partialFingerprints: the words the world has been waiting for

["Larry Golding \(Comcast\)" <larrygolding@comcast.net>]

For a long time we’ve agreed that partialFingerprints shouldn’t include information that’s deducible from the SARIF file, but the spec has never said so. As part of the “fingerprints” draft that I just merged and pushed, Appendix B now says the magic words:

 

An analysis tool SHALL NOT include in partialFingerprints information that a result management system could deduce from other information in the SARIF file, for example, file hashes. Rather, the result management would use such information, along with partialFingerprints, in its computation of fingerprints.

 

I understand that our vision of partialFingerprints is still evolving, but this will do for now.

 

Larry