#266: Editorial: Define externalPropertyFileReferences object

This is an editorial change. The spec described the value of  run.externalPropertyFileReferences  as a set of properties, but it did not assign a name to that set of properties and define it as an object. That was the only place in the spec we’d failed to define an object type  for a bundle of properties.

The change consists mostly of a refactor: cutting most of the text out of the description of  run.externalPropertyFileReferences , pasting it into the description of a new  externalPropertyFileReferences  object, and then adjusting the text and cross-references to stitch the two together. I made a couple of other small rewordings while I was at it.

I did make one normative change (which I pointed out with a bubble comment in the change draft): The spec stated (correctly) that it was invalid for a property to appear both inline and in an external property file. But then it went on  and told you what to do if the property did appear in both places (it said to ignore the external property file). Now, there are infinite ways to produce invalid SARIF, and the spec can’t very well tell you what to do in all such cases. So I’ve been removing  any normative statements that tell you what to do in such cases: the spec implicitly treats the behavior of a SARIF consumer in the face of invalid SARIF as “undefined.”

I might add an explicit statement to that effect near the top of the spec.

Here’s the change draft:

https://github.com/oasis-tcs/sarif-spec/blob/master/Documents/ChangeDrafts/Accepted/sarif-v2.0-editorial-266-externalPropertyFileReferences-object.docx

… and here’s the provisional draft with the change merged in:

https://github.com/oasis-tcs/sarif-spec/blob/master/Documents/ProvisionalDrafts/sarif-v2.0-csd02-provisional.docx

Thanks,
Larry