OASIS Static Analysis Results Interchange Format (SARIF) TC

Here you go. "Inspired by" our conformance clauses; not mapped 1:1 with them, but a pretty good sampling of the kinds of uses we'll see: - Static analysis tools - Static analysis results visualization tools (viewers) - Bug filing tools - Defect databases - Compliance systems And yes, still "non-exhaustive".

That list looks good to me! David On 4/3/20 5:05 PM, Larry Golding (Myriad Consulting Inc) wrote: Here you go. "Inspired by" our conformance clauses; not mapped 1:1 with them, but a pretty good sampling of the kinds of uses we'll see: - Static analysis tools - Static analysis results visualization tools (viewers) - Bug filing tools - Defect databases - Compliance systems And yes, still "non-exhaustive".
Original Message----- From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On Behalf Of Larry Golding (Myriad Consulting Inc) Sent: Friday, April 3, 2020 5:01 PM To: David Keaton <dmk@dmk.com>; sarif@lists.oasis-open.org Subject: RE: [sarif] RE: [EXTERNAL] Re: [sarif] Draft IANA registration for media type application/sarif+json That sounds like a great idea, thanks! (And the sql example does answer my question: the intent of the question is "what kinds of software would use this type", not "what kinds of software are using it now".)

Great! Thanks! k
Original Message----- From: sarif@lists.oasis-open.org [ mailto:sarif@lists.oasis-open.org ] On Behalf Of David Keaton Sent: Friday, April 03, 2020 5:07 PM To: sarif@lists.oasis-open.org Subject: Re: [sarif] RE: [EXTERNAL] Re: [sarif] Draft IANA registration for media type application/sarif+json That list looks good to me! David On 4/3/20 5:05 PM, Larry Golding (Myriad Consulting Inc) wrote: > Here you go. "Inspired by" our conformance clauses; not mapped 1:1 with them, but a pretty good sampling of the kinds of uses we'll see: > > - Static analysis tools > - Static analysis results visualization tools (viewers) > - Bug filing tools > - Defect databases > - Compliance systems > > And yes, still "non-exhaustive". > >
Original Message----- > From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On > Behalf Of Larry Golding (Myriad Consulting Inc) > Sent: Friday, April 3, 2020 5:01 PM > To: David Keaton <dmk@dmk.com>; sarif@lists.oasis-open.org > Subject: RE: [sarif] RE: [EXTERNAL] Re: [sarif] Draft IANA > registration for media type application/sarif+json > > That sounds like a great idea, thanks! (And the sql example does > answer my question: the intent of the question is "what kinds of > software would use this type", not "what kinds of software are using > it now".) > >

Looking at the draft registration as a whole, the rest looks good to me too (although the last line probably needs a newline at the end). David On 4/3/20 5:06 PM, David Keaton wrote: That list looks good to me! David On 4/3/20 5:05 PM, Larry Golding (Myriad Consulting Inc) wrote: Here you go. "Inspired by" our conformance clauses; not mapped 1:1 with them, but a pretty good sampling of the kinds of uses we'll see: - Static analysis tools - Static analysis results visualization tools (viewers) - Bug filing tools - Defect databases - Compliance systems And yes, still "non-exhaustive".
Original Message----- From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On Behalf Of Larry Golding (Myriad Consulting Inc) Sent: Friday, April 3, 2020 5:01 PM To: David Keaton <dmk@dmk.com>; sarif@lists.oasis-open.org Subject: RE: [sarif] RE: [EXTERNAL] Re: [sarif] Draft IANA registration for media type application/sarif+json That sounds like a great idea, thanks! (And the sql example does answer my question: the intent of the question is "what kinds of software would use this type", not "what kinds of software are using it now".)
Original Message----- From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On Behalf Of David Keaton Sent: Friday, April 3, 2020 4:59 PM To: sarif@lists.oasis-open.org Subject: Re: [sarif] RE: [EXTERNAL] Re: [sarif] Draft IANA registration for media type application/sarif+json Larry, Maybe we are being too specific. For example, if you look at the description for application/sql, it just says "Databases and related tools" instead of listing product names. https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc6922&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C0b5b79199ef648c333b408d7d82b47ef%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637215552709165825&amp;sdata=svGlW0aIoORluQQKiNcyGDoBmT3wM44NZf7wr%2BIfLW0%3D&amp;reserved=0 What if we went through the conformance clauses and picked out generic descriptions for tools, such as "static analyzers," "static analysis results visualization tools," etc. (still keeping the list labeled as not exhaustive)? Does that sound reasonable to you? David On 4/3/20 4:51 PM, Larry Golding (Myriad Consulting Inc) wrote: Oh! That is a very interesting point. Maybe I was answering the wrong question. I was answering the question "What applications use SARIF files?". I was not answering the question "What applications currently use application/sarif+json" to designate SARIF files?" Because the answer to _that_ question is "None" ð David, what should I be doing here?

Fixed ð
Original Message----- From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On Behalf Of David Keaton Sent: Friday, April 3, 2020 5:17 PM To: sarif@lists.oasis-open.org Subject: Re: [sarif] RE: [EXTERNAL] Re: [sarif] Draft IANA registration for media type application/sarif+json Looking at the draft registration as a whole, the rest looks good to me too (although the last line probably needs a newline at the end). David On 4/3/20 5:06 PM, David Keaton wrote: > That list looks good to me! > > David > > On 4/3/20 5:05 PM, Larry Golding (Myriad Consulting Inc) wrote: >> Here you go. "Inspired by" our conformance clauses; not mapped 1:1 >> with them, but a pretty good sampling of the kinds of uses we'll see: >> >> - Static analysis tools >> - Static analysis results visualization tools (viewers) >> - Bug filing tools >> - Defect databases >> - Compliance systems >> >> And yes, still "non-exhaustive". >> >>
Original Message----- >> From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On >> Behalf Of Larry Golding (Myriad Consulting Inc) >> Sent: Friday, April 3, 2020 5:01 PM >> To: David Keaton <dmk@dmk.com>; sarif@lists.oasis-open.org >> Subject: RE: [sarif] RE: [EXTERNAL] Re: [sarif] Draft IANA >> registration for media type application/sarif+json >> >> That sounds like a great idea, thanks! (And the sql example does >> answer my question: the intent of the question is "what kinds of >> software would use this type", not "what kinds of software are using >> it now".) >> >>
Original Message----- >> From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On >> Behalf Of David Keaton >> Sent: Friday, April 3, 2020 4:59 PM >> To: sarif@lists.oasis-open.org >> Subject: Re: [sarif] RE: [EXTERNAL] Re: [sarif] Draft IANA >> registration for media type application/sarif+json >> >> Larry, >> >> Maybe we are being too specific. For example, if you look at >> the description for application/sql, it just says "Databases and >> related tools" instead of listing product names. >> >> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftoo >> ls.ietf.org%2Fhtml%2Frfc6922&amp;data=02%7C01%7Cv-lgold%40microsoft.c >> om%7C168a1bec792d4fb36c0d08d7d82d814f%7C72f988bf86f141af91ab2d7cd011d >> b47%7C1%7C0%7C637215562266012765&amp;sdata=x4ZcMPhpW3Ha4qNKZP4el%2FHo >> VEwSQJQUxoofAncN9Bg%3D&amp;reserved=0 >> >> >> What if we went through the conformance clauses and picked out >> generic descriptions for tools, such as "static analyzers," "static >> analysis results visualization tools," etc. (still keeping the list >> labeled as not exhaustive)? Does that sound reasonable to you? >> >> David >> >> On 4/3/20 4:51 PM, Larry Golding (Myriad Consulting Inc) wrote: >>> Oh! >>> >>> That is a very interesting point. Maybe I was answering the wrong >>> question. I was answering the question "What applications use SARIF >>> files?". I was not answering the question "What applications >>> currently use application/sarif+json" to designate SARIF files?" >>> >>> Because the answer to _that_ question is "None" ð >>> >>> David, what should I be doing here? >>> >>>