Caesar, standards, and SAST: The road to SARIF

In this post, Michael Fanning gives us a short history on standards, how consensus on something very small can enable something very large, and how all of it relates to the design of the ‘Static Analysis Results Interchange Format’ (SARIF).

Michael C. Fanning
4 min readintermediate
--
View Original

Overview

The article discusses the historical significance of standards in both ancient Rome and modern software development, particularly focusing on the Static Analysis Results Interchange Format (SARIF). It highlights how SARIF facilitates effective communication between static analysis tools and consumers in a DevOps environment, enabling better integration and efficiency.

What You'll Learn

1

How to use SARIF for effective static analysis results interchange

2

Why standards are crucial for integrating disparate software tools

3

When to implement SARIF in your DevOps pipeline

Key Questions Answered

What is the purpose of SARIF in static analysis?
SARIF, or Static Analysis Results Interchange Format, is designed to standardize how static analysis tools communicate their results. It allows for consistent output that can be consumed by various tools and platforms, enhancing integration and usability in DevOps environments.
How did Julius Caesar's standards influence modern software development?
Julius Caesar's establishment of standard wheel and axle dimensions for vehicles on Roman roads serves as an analogy for how modern software standards, like SARIF, facilitate interoperability and efficiency among diverse software tools, enabling large-scale development.
What are the key components of a SARIF file?
A SARIF file is structured as a web-friendly JSON document that includes versioning information and a list of results from static analysis tools. It can also contain additional data to aid in understanding and resolving reported issues, such as execution paths and rule help.

Technologies & Tools

Some links below are affiliate links. We may earn a commission if you make a purchase.

Standard
Sarif
Used for standardizing static analysis results interchange in DevOps.
Framework
.net
Framework where the static analysis checker FxCop was initially integrated.

Key Actionable Insights

1
Adopt SARIF in your static analysis tools to streamline results communication.
Implementing SARIF allows for consistent formatting of analysis results, making it easier to integrate with various development environments and tools, thus enhancing productivity.
2
Establish standards early in your software projects to avoid integration issues later.
By defining clear standards from the beginning, teams can minimize coordination problems and ensure smoother collaboration across different tools and processes.
3
Utilize the log file format as a point of contact between different engineering processes.
Maintaining a consistent log file format can significantly reduce the need for coordination between teams, allowing for parallel development and faster iterations.

Common Pitfalls

1
Neglecting to define standards can lead to integration challenges.
Without established standards, teams may face significant delays and complications when trying to integrate different tools or processes, leading to inefficient workflows.

Related Concepts

Static Analysis
Devops
Standards In Software Engineering