationId": "Groups_CheckEligibility", "responses": { "200": { @@ -19416,7 +19446,7 @@ }, "/iam/v2/groups:checkEligibility": { "get": { - "description": "CheckEligibility reports whether the caller passes the same eligibility\ngates applied by LookupGroup and RequestGroupAccess. A response of\neligible=true does not guarantee those calls succeed for other reasons\n(no matching org, already requested, etc.).", + "description": "CheckEligibility reports whether the caller's email domain may use the\nself-serve Groups flows. A personal-mail domain may only create an\nunverified Starter organization (see\nCheckEligibilityResponse.unverified_starter); LookupGroup and\nRequestGroupAccess refuse it. A response of eligible=true does not\nguarantee those calls succeed for other reasons (no matching org,\nalready requested, etc.).", "operationId": "GroupsService_CheckEligibility", "responses": { "200": { @@ -25310,6 +25340,14 @@ "pattern": ".+", "type": "string" } + }, + { + "description": "include_deleted also returns images removed from the entitlement, each with\ndelete_time set. Honored only by ListEntitlementCatalogImages;\nListEntitlementImages accepts and ignores it.", + "in": "query", + "name": "includeDeleted", + "schema": { + "type": "boolean" + } } ], "responses": { @@ -25354,6 +25392,14 @@ "pattern": ".+", "type": "string" } + }, + { + "description": "include_deleted also returns images removed from the entitlement, each with\ndelete_time set. Honored only by ListEntitlementCatalogImages;\nListEntitlementImages accepts and ignores it.", + "in": "query", + "name": "includeDeleted", + "schema": { + "type": "boolean" + } } ], "responses": {