This represents a logical "role" that can attest to artifacts.

The note and occurrence assert build provenance.

The note and occurrence track deployment events.

The note and occurrence track the initial discovery status of a resource.

This represents an image basis relationship.

Unknown.

This represents a package installed via a package manager.

The note and occurrence represent a package vulnerability.

Metadata for any related URL information.

Kind represents the kinds of notes supported.