Add proto definition for vuln predicate type

protos/README.md

@@ -20,6 +20,8 @@ predicates have protobuf definitions:
     artifact.
 -   [SCAI]: Evidence-based assertions about software artifact and supply
     chain attributes.
+-   [VULN]: Describes how to store the results of scanners when detecting vulnerabilities in a software artifact.
+    chain attributes.
 -   [Test Result]: Expresses the result of a test run in the software supply
     chain.
 
@@ -50,6 +52,7 @@ testing the supported language bindings.
 [SCAI]: in_toto_attestation/predicates/scai/
 [SLSA Provenance]: in_toto_attestation/predicates/provenance/
 [SLSA Verification Summary]: in_toto_attestation/predicates/vsa/
+[VULN]: in_toto_attestation/predicates/vuln/
 [in-toto Link]: in_toto_attestation/predicates/link/
 [Test Result]: in_toto_attestation/predicates/test_result/
 [documentation]: ../docs/protos.md

protos/in_toto_attestation/predicates/vuln/v1/vuln.proto

@@ -0,0 +1,50 @@
+syntax = "proto3";
+
+package in_toto_attestation.predicates.vuln.v1;
+
+import "google/protobuf/struct.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/in-toto/attestation/go/predicates/vuln/v1";
+option java_package = "io.github.intoto.attestation.predicates.vuln.v1";
+
+// Validation of all fields is left to the users of this proto.
+message Vuln {
+  Scanner scanner = 1;
+  ScanMetadata scan_metadata = 2;
+}
+
+message Scanner {
+  string uri = 1;
+  string version = 2;
+  VulnDatabase database = 3;
+  Result result = 4;
+}
+
+message VulnDatabase {
+  optional string uri = 1;
+  optional string version = 2;
+  google.protobuf.Timestamp last_update = 3;
+}
+
+message Result {
+ repeated Vulnerability vulnerabilities = 3;
+}
+
+message Vulnerability {
+  string id = 1;
+  repeated Severity severity = 2;
+
+  message Severity {
+    string method = 1;
+    string score = 2;
+  }
+
+  repeated google.protobuf.Struct annotations = 3;
+}
+
+message ScanMetadata {
+  google.protobuf.Timestamp scan_started_on = 1;
+  google.protobuf.Timestamp scan_finished_on = 2;
+}
+