OASIS Static Analysis Results Interchange Format (SARIF) TC

So what do we do now to say, "Great, we're a Committee Specification! Now we want to be an OASIS Specification"? -----Original Message----- From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On Behalf Of Larry Golding (Myriad Consulting Inc) Sent: Thursday, August 8, 2019 5:06 PM To: David Keaton <dmk@dmk.com>; Chet Ensign <chet.ensign@oasis-open.org>; OASIS SARIF TC Discussion List <sarif@lists.oasis-open.org> Subject: RE: [sarif] Static Analysis Results Interchange Format (SARIF) V2.1.0 from the SARIF TC is an approved OASIS Committee Specification Oh, right, _that_'s when we can do it. OK. -----Original Message----- From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On Behalf Of David Keaton Sent: Thursday, August 8, 2019 5:05 PM To: Larry Golding (Myriad Consulting Inc) <v-lgold@microsoft.com>; Chet Ensign <chet.ensign@oasis-open.org>; OASIS SARIF TC Discussion List <sarif@lists.oasis-open.org> Subject: Re: [sarif] Static Analysis Results Interchange Format (SARIF) V2.1.0 from the SARIF TC is an approved OASIS Committee Specification Larry, No, we cannot make any changes at this time and stay within our plan for progressing the document. At the next stage, there will be a 60-day public comment period, and non-material changes to address comments from that will be allowed afterward. David On 8/8/19 4:34 PM, Larry Golding (Myriad Consulting Inc) wrote: > Thank you, Chet, and congratulations, SARIF TC! > > Now on to the next step. *David*, is now the time I can make the small > set of non-substantive changes in preparation to sending out to OASIS? > > Larry > > *From:* sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> *On > Behalf Of *Chet Ensign > *Sent:* Thursday, August 8, 2019 12:54 PM > *To:* tc-announce@lists.oasis-open.org; members@lists.oasis-open.org; > OASIS SARIF TC Discussion List <sarif@lists.oasis-open.org>; > sarif-comment@lists.oasis-open.org > *Subject:* [sarif] Static Analysis Results Interchange Format (SARIF) > V2.1.0 from the SARIF TC is an approved OASIS Committee Specification > > OASIS Members and other interested parties, > > OASIS is pleased to announce that Static Analysis Results Interchange > Format (SARIF) Version 2.1.0 from the Static Analysis Results > Interchange Format (SARIF) TC [1] has been approved as an OASIS > Committee Specification. > > Software developers use a variety of tools to assess the quality of > their programs. These tools can report results on qualities such as > validity, security, performance, compliance with legal requirements, > etc. To form an overall picture of program quality, developers often > need to aggregate the results produced by all of these tools, a task > made difficult when each tool produces output in a different format. > > > SARIF defines a standard format for the output of static analysis > tools in order to: > > - Comprehensively capture the range of data produced by commonly used > static analysis tools. > > - Reduce the cost and complexity of aggregating the results of various > analysis tools into common workflows. > > - Represent analysis results for all kinds of programming artifacts, > including source code and object code. > > This Committee Specification is an OASIS deliverable, completed and > approved by the TC and fully ready for testing and implementation. > > The prose specifications and related files are available here: > > Static Analysis Results Interchange Format (SARIF) Version 2.1.0 > Committee Specification 01 > 23 July 2019 > > Editable source (Authoritative): > https://docs > .oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcs01%2Fsarif-v2.1.0-cs01.do > cx&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08 > d71c5d3b5c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C63700905887334 > 1498&amp;sdata=jF6AMSeLYBLGkdxyQpk0Jf5zuoVFDk5gN4SjUiBZntA%3D&amp;rese > rved=0 > < https://doc > s.oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcs01%2Fsarif-v2.1.0-cs01.d > ocx&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f0 > 8d71c5d3b5c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C6370090588733 > 41498&amp;sdata=jF6AMSeLYBLGkdxyQpk0Jf5zuoVFDk5gN4SjUiBZntA%3D&amp;res > erved=0> > (Authoritative) > > > HTML: > https://docs > .oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcs01%2Fsarif-v2.1.0-cs01.ht > ml&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08 > d71c5d3b5c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C63700905887334 > 1498&amp;sdata=UcGO45wpFncWWUF00mKf8cjGAnlQaIvmxxEkAq%2F%2FMI8%3D&amp; > reserved=0 > < https://doc > s.oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcs01%2Fsarif-v2.1.0-cs01.h > tml&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f0 > 8d71c5d3b5c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C6370090588733 > 41498&amp;sdata=UcGO45wpFncWWUF00mKf8cjGAnlQaIvmxxEkAq%2F%2FMI8%3D&amp > ;reserved=0> > > PDF: > https://docs > .oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcs01%2Fsarif-v2.1.0-cs01.pd > f&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08d > 71c5d3b5c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C637009058873341 > 498&amp;sdata=uRvNn3o%2Fg9P5K1yIzCFpGVegLVq58jzsqYExKIpzN7Q%3D&amp;res > erved=0 > < https://doc > s.oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcs01%2Fsarif-v2.1.0-cs01.p > df&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08 > d71c5d3b5c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C63700905887334 > 1498&amp;sdata=uRvNn3o%2Fg9P5K1yIzCFpGVegLVq58jzsqYExKIpzN7Q%3D&amp;re > served=0> > > JSON schemas: > https://docs > .oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcs01%2Fschemas%2F&amp;data= > 02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08d71c5d3b5c%7 > C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C637009058873341498&amp;sda > ta=JlGEVSdeCejsD1sITuKGYODdSVnRCdDd2vLohJD0AKo%3D&amp;reserved=0 > < https://doc > s.oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcs01%2Fschemas%2F&amp;data > =02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08d71c5d3b5c% > 7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C637009058873351495&amp;sd > ata=YkTOlRvcd8Ox424URAjr1%2FBpKRjie0YbuzzpgC1MUfg%3D&amp;reserved=0> > > Distribution ZIP file > > For your convenience, OASIS provides a complete package of the prose > specification and related files in a ZIP distribution file. You can > download the ZIP file here: > > https://docs > .oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcs01%2Fsarif-v2.1.0-cs01.zi > p&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08d > 71c5d3b5c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C637009058873351 > 495&amp;sdata=l1Gn6g%2FBbBZjN7JcF0rtfrfr7syp4EYsaJSeFIkPTYw%3D&amp;res > erved=0 > < https://doc > s.oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcs01%2Fsarif-v2.1.0-cs01.z > ip&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08 > d71c5d3b5c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C63700905887335 > 1495&amp;sdata=l1Gn6g%2FBbBZjN7JcF0rtfrfr7syp4EYsaJSeFIkPTYw%3D&amp;re > served=0> > > Members of the SARIF TC [1] approved this specification by Special > Majority Vote. The specification had been released for public review > as required by the TC Process [2]. The vote to approve as a Committee > Specification passed [3], and the document is now available online in > the OASIS Library as referenced above. > > Our congratulations to the TC on achieving this milestone and our > thanks to the reviewers who provided feedback on the specification > drafts to help improve the quality of the work. > > ========== Additional references: > > [1] Static Analysis Results Interchange Format (SARIF) TC https://www . > oasis-open.org%2Fcommittees%2Fsarif%2F&amp;data=02%7C01%7Cv-lgold%40mi > crosoft.com%7C74e93ed43d5e400b440f08d71c5d3b5c%7C72f988bf86f141af91ab2 > d7cd011db47%7C1%7C1%7C637009058873351495&amp;sdata=ZRQwJZcBOPb%2F4EbGE > KyrSNZ0hr4JcQ6i690koa3XvPQ%3D&amp;reserved=0 > < https://www > .oasis-open.org%2Fcommittees%2Fsarif%2F&amp;data=02%7C01%7Cv-lgold%40m > icrosoft.com%7C74e93ed43d5e400b440f08d71c5d3b5c%7C72f988bf86f141af91ab > 2d7cd011db47%7C1%7C1%7C637009058873351495&amp;sdata=ZRQwJZcBOPb%2F4EbG > EKyrSNZ0hr4JcQ6i690koa3XvPQ%3D&amp;reserved=0> > > [2] Public reviews: > > * 30-day public review, 05 June 2019: > https://list > s.oasis-open.org%2Farchives%2Fmembers%2F201906%2Fmsg00002.html&amp;dat > a=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08d71c5d3b5c > %7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C637009058873351495&amp;s > data=LHdXsFqS99jvukij2G3o112l5PeT5mjknHvbJECE%2BfA%3D&amp;reserved=0 > < https://lis > ts.oasis-open.org%2Farchives%2Fmembers%2F201906%2Fmsg00002.html&amp;da > ta=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08d71c5d3b5 > c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C637009058873351495&amp; > sdata=LHdXsFqS99jvukij2G3o112l5PeT5mjknHvbJECE%2BfA%3D&amp;reserved=0> > - Comment resolution log: > http://docs . > oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcsprd01%2Fsarif-v2.1.0-csprd > 01-comment-resolution-log.txt&amp;data=02%7C01%7Cv-lgold%40microsoft.c > om%7C74e93ed43d5e400b440f08d71c5d3b5c%7C72f988bf86f141af91ab2d7cd011db > 47%7C1%7C1%7C637009058873351495&amp;sdata=5S8mAo2pENHAXIJPDTaIymdgFWCe > 4AS5Ttw%2FpMW8QSk%3D&amp;reserved=0 > < http://docs > .oasis-open.org%2Fsarif%2Fsarif%2Fv2.1.0%2Fcsprd01%2Fsarif-v2.1.0-cspr > d01-comment-resolution-log.txt&amp;data=02%7C01%7Cv-lgold%40microsoft. > com%7C74e93ed43d5e400b440f08d71c5d3b5c%7C72f988bf86f141af91ab2d7cd011d > b47%7C1%7C1%7C637009058873351495&amp;sdata=5S8mAo2pENHAXIJPDTaIymdgFWC > e4AS5Ttw%2FpMW8QSk%3D&amp;reserved=0> > > > [3] Approval ballot: > https://www . > oasis-open.org%2Fcommittees%2Fballot.php%3Fid%3D3416&amp;data=02%7C01% > 7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08d71c5d3b5c%7C72f988b > f86f141af91ab2d7cd011db47%7C1%7C1%7C637009058873351495&amp;sdata=iwyo% > 2BWXuCsMarKI3RmmpO0Y46mS5YGFiNyFzek55WXc%3D&amp;reserved=0 > < https://www > .oasis-open.org%2Fcommittees%2Fballot.php%3Fid%3D3416&amp;data=02%7C01 > %7Cv-lgold%40microsoft.com%7C74e93ed43d5e400b440f08d71c5d3b5c%7C72f988 > bf86f141af91ab2d7cd011db47%7C1%7C1%7C637009058873361486&amp;sdata=Rl7e > fvX4GpiofVE6clzE3NPK7zGlP9ENS%2Bl3qX1tGFk%3D&amp;reserved=0> > > -- > > > /chet > ---------------- > > Chet Ensign > > Chief Technical Community Steward > OASIS: Advancing open standards for the information society > http://www.o > asis-open.org&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d5 > e400b440f08d71c5d3b5c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C637 > 009058873361486&amp;sdata=8Jgwza961tvdIo%2BNM5xSSaQPMKfIBex0l1Fk0zz9Ia > 8%3D&amp;reserved=0 > < http://www . > oasis-open.org&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C74e93ed43d > 5e400b440f08d71c5d3b5c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C63 > 7009058873361486&amp;sdata=8Jgwza961tvdIo%2BNM5xSSaQPMKfIBex0l1Fk0zz9I > a8%3D&amp;reserved=0> > > > Mobile: +1 201-341-1393 > --------------------------------------------------------------------- To unsubscribe from this mail list, you must leave the OASIS TC that generates this mail. Follow this link to all your TCs in OASIS at: https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.oasis-open.org%2Fapps%2Forg%2Fworkgroup%2Fportal%2Fmy_workgroups.php&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C4a682a79a03c417ab4bb08d71c5d5db7%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637009059648995705&amp;sdata=pmMHuCJH70QVXfpdZHlVvKL4sym56PgVPErO%2B5cOVSc%3D&amp;reserved=0

On 8/8/19 5:07 PM, Larry Golding (Myriad Consulting Inc) wrote: So what do we do now to say, "Great, we're a Committee Specification! Now we want to be an OASIS Specification"? First, we need three Statements of Use. I have an updated one from Jim, and I need two more. One must be from an OASIS organizational member. We also need to document SARIF's relationship to the work of other OASIS TCs or other standards developing organizations. This can be two or three lines. Example: explain why SARIF complements TOIF instead of competing with it. Then we can have a ballot to approve the SoUs and to request a Special Majority Vote to proceed to Candidate OASIS Standard. (See my message below where I detailed it all.) David On 7/23/19 6:13 PM, David Keaton wrote: The Special Majority Vote for Committee Specification has closed, and we will receive official notification of Committee Specification status soon. Once the official date of the Committee Specification has been recorded, it will be time to begin submitting Statements of Use. If you need any assistance with this, please let me know. I will collect the Statements of Use and enter them as TC documents for use in our request for Candidate OASIS Standard status. I would like to ask for a volunteer to submit a brief paragraph for each of the following. 1. A clear English-language summary of the specification that will help OASIS members outside the TC understand what they will be reviewing at the Candidate OASIS Standard stage. 2. The relationship of this specification to similar work of other OASIS TCs or other standards developing organizations. Once the Statements of Use and the descriptive paragraphs have been collected, I will issue a 7-day e-ballot to approve the following. 1. Certification by the TC that all schema and XML instances are well-formed and that expressions are valid. 2. Approval of the descriptive paragraphs. 3. Approval of the Statements of Use. 4. Request for Special Majority Vote to proceed to Candidate OASIS Standard. We're on our way! David --------------------------------------------------------------------- To unsubscribe from this mail list, you must leave the OASIS TC that generates this mail. Follow this link to all your TCs in OASIS at: https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php

It occurs to me that now that we aren't having meetings regularly, this kind of question will come up often, because it will be easy to lose track of where we are. In the next couple of days, I will edit our page on the OASIS web site so that you'll always be able to log in and see exactly what next steps we need to take. David On 8/8/19 5:16 PM, David Keaton wrote: On 8/8/19 5:07 PM, Larry Golding (Myriad Consulting Inc) wrote: So what do we do now to say, "Great, we're a Committee Specification! Now we want to be an OASIS Specification"? First, we need three Statements of Use. I have an updated one from Jim, and I need two more. One must be from an OASIS organizational member. We also need to document SARIF's relationship to the work of other OASIS TCs or other standards developing organizations. This can be two or three lines. Example: explain why SARIF complements TOIF instead of competing with it. Then we can have a ballot to approve the SoUs and to request a Special Majority Vote to proceed to Candidate OASIS Standard. (See my message below where I detailed it all.) David On 7/23/19 6:13 PM, David Keaton wrote: The Special Majority Vote for Committee Specification has closed, and we will receive official notification of Committee Specification status soon. Once the official date of the Committee Specification has been recorded, it will be time to begin submitting Statements of Use. If you need any assistance with this, please let me know. I will collect the Statements of Use and enter them as TC documents for use in our request for Candidate OASIS Standard status. I would like to ask for a volunteer to submit a brief paragraph for each of the following. 1. A clear English-language summary of the specification that will help OASIS members outside the TC understand what they will be reviewing at the Candidate OASIS Standard stage. 2. The relationship of this specification to similar work of other OASIS TCs or other standards developing organizations. Once the Statements of Use and the descriptive paragraphs have been collected, I will issue a 7-day e-ballot to approve the following. 1. Certification by the TC that all schema and XML instances are well-formed and that expressions are valid. 2. Approval of the descriptive paragraphs. 3. Approval of the Statements of Use. 4. Request for Special Majority Vote to proceed to Candidate OASIS Standard. We're on our way! David --------------------------------------------------------------------- To unsubscribe from this mail list, you must leave the OASIS TC that generates this mail. Follow this link to all your TCs in OASIS at: https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php --------------------------------------------------------------------- To unsubscribe from this mail list, you must leave the OASIS TC that generates this mail. Follow this link to all your TCs in OASIS at: https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php

Thanks, good idea. Larry -----Original Message----- From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On Behalf Of David Keaton Sent: Thursday, August 8, 2019 5:46 PM To: sarif@lists.oasis-open.org Subject: Re: [sarif] Static Analysis Results Interchange Format (SARIF) V2.1.0 from the SARIF TC is an approved OASIS Committee Specification It occurs to me that now that we aren't having meetings regularly, this kind of question will come up often, because it will be easy to lose track of where we are. In the next couple of days, I will edit our page on the OASIS web site so that you'll always be able to log in and see exactly what next steps we need to take. David On 8/8/19 5:16 PM, David Keaton wrote: > On 8/8/19 5:07 PM, Larry Golding (Myriad Consulting Inc) wrote: >> So what do we do now to say, "Great, we're a Committee Specification! >> Now we want to be an OASIS Specification"? > > First, we need three Statements of Use. I have an updated one > from Jim, and I need two more. One must be from an OASIS > organizational member. > > We also need to document SARIF's relationship to the work of > other OASIS TCs or other standards developing organizations. This can > be two or three lines. Example: explain why SARIF complements TOIF > instead of competing with it. > > Then we can have a ballot to approve the SoUs and to request a > Special Majority Vote to proceed to Candidate OASIS Standard. (See my > message below where I detailed it all.) > > David > > On 7/23/19 6:13 PM, David Keaton wrote: >> The Special Majority Vote for Committee Specification has >> closed, and we will receive official notification of Committee >> Specification status soon. >> >> Once the official date of the Committee Specification has been >> recorded, it will be time to begin submitting Statements of Use. If >> you need any assistance with this, please let me know. I will >> collect the Statements of Use and enter them as TC documents for use >> in our request for Candidate OASIS Standard status. >> >> I would like to ask for a volunteer to submit a brief paragraph >> for each of the following. >> >> 1. A clear English-language summary of the specification that will >> help OASIS members outside the TC understand what they will be >> reviewing at the Candidate OASIS Standard stage. >> >> 2. The relationship of this specification to similar work of other >> OASIS TCs or other standards developing organizations. >> >> Once the Statements of Use and the descriptive paragraphs have >> been collected, I will issue a 7-day e-ballot to approve the following. >> >> 1. Certification by the TC that all schema and XML instances are >> well-formed and that expressions are valid. >> >> 2. Approval of the descriptive paragraphs. >> >> 3. Approval of the Statements of Use. >> >> 4. Request for Special Majority Vote to proceed to Candidate OASIS >> Standard. >> >> We're on our way! >> >> David >> >> --------------------------------------------------------------------- >> To unsubscribe from this mail list, you must leave the OASIS TC that >> generates this mail. Follow this link to all your TCs in OASIS at: >> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww >> .oasis-open.org%2Fapps%2Forg%2Fworkgroup%2Fportal%2Fmy_workgroups.php >> &amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C2544bb3006bd4444eeec08d >> 71c6302ca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63700908388182 >> 8963&amp;sdata=FRx4vc4hStaDvxL4z1K%2F9nWMucEBTaUijbQ2r%2BLMq1Y%3D&amp >> ;reserved=0 > > > --------------------------------------------------------------------- > To unsubscribe from this mail list, you must leave the OASIS TC that > generates this mail. Follow this link to all your TCs in OASIS at: > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww . > oasis-open.org%2Fapps%2Forg%2Fworkgroup%2Fportal%2Fmy_workgroups.php&a > mp;data=02%7C01%7Cv-lgold%40microsoft.com%7C2544bb3006bd4444eeec08d71c > 6302ca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637009083881828963 > &amp;sdata=FRx4vc4hStaDvxL4z1K%2F9nWMucEBTaUijbQ2r%2BLMq1Y%3D&amp;rese > rved=0 --------------------------------------------------------------------- To unsubscribe from this mail list, you must leave the OASIS TC that generates this mail. Follow this link to all your TCs in OASIS at: https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.oasis-open.org%2Fapps%2Forg%2Fworkgroup%2Fportal%2Fmy_workgroups.php&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C2544bb3006bd4444eeec08d71c6302ca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637009083881828963&amp;sdata=FRx4vc4hStaDvxL4z1K%2F9nWMucEBTaUijbQ2r%2BLMq1Y%3D&amp;reserved=0