syntax = "proto3";

package in_toto_attestation.predicates.vulns.v02;

import "google/protobuf/struct.proto";
import "google/protobuf/timestamp.proto";

option go_package = "github.com/in-toto/attestation/go/predicates/vulns/v02";
option java_package = "io.github.intoto.attestation.predicates.vulns.v02";

// Validation of all fields is left to the users of this proto.
message Vulns {
  Scanner scanner = 1;
  ScanMetadata metadata = 2;
}

message Scanner {
  string uri = 1;
  optional string version = 2;
  VulnDatabase db = 3;
  repeated Result result = 4;
}

message VulnDatabase {
  optional string uri = 1;
  optional string version = 2;
  google.protobuf.Timestamp last_update = 3;
}

message Result {
  string id = 1;
  repeated Severity severity = 2;

  message Severity {
    string method = 1;
    string score = 2;
  }

  repeated google.protobuf.Struct annotations = 3;
}

message ScanMetadata {
  google.protobuf.Timestamp scan_started_on = 1;
  google.protobuf.Timestamp scan_finished_on = 2;
}
