RE: More internal MS feedback

I wrote a change draft that incorporates the feedback:

https://github.com/oasis-tcs/sarif-spec/blob/master/Documents/ChangeDrafts/Accepted/sarif-v2.0-issues-371-372-373-374-Ryley-feedback.docx

merged changes into the provisional draft:

https://github.com/oasis-tcs/sarif-spec/blob/master/Documents/ProvisionalDrafts/sarif-v2.0-csd02-provisional.docx

resolved the issues as “fixed”, and closed them.

Please take a careful look at the issues and the change draft. The changes are pretty small. The changes to  suppression.kind  look larger than they are because I compressed the presentation, combining some sub-sub-sections in to a single sub-section.

I took the opportunity to simplify the value names:
suppression.kind
suppressedInSource => inSource
suppressedExternally => external
suppression.status
suppressionRejected => rejected

I also added a value  "accepted"  for  suppression.status  and made it the default. So the values for  suppression.status  are
"accepted"  (the default),  "underReview" , and  "rejected" .

Thanks for reading!
Larry
From:  Larry Golding (Myriad Consulting Inc) <>
Sent:  Saturday, April 13, 2019 4:34 PM
To:  Larry Golding (Myriad Consulting Inc) <>; OASIS SARIF TC Discussion List <>
Cc:  Michael Fanning <>
Subject:  RE: More internal MS feedback

Here you go. Here are the four issues with better titles, explanations, and schema change impact:

#371 :  Separate suppression status from kind
#372 :  Add roles for configuration files
#373 :  Add suppression.justification
#374 :  Loosen restrictions on RMS usage of partialFingerprints

I will write a single change draft for these tomorrow, then turn my attention back to the remaining few items.

Larry
From:
  < 
>  On Behalf Of  Larry Golding (Myriad Consulting Inc)

Sent:  Saturday, April 13, 2019 3:42 PM
To:  OASIS SARIF TC Discussion List < 
>
Cc:  Michael Fanning < 
>
Subject:  [sarif] More internal MS feedback

In writing my last email I forgot that an internal MS customer had a small set of feedback items. I’ll paste my raw notes here. Don’t worry if the words don’t make sense; I’ll file issues with the details.

- pull out suppression status from kind
+ roles
   - userSpecifiedConfiguration
   - toolSpecifiedConfiguration
+ suppression.justification (last priority)
- more flexibility in how an RMS result matcher uses partial fingerprints to decide whether
  two results fall into the same bucket.

Even without the details, you might be able to see that these are quite simple. I’ll write the drafts tomorrow.

Larry