syntax = "proto3";

import "google/protobuf/timestamp.proto";

package trivy.common;
option  go_package = "github.com/aquasecurity/trivy/rpc/common;common";

import "google/protobuf/struct.proto";

message OS {
  string family = 1;
  string name   = 2;
  bool   eosl   = 3;
}

message Repository {
  string family  = 1;
  string release = 2;
}

message PackageInfo {
  string           file_path = 1;
  repeated Package packages  = 2;
}

message Application {
  string           type      = 1;
  string           file_path = 2;
  repeated Package libraries = 3;
}

message Package {
  // binary package
  // e.g. bind-utils
  string id      = 13;
  string name    = 1;
  string version = 2;
  string release = 3;
  int32  epoch   = 4;
  string arch    = 5;
  // src package containing some binary packages
  // e.g. bind
  string          src_name    = 6;
  string          src_version = 7;
  string          src_release = 8;
  int32           src_epoch   = 9;
  repeated string licenses    = 15;
  Layer           layer       = 11;
  string          file_path   = 12;
  repeated string depends_on  = 14;
}

message Misconfiguration {
  string                 file_type  = 1;
  string                 file_path  = 2;
  repeated MisconfResult successes  = 3;
  repeated MisconfResult warnings   = 4;
  repeated MisconfResult failures   = 5;
  repeated MisconfResult exceptions = 6;
}

message MisconfResult {
  string namespace = 1;
  string message   = 2;
  string type      = 3;
  string id        = 4;
  string title     = 5;
  string severity  = 6;
}

message DetectedMisconfiguration {
  string type                 = 1;
  string id                   = 2;
  string title                = 3;
  string description          = 4;
  string message              = 5;
  string namespace            = 6;
  string          resolution  = 7;
  Severity        severity    = 8;
  string          primary_url = 9;
  repeated string references  = 10;
  string          status      = 11;
  Layer           layer       = 12;
}

message Vulnerability {
  string                    vulnerability_id     = 1;
  string                    pkg_name             = 2;
  string                    installed_version    = 3;
  string                    fixed_version        = 4;
  string                    title                = 5;
  string                    description          = 6;
  Severity                  severity             = 7;
  repeated string           references           = 8;
  Layer                     layer                = 10;
  string                    severity_source      = 11;
  map<string, CVSS>         cvss                 = 12;
  repeated string           cwe_ids              = 13;
  string                    primary_url          = 14;
  google.protobuf.Timestamp published_date       = 15;
  google.protobuf.Timestamp last_modified_date   = 16;
  google.protobuf.Value     custom_advisory_data = 17;
  google.protobuf.Value     custom_vuln_data     = 18;
  repeated string           vendor_ids           = 19;
  DataSource                data_source          = 20;
  map<string, Severity>     vendor_severity      = 21;
  string                    pkg_path             = 22;
  string                    pkg_id               = 23;
}

message DataSource {
  string id   = 1;
  string name = 2;
  string url  = 3;
}

message Layer {
  string digest  = 1;
  string diff_id = 2;
}

enum Severity {
  UNKNOWN  = 0;
  LOW      = 1;
  MEDIUM   = 2;
  HIGH     = 3;
  CRITICAL = 4;
}

message CVSS {
  string v2_vector = 1;
  string v3_vector = 2;
  double v2_score  = 3;
  double v3_score  = 4;
}

message CustomResource {
  string                type      = 1;
  string                file_path = 2;
  Layer                 layer     = 3;
  google.protobuf.Value data      = 4;
}