RE: #357: Default for associatedComponent

By the way, there’s no schema change here – at least, I don’t think you can express that default in JSON schema.

From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On Behalf Of Larry Golding (Myriad Consulting Inc)
Sent: Friday, April 5, 2019 11:24 AM
To: 'Luke Cartey' <luke@semmle.com>
Cc: OASIS SARIF TC Discussion List <sarif@lists.oasis-open.org>
Subject: [sarif] #357: Default for associatedComponent
Importance: High

Luke filed #357, where he pointed out that the section on Policies stated that when a toolComponent object represents a policy, its associatedComponent property must be present – but the code example didn’t show associatedComponent.

In the issue, he asked me to fix the example, but I realized that there is a perfectly good default for associatedComponent, namely theTool.driver. This optimizes the common case where there are no extensions.

So I made that change, and produced a change draft

https://github.com/oasis-tcs/sarif-spec/blob/master/Documents/ChangeDrafts/Accepted/sarif-v2.0-issue-357-associatedComponent.docx

and merged it into the provisional draft:

https://github.com/oasis-tcs/sarif-spec/blob/master/Documents/ProvisionalDrafts/sarif-v2.0-csd02-provisional.docx

This seems to me an uncontroversial change, but it slightly exceeds editorial discretion, so please take a look at the change draft and let me know if you disagree. Remember, you can raise concerns right up until the time we vote the provisional draft out as CSD.2 (which we hope to do at TC #35 on 4/17) – but please do try to raise any concerns before 4/10 so I have plenty of time to address them.

Thanks,

Larr

sarif message