RE: [sarif] Edits for the spec

Paul,


  Thank you again for your careful reading. I ve incorporated all necessary changes into the provisional draft. Here are my responses to your substantive concerns:



  In  3.4.4,
 artifactLocation.uriBaseId  property, you commented:

  I seem to remember that if uri is relative and if uriBaseId is not present, then the uri should be resolved with respect to the directory in which the sarif file exists. Is that still the case? Some clarification of this would be useful here, or a reference
  to somewhere else where clarification is made.

 That interpretation applies in only one place: in  3.15.2,
 externalPropertyFileReference.location  property, which says:



If the externalized properties are persisted in a separate file,

location
  SHALL  be present. In that case, if the
artifactLocation
object s

uri
property (
3.4.3  ) specifies a relative reference and its

uriBaseId
property (
3.4.4  ) is absent, then

uri
  SHALL  be interpreted relative to the location of the root file.

 That seemed like a reasonable default in this particular case: it wouldn t be surprising if an external property sat alongside its parent log file. In all other cases (for example, when the artifact is a source file, or a configuration file, or a tool binary,
  etc.), it did not seem to me that there was any reasonable default.



  In  3.26.5,
 location.annotations  property, you commented (with regard to a sample):

  Did you mean these columns to refer to a particular range within the example string?

 Yes, and I got them wrong. I meant them to refer to the subexpression "(y + z)", so I ve corrected them from (13, 19) to (9, 16).

In  3.53.3,
 notification.message  property, you commented (with regard to a note saying that
  notification.message  would usually be plain text because it appears on the console):

  In CodeSonar, only the most basic notifications about command line errors go to the console. Many other notifications show up with formatting in the UI. Also, I ve seen plenty of command line tools that use ansi codes to color the text output to the console.
  I d just as soon delete this note.

 You are right. I removed the note.

 (With regard to ANSI color code on the console, you d have to drop down to HTML to represent that in Markdown, and the spec actually prohibits that
see  3.11.4.2,  Security implications .)


  Larry