feat: OSConfig: add ExecResourceOutput and per step error message.

Committer: @adjackura
PiperOrigin-RevId: 375488160

google/cloud/osconfig/v1alpha/config_common.proto

@@ -18,9 +18,9 @@ package google.cloud.osconfig.v1alpha;
 
 option csharp_namespace = "Google.Cloud.OsConfig.V1Alpha";
 option go_package = "google.golang.org/genproto/googleapis/cloud/osconfig/v1alpha;osconfig";
+option java_multiple_files = true;
 option java_outer_classname = "ConfigCommonProto";
 option java_package = "com.google.cloud.osconfig.v1alpha";
-option java_multiple_files = true;
 option php_namespace = "Google\\Cloud\\OsConfig\\V1alpha";
 option ruby_package = "Google::Cloud::OsConfig::V1alpha";
 
@@ -68,10 +68,21 @@ message OSPolicyResourceConfigStep {
 
   // Outcome of the configuration step.
   Outcome outcome = 2;
+
+  // An error message recorded during the execution of this step.
+  // Only populated when outcome is FAILED.
+  string error_message = 3;
 }
 
 // Compliance data for an OS policy resource.
 message OSPolicyResourceCompliance {
+  // ExecResource specific output.
+  message ExecResourceOutput {
+    // Output from Enforcement phase output file (if run).
+    // Output size is limited to 100K bytes.
+    bytes enforcement_output = 2;
+  }
+
   // The id of the OS policy resource.
   string os_policy_resource_id = 1;
 
@@ -81,6 +92,12 @@ message OSPolicyResourceCompliance {
 
   // Compliance state of the OS policy resource.
   OSPolicyComplianceState state = 3;
+
+  // Resource specific output.
+  oneof output {
+    // ExecResource specific output.
+    ExecResourceOutput exec_resource_output = 4;
+  }
 }
 
 // Supported OSPolicy compliance states.

google/cloud/osconfig/v1alpha/instance_os_policies_compliance.proto

@@ -23,9 +23,9 @@ import "google/protobuf/timestamp.proto";
 
 option csharp_namespace = "Google.Cloud.OsConfig.V1Alpha";
 option go_package = "google.golang.org/genproto/googleapis/cloud/osconfig/v1alpha;osconfig";
+option java_multiple_files = true;
 option java_outer_classname = "InstanceOSPoliciesComplianceProto";
 option java_package = "com.google.cloud.osconfig.v1alpha";
-option java_multiple_files = true;
 option php_namespace = "Google\\Cloud\\OsConfig\\V1alpha";
 option ruby_package = "Google::Cloud::OsConfig::V1alpha";
 
@@ -58,8 +58,8 @@ message InstanceOSPoliciesCompliance {
     // Format:
     // `projects/{project_number}/locations/{location}/osPolicyAssignments/{os_policy_assignment_id@revision_id}`
     string os_policy_assignment = 2 [(google.api.resource_reference) = {
-      type: "osconfig.googleapis.com/OSPolicyAssignment"
-    }];
+                                       type: "osconfig.googleapis.com/OSPolicyAssignment"
+                                     }];
 
     // Compliance state of the OS policy.
     OSPolicyComplianceState state = 4;
@@ -101,12 +101,10 @@ message InstanceOSPoliciesCompliance {
   string detailed_state_reason = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. Compliance data for each `OSPolicy` that is applied to the VM.
-  repeated OSPolicyCompliance os_policy_compliances = 6
-      [(google.api.field_behavior) = OUTPUT_ONLY];
+  repeated OSPolicyCompliance os_policy_compliances = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. Timestamp of the last compliance check for the VM.
-  google.protobuf.Timestamp last_compliance_check_time = 7
-      [(google.api.field_behavior) = OUTPUT_ONLY];
+  google.protobuf.Timestamp last_compliance_check_time = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. Unique identifier for the last compliance run.
   // This id will be logged by the OS config agent during a compliance run and

google/cloud/osconfig/v1alpha/inventory.proto

@@ -22,9 +22,9 @@ import "google/protobuf/timestamp.proto";
 
 option csharp_namespace = "Google.Cloud.OsConfig.V1Alpha";
 option go_package = "google.golang.org/genproto/googleapis/cloud/osconfig/v1alpha;osconfig";
+option java_multiple_files = true;
 option java_outer_classname = "Inventories";
 option java_package = "com.google.cloud.osconfig.v1alpha";
-option java_multiple_files = true;
 option php_namespace = "Google\\Cloud\\OsConfig\\V1alpha";
 option ruby_package = "Google::Cloud::OsConfig::V1alpha";
 
@@ -269,15 +269,14 @@ message Inventory {
   // Output only. Base level operating system information for the VM.
   OsInfo os_info = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // Output only. Inventory items related to the VM keyed by an opaque unique
-  // identifier for each inventory item. The identifier is unique to each
-  // distinct and addressable inventory item and will change, when there is a
-  // new package version.
+  // Output only. Inventory items related to the VM keyed by an opaque unique identifier for
+  // each inventory item. The identifier is unique to each distinct and
+  // addressable inventory item and will change, when there is a new package
+  // version.
   map<string, Item> items = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. Timestamp of the last reported inventory for the VM.
-  google.protobuf.Timestamp update_time = 4
-      [(google.api.field_behavior) = OUTPUT_ONLY];
+  google.protobuf.Timestamp update_time = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
 }
 
 // A request message for getting inventory data for the specified VM.

google/cloud/osconfig/v1alpha/os_policy.proto

@@ -20,9 +20,9 @@ import "google/api/field_behavior.proto";
 
 option csharp_namespace = "Google.Cloud.OsConfig.V1Alpha";
 option go_package = "google.golang.org/genproto/googleapis/cloud/osconfig/v1alpha;osconfig";
+option java_multiple_files = true;
 option java_outer_classname = "OSPolicyProto";
 option java_package = "com.google.cloud.osconfig.v1alpha";
-option java_multiple_files = true;
 option php_namespace = "Google\\Cloud\\OsConfig\\V1alpha";
 option ruby_package = "Google::Cloud::OsConfig::V1alpha";
 
@@ -54,8 +54,8 @@ message OSPolicy {
     message File {
       // Specifies a file available via some URI.
       message Remote {
-        // Required. URI from which to fetch the object. It should contain both
-        // the protocol and path following the format `{protocol}://{location}`.
+        // Required. URI from which to fetch the object. It should contain both the
+        // protocol and path following the format `{protocol}://{location}`.
         string uri = 1 [(google.api.field_behavior) = REQUIRED];
 
         // SHA256 checksum of the remote file.
@@ -232,8 +232,8 @@ message OSPolicy {
         // Required. Distribution of this repository.
         string distribution = 3 [(google.api.field_behavior) = REQUIRED];
 
-        // Required. List of components for this repository. Must contain at
-        // least one item.
+        // Required. List of components for this repository. Must contain at least one
+        // item.
         repeated string components = 4 [(google.api.field_behavior) = REQUIRED];
 
         // URI of the key file for this repository. The agent maintains a
@@ -245,8 +245,8 @@ message OSPolicy {
       // repo file that is managed at
       // `/etc/yum.repos.d/google_osconfig.repo`.
       message YumRepository {
-        // Required. A one word, unique name for this repository. This is  the
-        // `repo id` in the yum config file and also the `display_name` if
+        // Required. A one word, unique name for this repository. This is  the `repo
+        // id` in the yum config file and also the `display_name` if
         // `display_name` is omitted. This id is also used as the unique
         // identifier when checking for resource conflicts.
         string id = 1 [(google.api.field_behavior) = REQUIRED];
@@ -265,8 +265,8 @@ message OSPolicy {
       // repo file that is managed at
       // `/etc/zypp/repos.d/google_osconfig.repo`.
       message ZypperRepository {
-        // Required. A one word, unique name for this repository. This is the
-        // `repo id` in the zypper config file and also the `display_name` if
+        // Required. A one word, unique name for this repository. This is the `repo
+        // id` in the zypper config file and also the `display_name` if
         // `display_name` is omitted. This id is also used as the unique
         // identifier when checking for GuestPolicy conflicts.
         string id = 1 [(google.api.field_behavior) = REQUIRED];
@@ -372,12 +372,20 @@ message OSPolicy {
 
         // Required. The script interpreter to use.
         Interpreter interpreter = 4 [(google.api.field_behavior) = REQUIRED];
+
+        // Only recorded for enforce Exec.
+        // Path to an output file (that is created by this Exec) whose
+        // content will be recorded in OSPolicyResourceCompliance after a
+        // successful run. Absence or failure to read this file will result in
+        // this ExecResource being non-compliant. Output file size is limited to
+        // 100K bytes.
+        string output_file_path = 5;
       }
 
-      // Required. What to run to validate this resource is in the desired
-      // state. An exit code of 100 indicates "in desired state", and exit code
-      // of 101 indicates "not in desired state". Any other exit code indicates
-      // a failure running validate.
+      // Required. What to run to validate this resource is in the desired state.
+      // An exit code of 100 indicates "in desired state", and exit code of 101
+      // indicates "not in desired state". Any other exit code indicates a
+      // failure running validate.
       Exec validate = 1 [(google.api.field_behavior) = REQUIRED];
 
       // What to run to bring this resource into the desired state.
@@ -517,8 +525,7 @@ message OSPolicy {
   // If none of the resource groups are applicable for a VM, the VM is
   // considered to be non-compliant w.r.t this policy. This behavior can be
   // toggled by the flag `allow_no_resource_group_match`
-  repeated ResourceGroup resource_groups = 4
-      [(google.api.field_behavior) = REQUIRED];
+  repeated ResourceGroup resource_groups = 4 [(google.api.field_behavior) = REQUIRED];
 
   // This flag determines the OS policy compliance status when none of the
   // resource groups within the policy are applicable for a VM. Set this value

google/cloud/osconfig/v1alpha/os_policy_assignments.proto

@@ -26,9 +26,9 @@ import "google/protobuf/timestamp.proto";
 
 option csharp_namespace = "Google.Cloud.OsConfig.V1Alpha";
 option go_package = "google.golang.org/genproto/googleapis/cloud/osconfig/v1alpha;osconfig";
+option java_multiple_files = true;
 option java_outer_classname = "OSPolicyAssignments";
 option java_package = "com.google.cloud.osconfig.v1alpha";
-option java_multiple_files = true;
 option php_namespace = "Google\\Cloud\\OsConfig\\V1alpha";
 option ruby_package = "Google::Cloud::OsConfig::V1alpha";
 
@@ -95,18 +95,16 @@ message OSPolicyAssignment {
   // Message to configure the rollout at the zonal level for the OS policy
   // assignment.
   message Rollout {
-    // Required. The maximum number (or percentage) of VMs per zone to disrupt
-    // at any given moment.
-    FixedOrPercent disruption_budget = 1
-        [(google.api.field_behavior) = REQUIRED];
+    // Required. The maximum number (or percentage) of VMs per zone to disrupt at
+    // any given moment.
+    FixedOrPercent disruption_budget = 1 [(google.api.field_behavior) = REQUIRED];
 
     // Required. This determines the minimum duration of time to wait after the
     // configuration changes are applied through the current rollout. A
     // VM continues to count towards the `disruption_budget` at least
     // until this duration of time has passed after configuration changes are
     // applied.
-    google.protobuf.Duration min_wait_duration = 2
-        [(google.api.field_behavior) = REQUIRED];
+    google.protobuf.Duration min_wait_duration = 2 [(google.api.field_behavior) = REQUIRED];
   }
 
   // OS policy assignment rollout state
@@ -161,14 +159,13 @@ message OSPolicyAssignment {
   string revision_id = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. The timestamp that the revision was created.
-  google.protobuf.Timestamp revision_create_time = 7
-      [(google.api.field_behavior) = OUTPUT_ONLY];
+  google.protobuf.Timestamp revision_create_time = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. OS policy assignment rollout state
   RolloutState rollout_state = 9 [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // Output only. Indicates that this revision has been successfully rolled out
-  // in this zone and new VMs will be assigned OS policies from this revision.
+  // Output only. Indicates that this revision has been successfully rolled out in this zone
+  // and new VMs will be assigned OS policies from this revision.
   //
   // For a given OS policy assignment, there is only one revision with a value
   // of `true` for this field.
@@ -183,8 +180,7 @@ message OSPolicyAssignment {
   // * CANCELLING
   bool reconciling = 12 [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // Output only. Server generated unique id for the OS policy assignment
-  // resource.
+  // Output only. Server generated unique id for the OS policy assignment resource.
   string uid = 13 [(google.api.field_behavior) = OUTPUT_ONLY];
 }
 
@@ -229,8 +225,8 @@ message OSPolicyAssignmentOperationMetadata {
   // Format:
   // `projects/{project_number}/locations/{location}/osPolicyAssignments/{os_policy_assignment_id@revision_id}`
   string os_policy_assignment = 1 [(google.api.resource_reference) = {
-    type: "osconfig.googleapis.com/OSPolicyAssignment"
-  }];
+                                     type: "osconfig.googleapis.com/OSPolicyAssignment"
+                                   }];
 
   // The OS policy assignment API method.
   APIMethod api_method = 2;
@@ -257,8 +253,7 @@ message CreateOSPolicyAssignmentRequest {
   ];
 
   // Required. The OS policy assignment to be created.
-  OSPolicyAssignment os_policy_assignment = 2
-      [(google.api.field_behavior) = REQUIRED];
+  OSPolicyAssignment os_policy_assignment = 2 [(google.api.field_behavior) = REQUIRED];
 
   // Required. The logical name of the OS policy assignment in the project
   // with the following restrictions:
@@ -274,13 +269,10 @@ message CreateOSPolicyAssignmentRequest {
 // A request message to update an OS policy assignment
 message UpdateOSPolicyAssignmentRequest {
   // Required. The updated OS policy assignment.
-  OSPolicyAssignment os_policy_assignment = 1
-      [(google.api.field_behavior) = REQUIRED];
+  OSPolicyAssignment os_policy_assignment = 1 [(google.api.field_behavior) = REQUIRED];
 
-  // Optional. Field mask that controls which fields of the assignment should be
-  // updated.
-  google.protobuf.FieldMask update_mask = 2
-      [(google.api.field_behavior) = OPTIONAL];
+  // Optional. Field mask that controls which fields of the assignment should be updated.
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = OPTIONAL];
 }
 
 // A request message to get an OS policy assignment

google/cloud/osconfig/v1alpha/osconfig_common.proto

@@ -18,9 +18,9 @@ package google.cloud.osconfig.v1alpha;
 
 option csharp_namespace = "Google.Cloud.OsConfig.V1Alpha";
 option go_package = "google.golang.org/genproto/googleapis/cloud/osconfig/v1alpha;osconfig";
+option java_multiple_files = true;
 option java_outer_classname = "Common";
 option java_package = "com.google.cloud.osconfig.v1alpha";
-option java_multiple_files = true;
 option php_namespace = "Google\\Cloud\\OsConfig\\V1alpha";
 option ruby_package = "Google::Cloud::OsConfig::V1alpha";
 

google/cloud/osconfig/v1alpha/osconfig_zonal_service.proto

@@ -27,14 +27,11 @@ import "google/longrunning/operations.proto";
 
 option csharp_namespace = "Google.Cloud.OsConfig.V1Alpha";
 option go_package = "google.golang.org/genproto/googleapis/cloud/osconfig/v1alpha;osconfig";
+option java_multiple_files = true;
 option java_outer_classname = "OsConfigZonalServiceProto";
 option java_package = "com.google.cloud.osconfig.v1alpha";
-option java_multiple_files = true;
 option php_namespace = "Google\\Cloud\\OsConfig\\V1alpha";
 option ruby_package = "Google::Cloud::OsConfig::V1alpha";
-
-// Some messages refer to Compute API resources; the resource names
-// need to be defined so that client library generators know how to handle them.
 option (google.api.resource_definition) = {
   type: "compute.googleapis.com/Instance"
   pattern: "projects/{project}/locations/{location}/instances/{instance}"
@@ -46,8 +43,7 @@ option (google.api.resource_definition) = {
 // manage package installations and patch jobs for Compute Engine VM instances.
 service OsConfigZonalService {
   option (google.api.default_host) = "osconfig.googleapis.com";
-  option (google.api.oauth_scopes) =
-      "https://www.googleapis.com/auth/cloud-platform";
+  option (google.api.oauth_scopes) = "https://www.googleapis.com/auth/cloud-platform";
 
   // Create an OS policy assignment.
   //
@@ -58,14 +54,12 @@ service OsConfigZonalService {
   //
   // For more information, see [Method:
   // projects.locations.osPolicyAssignments.operations.cancel](https://cloud.google.com/compute/docs/osconfig/rest/v1alpha/projects.locations.osPolicyAssignments.operations/cancel).
-  rpc CreateOSPolicyAssignment(CreateOSPolicyAssignmentRequest)
-      returns (google.longrunning.Operation) {
+  rpc CreateOSPolicyAssignment(CreateOSPolicyAssignmentRequest) returns (google.longrunning.Operation) {
     option (google.api.http) = {
       post: "/v1alpha/{parent=projects/*/locations/*}/osPolicyAssignments"
       body: "os_policy_assignment"
     };
-    option (google.api.method_signature) =
-        "parent,os_policy_assignment,os_policy_assignment_id";
+    option (google.api.method_signature) = "parent,os_policy_assignment,os_policy_assignment_id";
     option (google.longrunning.operation_info) = {
       response_type: "OSPolicyAssignment"
       metadata_type: "OSPolicyAssignmentOperationMetadata"
@@ -81,8 +75,7 @@ service OsConfigZonalService {
   //
   // For more information, see [Method:
   // projects.locations.osPolicyAssignments.operations.cancel](https://cloud.google.com/compute/docs/osconfig/rest/v1alpha/projects.locations.osPolicyAssignments.operations/cancel).
-  rpc UpdateOSPolicyAssignment(UpdateOSPolicyAssignmentRequest)
-      returns (google.longrunning.Operation) {
+  rpc UpdateOSPolicyAssignment(UpdateOSPolicyAssignmentRequest) returns (google.longrunning.Operation) {
     option (google.api.http) = {
       patch: "/v1alpha/{os_policy_assignment.name=projects/*/locations/*/osPolicyAssignments/*}"
       body: "os_policy_assignment"
@@ -99,8 +92,7 @@ service OsConfigZonalService {
   // This method always returns the latest revision. In order to retrieve a
   // previous revision of the assignment, also provide the revision ID in the
   // `name` parameter.
-  rpc GetOSPolicyAssignment(GetOSPolicyAssignmentRequest)
-      returns (OSPolicyAssignment) {
+  rpc GetOSPolicyAssignment(GetOSPolicyAssignmentRequest) returns (OSPolicyAssignment) {
     option (google.api.http) = {
       get: "/v1alpha/{name=projects/*/locations/*/osPolicyAssignments/*}"
     };
@@ -110,8 +102,7 @@ service OsConfigZonalService {
   // List the OS policy assignments under the parent resource.
   //
   // For each OS policy assignment, the latest revision is returned.
-  rpc ListOSPolicyAssignments(ListOSPolicyAssignmentsRequest)
-      returns (ListOSPolicyAssignmentsResponse) {
+  rpc ListOSPolicyAssignments(ListOSPolicyAssignmentsRequest) returns (ListOSPolicyAssignmentsResponse) {
     option (google.api.http) = {
       get: "/v1alpha/{parent=projects/*/locations/*}/osPolicyAssignments"
     };
@@ -119,8 +110,7 @@ service OsConfigZonalService {
   }
 
   // List the OS policy assignment revisions for a given OS policy assignment.
-  rpc ListOSPolicyAssignmentRevisions(ListOSPolicyAssignmentRevisionsRequest)
-      returns (ListOSPolicyAssignmentRevisionsResponse) {
+  rpc ListOSPolicyAssignmentRevisions(ListOSPolicyAssignmentRevisionsRequest) returns (ListOSPolicyAssignmentRevisionsResponse) {
     option (google.api.http) = {
       get: "/v1alpha/{name=projects/*/locations/*/osPolicyAssignments/*}:listRevisions"
     };
@@ -139,8 +129,7 @@ service OsConfigZonalService {
   //
   // For more information, see [Method:
   // projects.locations.osPolicyAssignments.operations.cancel](https://cloud.google.com/compute/docs/osconfig/rest/v1alpha/projects.locations.osPolicyAssignments.operations/cancel).
-  rpc DeleteOSPolicyAssignment(DeleteOSPolicyAssignmentRequest)
-      returns (google.longrunning.Operation) {
+  rpc DeleteOSPolicyAssignment(DeleteOSPolicyAssignmentRequest) returns (google.longrunning.Operation) {
     option (google.api.http) = {
       delete: "/v1alpha/{name=projects/*/locations/*/osPolicyAssignments/*}"
     };
@@ -153,8 +142,7 @@ service OsConfigZonalService {
 
   // Get OS policies compliance data for the specified Compute Engine VM
   // instance.
-  rpc GetInstanceOSPoliciesCompliance(GetInstanceOSPoliciesComplianceRequest)
-      returns (InstanceOSPoliciesCompliance) {
+  rpc GetInstanceOSPoliciesCompliance(GetInstanceOSPoliciesComplianceRequest) returns (InstanceOSPoliciesCompliance) {
     option (google.api.http) = {
       get: "/v1alpha/{name=projects/*/locations/*/instanceOSPoliciesCompliances/*}"
     };
@@ -163,9 +151,7 @@ service OsConfigZonalService {
 
   // List OS policies compliance data for all Compute Engine VM instances in the
   // specified zone.
-  rpc ListInstanceOSPoliciesCompliances(
-      ListInstanceOSPoliciesCompliancesRequest)
-      returns (ListInstanceOSPoliciesCompliancesResponse) {
+  rpc ListInstanceOSPoliciesCompliances(ListInstanceOSPoliciesCompliancesRequest) returns (ListInstanceOSPoliciesCompliancesResponse) {
     option (google.api.http) = {
       get: "/v1alpha/{parent=projects/*/locations/*}/instanceOSPoliciesCompliances"
     };
@@ -182,8 +168,7 @@ service OsConfigZonalService {
   }
 
   // List inventory data for all VM instances in the specified zone.
-  rpc ListInventories(ListInventoriesRequest)
-      returns (ListInventoriesResponse) {
+  rpc ListInventories(ListInventoriesRequest) returns (ListInventoriesResponse) {
     option (google.api.http) = {
       get: "/v1alpha/{parent=projects/*/locations/*/instances/*}/inventories"
     };
@@ -192,8 +177,7 @@ service OsConfigZonalService {
 
   // Gets the vulnerability report for the specified VM instance. Only VMs with
   // inventory data have vulnerability reports associated with them.
-  rpc GetVulnerabilityReport(GetVulnerabilityReportRequest)
-      returns (VulnerabilityReport) {
+  rpc GetVulnerabilityReport(GetVulnerabilityReportRequest) returns (VulnerabilityReport) {
     option (google.api.http) = {
       get: "/v1alpha/{name=projects/*/locations/*/instances/*/vulnerabilityReport}"
     };
@@ -201,8 +185,7 @@ service OsConfigZonalService {
   }
 
   // List vulnerability reports for all VM instances in the specified zone.
-  rpc ListVulnerabilityReports(ListVulnerabilityReportsRequest)
-      returns (ListVulnerabilityReportsResponse) {
+  rpc ListVulnerabilityReports(ListVulnerabilityReportsRequest) returns (ListVulnerabilityReportsResponse) {
     option (google.api.http) = {
       get: "/v1alpha/{parent=projects/*/locations/*/instances/*}/vulnerabilityReports"
     };

google/cloud/osconfig/v1alpha/vulnerability.proto

@@ -22,9 +22,9 @@ import "google/protobuf/timestamp.proto";
 
 option csharp_namespace = "Google.Cloud.OsConfig.V1Alpha";
 option go_package = "google.golang.org/genproto/googleapis/cloud/osconfig/v1alpha;osconfig";
+option java_multiple_files = true;
 option java_outer_classname = "VulnerabilityProto";
 option java_package = "com.google.cloud.osconfig.v1alpha";
-option java_multiple_files = true;
 option php_namespace = "Google\\Cloud\\OsConfig\\V1alpha";
 option ruby_package = "Google::Cloud::OsConfig::V1alpha";
 
@@ -59,20 +59,21 @@ message VulnerabilityReport {
       // 0 - 10 where 0 indicates low severity and 10 indicates high severity.
       float cvss_v2_score = 2;
 
-      // The full description of the CVSSv3 for this vulnerability.
+      // The full description of the CVSSv3 for this vulnerability from NVD.
       CVSSv3 cvss_v3 = 3;
 
-      // Assigned severity/impact ranking.
+      // Assigned severity/impact ranking from the distro.
       string severity = 4;
 
-      // The note or description describing the vulnerability.
+      // The note or description describing the vulnerability from the distro.
       string description = 5;
 
       // Corresponds to the references attached to the `VulnerabilityDetails`.
       repeated Reference references = 6;
     }
 
-    // Contains metadata as per the upstream feed of the operating system.
+    // Contains metadata as per the upstream feed of the operating system and
+    // NVD.
     Details details = 1;
 
     // Corresponds to the `INSTALLED_PACKAGE` inventory item on the VM.