From 7af62ffdaf87360f3ad8ed8245995e88480d9679 Mon Sep 17 00:00:00 2001
From: Larry Golding <lgolding@comcast.net>
Date: Fri, 3 Jul 2020 13:55:07 -0700
Subject: [PATCH] Provide messages for
 SARIF2003.ProvideVersionControlProvenance.

---
 docs/Producing effective SARIF.md             |   4 ++++
 docs/Rule factoring.xlsx                      | Bin 13864 -> 13515 bytes
 .../Rules/RuleResources.Designer.cs           |   4 ++--
 src/Sarif.Multitool/Rules/RuleResources.resx  |   4 ++--
 ...RIF2003.ProvideVersionControlProvenance.cs |   7 +++++--
 ...videVersionControlProvenance_Invalid.sarif |   6 +++---
 6 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/docs/Producing effective SARIF.md b/docs/Producing effective SARIF.md
index a2c166f17..d87cf095a 100644
--- a/docs/Producing effective SARIF.md	
+++ b/docs/Producing effective SARIF.md	
@@ -371,10 +371,14 @@ In result messages, use the 'message.id' and 'message.arguments' properties rath
 
 #### Description
 
+Provide 'versionControlProvenance' to record which version of the code was analyzed, and to enable paths to be expressed relative to the root of the repository.
+
 #### Messages
 
 ##### `Default`: note
 
+This run does not provide 'versionControlProvenance'. As a result, it is not possible to determine which version of code was analyzed, nor to map relative paths to their locations within the repository.
+
 ---
 
 ### Rule `SARIF2004.OptimizeFileSize`
diff --git a/docs/Rule factoring.xlsx b/docs/Rule factoring.xlsx
index ae17dc8e0ba9c39fa22ebdfbc423fab1bea9ff93..911cb5d13bc1a3d1fc7e233704f982aa5663180e 100644
GIT binary patch
delta 4937
zcmY*dcQ71W`(10Tw)$d;8ZCNRqL)QNgh(V>ELLar8h!OH!U_^KQNt3wM3l8kL~pU8
zmjsEZ2|>iq@0)MlcfR}AnK@_f-1|Jw+_~pexDC0m-oHx<f&#z*3IG7W3-G)7xGb0i
z0Enq$6$D~{()69VziD%=Xe{<oDK@JS!H*dCNzlr*G>gsK5DL#dH-s%jlLFa1*L-xL
z?^LFal&>*EXkH5y2zD@quJ}uR8WTN`4*Q{!1iTYejNHGUNK*u(_3%8KG60Dwe6|xn
zzy8fH@Qs~4)*)f#)SkttH~}+-yj{wQrakPO55qiD3IrN*qNRI_E+OzHzen$JK_OKe
zQ^5~Xnok~A>Q%t<XOhe+kU>ZBB}|U+Dm<ve4fd`#M}rMVQsM2OpT#x>N+80hf}X)6
z2}in5YV@8C_tZ8s>=Dn@AwLE$YXZFY{%{Pk-{=>a$VC&|k;<pclWXvpTR|Kf3)34=
z%=6Uxzd9!je?!?Etb$EhCeMbth5YDeVITf<AT{F@5ebdn5wrI~z^Z-7Dv+Zlvg4?V
z`gdxWX1vM0G_*vzsE|!sNJ^naaGs`i0XyX=>;BYhcRwK+dj9%a&q=MmPN$7@-#R;I
zr<WwY5f)$BlzxK&fXho#z<+y!4W}Y+_(Uo|O2(-k{`YYPIS1x}XRZ=7ywLBG^iY|M
zi6=s@T#&wcQpwnTw&T%Dq*Najs>c20qnW?wPYrbE{a^aDUt_p-&Y{-nJNjh!V8DIe
zjP8+ce>-%QkJY?UG;r|UIW(-pYL214<htb@_N57^s!^g^!JnhmKtkWy)1xLbK)(Ki
z>PLkNPsPxm8H0K;A)g~l*Io-yWvwlxcNCRm%9U2SbBy_Gl?&js_%yH6;#Z9Os9qk}
zI=htLrbk?R9npz1mlSGjRshuq*sA^vz|V8>?3xj#i%D*oSnxZYaI$XHMAo(_)HVZa
z=>HO9@wrQ&GWoY?bKcgC=So0lC;kh;@Es*smmdDuot74(b;ya}&Z$`~cuuiAD6(J|
zJBA`&xXMB%Wgg$*3EI=9K3-7q^Fh|dEu~C0=`Le<t7{%b<KlFmXX{VM-10R$qzP-{
zjSH8q1>*`>gM2sgcD{u2;xbI^ou}m}f}-L_DF{UBMj?vz#s`o5v?m1ipj%$7v&-mF
zl%y*yRSQO9yNi?w%1-^0tgc5lDQ01i`Zd~>-XJM!(ESd#hX4bv-l45iJc!rR`a{P1
zACZ?l`bJyMoD@$=WS1`4m86&k`8%lv#9Gyd)U-%yK9FXTCeb$Pw-g{c4|YOK6F?XY
zm7P2xa_@7pSepBCn$P)k8c_Lz@9dG`kyvsAH$5hW0vm-z%(UydZb47+p8A{i%I3AX
z5L{^4!NzWQa{-1;aGs8{R&B}yw)nxxV5_w0qW@inr;)u~^~S*LP^xseU1{Y**<?*R
zWPgWY=HhHOkx;M%`r+y*98A?fj2^d}_l+JtUSw-#jpWK|2xVJUuo_V%d<a4e<`rm+
zV1`YcpqNs_N05QW0)vcn0mchjZxh>xz1wwBvSc@qhW*n0HLR|5?~DseW#9?PB&s{@
z<-YRA?(&6X&D?zjoTu<HtFsr`<VPw)tdTWoY8Tkcb%-pxVcA%cqdC*78ZzNe`_k`9
zW}<ZIr(yK_VRr%;w5gwfp%=_nb81f!W+utwEzxdr)L#`WzT&^Vz|nREZ&E@Pzq;s6
z0~X(0o5C@v)&#VlkDwQbGuy^{0@*J{&v&=g6|E3IX;jC9{C$ho4~I^FwN3PUl6vV!
z{c^Tn)pt-lrNnwuK`ArHGj~8&kDq$OQz{V>OvVtpR|<0LB=&FgM5nh**!?(f#|fhx
z_uTLZuS^AfTXKuAjXhT*rNQoJ9`(|?Jttg=?emx?)xY_<*`1i}?@&eI0vzmI$@cn&
zM)(rCo$tEk3y_hL5jST|+fC8w>*c7IY6%s#(Lln2XDQ_K{dit))j5SXd3(?7wq56n
zF>1C3KG-t4$uT(|^(kn)QKWii3s2Ikw9!k~_DZy@s`AA|`WI>znf>v8GVRDtL6dz8
zp>&1~hx3t_#~fpt*mJXw2P0XqdO5bvJaw>EFVnyq<_!h&m^N#s+jdojkedNficMJ(
zJ}u}QkYJHz;=u4&gS6)*{zC(CQyl=n5=faSW5n2fs;B^fW$Z7=b&TP<F5}<u$&2_8
zg&zJoj9r3=ZmK96HWx<|!p@=-6GR)^t2od-TyWgw*`?@h%KYUxud#vl>*{t*&9~sn
zp@X@%%ktmxt`B~gemPz^insH;@0R_AfIj!zz4$Aq{319yEZ>v+(7#Q5w1c~E>HOE)
z9!5Dtw94~*^K}Jzlntg`{iNV~@DnBWAK7Dlg3EM6mUYZsL1I+~R>|B|<rCqi%%{<3
z#UsJclz~BK?Azu7M}=yn!pDJunfg|VY{^_(3)hTFv(2WQ%fCTQ^YU)FrPPapZ#z47
z?qz*(6uPl%`rY_KD?K=R<k0V+QM~F;xcJWBU7b^({SL-UvNdZA5mLNcoPM*)!FYFQ
zAoxa(PVgx4&z$qkkJ;pcZe2{N+^Lmo{sNqVB~;-adf}lfR8Q?!4KoDDW!jK4+e6=0
z7tXC2t@|71?8ANhgA^4Lzcy?S&L|ukN=)?{!qtZ|Tz;27@jk9)<jOLksa!i)X#Z)b
zelOJ1&$|q`wOqA^abG@DsW>`sx3v`et_fKSiB|vU<J&S^x>x4?eZWwLXZEZtW%a!N
zkKiE7+E~9WvEzC=;p<TFugAm5O&ZI$ZB>sijp6BqeX_UXgBsQ4eLp^0xHO^RN*eg%
zV2Kf4_DG(Y@)Z|krRj@#w34Uxr&Z$kF2kVhz76c|l0zE{KW6PRdPL9T4nyMU6aO#^
z)#<S{Y-`h7jP6ix`MIsNljxoAG+C18?-u?HbVFX0F-)1tuA!Y@&v|_lnoywZbqhYC
zOcPP_mJ6M_jF*t{TSIR}9eAna8x(sT!l#%p#brV@agtBt9&ntgJGj{rdz%jMelQ)p
z*o$UIAsK=72u$KC{cN0_jD8R5b3sOt*Uxed5z@ZrrFM?8aOm2ZTCCKISNpNZtt}`w
zd&auvQFDr4NtL@_{_JU=xp60rHcRF~$53h6?{Xi|0irjyAa2Q&itoheMtC*Gn`pV`
zE?!s8e_Cp98nZTbVoT_<ig7A7t&7hFd&e?FrsmkiVAPv=XF<I!yu#9>!*TX7nSA22
zYiJ$~-@7QF)M{*h0*$X(ws6sDgo~q2?(Losa@LP-a{;{hKiIQ%8-2EIwkTRbeBHLA
zlpvnA{%0^T%_QE3fI(Spw{?O&snmF?4Fe(sIrPST!d-qOUPF6xz3<P_USX$1J;uI#
zt_!?`nH`%g?63x3au8cs3&CAsr=dpz9qmWqiq}*>)~elG@JY=vrkmAm{P7aj3g%<1
zwUFwGui@oEjg`WHs>KXACkW+twygfgdT;bc9~9^{c4VSNoxr@B>-6&Q)<sUK7L|S(
z#KsAipl+i(km9>OpBXod@e{dNszZcIVXG5{J+YYvptwuL7g|K;3k2TmlOu^d(AVhh
zAB4oDl9LaMr`2UW+^#+kW)EWN@k%h`*4|-`d;u8FTZ>eT>gm2!Dy93-{|>(2nLq%)
zA?eVvmlVahm?89y6Fmonr@s%Q0^yCe=kM9rH|%dqS{jCl`>dsSP3slSzrgQ1wo+h3
z4DCa-hAVVF9SI<(U%JCJRvf^D+*d(L?_VMAEo}*WdBee)vr72sF7=*G;`&FXxuq?k
z;!cy6`<$K*w=VGu6Xk~i%->FoTJDmOx6_&^L&4ujBN1eDv4}zaDwOi>eK~YsV0_yR
z2}65j{gi+OwfYvmT)T>Fo67U)Y_B#<nEh0*Pg?1srAoG%$uNCpgegc6Agv}OMN|#M
z0h~?Hfw)Eh^8zaHB&Y5-e>LKs3xZ?oyj7=1_ylAmL|3X&9s*rhQsqt95~Yf!^?6)S
zodL|>kP-y7OUc<aEiwTMhEcx>d2Gr4bcXiasnteBz9*o^`QmU5qmPg{c?_Wxx{~My
z#~BsPLy%N4UJW1#9oO;(xx4ncHqU{Jj<ThIVTZ`lzQtU!LPsq#c~LztR7_h+cM<Y7
zYTpsxgrIOGB@lF8+;#6}n%k{IM|+&eHsR}5AU3COmAW^%Jg@$=M<G_xNFyH<^L0zd
z&_`aYr_ve2McF^CL=?6#IK*Iy)D0n5%1vLHe(l=Vulj*O%5d0{x}(^VI{U^(q1AI;
z_LXlunv*?L&FEXpvMTS{c0WqCuc|^V@Cd)|;OuVw?x!!AV3{!$bsB#Sg&}U~Y>;c5
zG<5AamGtK^J>f~!D=2dt2|3sjgthPM)m?*y16a@u`L8&j%>tN*(6mrb>sOIUc&Ik2
zZ2$f(l-DyCe~<DvAdstGD%rI`Fd<|hrH}jtxUHn9)>6Z-8eKNN$+eo-j0#XDKPf5a
zIk8SGpR91A8lneA=WC^q{fb;;<J+r!R|R*~>J1sN>?SlvJP~)T94{Jy4ADog+6{kM
z8D*MdD-!oz#A6T@96MR@+N>dv!pr+SL@6OD=_Fbe*td8XSGc()?E<Yfbu@#OlG@v#
zy*CyXFO{>^dN$`_yLW->=e1tN8eZF!!w{4aFgj}qMJ)9UB!&$#nKM*(W=;LP@h+QL
zeJOR7fa#+s2#osdanEMFa;;7<LP#KRzfy@K=^9tKF{V9{C7u$$?mn%PFTu=?;~nMz
zIVOE#E6fOM9EHInt9fj3AXSx5Dxp7L)_op<aUYL+=1weW&5<nVyq!uIw<X?^hAq((
zrfd?Z(Kh|ALWr(kAEuj|vr}&W_VxvGbIZYw+1^lZHIv%UPu$hz!&y-7q%h{NeWuM3
zx;;-~hY{S$h4zN72rmrBr(I{|{F1n1>@Hu^o^h%&8Rl9g6lqUw#~65DUgdphT)bf|
z`-aiZKv-pDo96sBv<#ow&0lNaCWR}dp>ushI?;o|ecpm4WG$~B;~O9LGP85su$hgz
z(ufF1=^}4H77Re(#8&*is3#RzO-R1Dt|AtLm{UCMnAsEfA)Pf3x>-Xx45|)qX)Fh&
z?P;~adBR=t{o2_^@3gF2y{jHakrVa??ZLekYy1l%ULIKqBy<LZ-9@2^W&z4AFtYEe
zUgS)`=qKFLEN+|hDuE|1T;Vn&W}!=Vi930pbcTAV8Ga}G-zc{khTI&a;4<SanZ}qo
zKddt<vk;@9>#|+cPL9*<Sg;YdozxM8$7a0}wtoH08q(&nyLBS6QEl-(OVzA>Xuge(
zaVpOpbKnk1Rsuo^+PXHV2Rf*6^NjAIRFu@tZRfy1HXluK$j7W##oot<C&Iw`5=Bcw
zG<vd1v3i_GGR;OO0?@aAo(u&CVHlp2*Re{2L(<(vazDtca9ZtX%+Y?EF~7HeXNH^L
z`HQIt)|@2_d2Fr%voe2u0SN&(iiKkoguURdLS*-Xg=;klIkC2gs3I^Ek6!`5RG>@U
zz4aph@fAnh(;~UzHgR`JwtESDUtlIJ{1j@80vdrX2hJ5=4E9$_{pr8QVd9xxN!NNX
zHc|n4>btI@cKX4CEt(dGiwiD;@|{i29;=6l_Y$9r>y4dT-=bXZMy^y@`vPO~3~g2h
zGrD;;uR(I_*||QQ(q5IWqG|d}-0b3PNdhCH_H||o-Oi0m*7<d>D#xtUI)sz%3;$4l
z=#+7%T#)srHHVq6<xU5VHv@U8WDi(y@_}MQ?@kdE?>9O`zhy5L;Y`*n&41OOw6%y<
zz58g|1Y3R7X^s@<`q@kSw#@oZ1D+Mngf$oICDVX=P&+kT7l)Hz{O%~Xw2cR>*k5<!
zQFstaJ-BG%hRv`KxHu_WG!dmz6Wm;o+(a^t(cXHhh9~M*f#OM%7;e0BC~Kw+H<ygE
zNWrb^9U?__y=Yj*CWn&EGWDHF4R2?okYJXejC%b{$|Xfp8BH7!f&bC1oXINx8M<&<
zJeQG?OxH=q_&^CGNTwjswq8O4cF^e+DuHs=FXX-_(?#&a12Y@=Ibt^Ezjs5A$0AL(
z6_bZ&O85Md=AG_(LzPePj`?+!l?XXEyWf9!gDk`g=PMCqFD)s%UBt+kz^zk)mWLe&
zcgcPh9XZxXZzqmi_w`u(xEG3zd|%bEoO9-O+qCMlJ@WO#Hj{utW%V?!=dDi%_YjxP
z^9R3WbT=M0*bOusD&;M|WmQOZ)+SY=?U_)@tIZXrF5fe#;XX1*Uccq7cOvP{IKHa%
z+D+D0_8Y@kMB~WC(PoJ?7Ej9D@J<pBr2HpE!p6uLku+duWw@^WC&C~F0Hm*iCc3Mv
z>EA`f(!;M``^S7;Y1scIuaGs?04~n)j}uV?0AT;a7elaT5O!=WT!bVBI}g_&A;ogY
zDgo*Eu%3J@SPxkdAg3@kOjrQhbp^Rauow|xEL4vEY9i<%|868Dij9`L&heiSx$=N<
lKmdT@U-k<96vg7@RDl^188_K!X#g|;`>T^akp6$o{{d#<7##or

delta 5275
zcmZu#2Q(ba+FmR|R&TpHt0lTcq7x($A&9a>?<^q+vRYPWwL~^r^p+^mB_b<Wy{!_x
zgw;ifZa)OS@1A?Ud+vYk%z4keGv|G0&dfaXobybdTd@b5fi4-489)KJ1^@u~0M=4N
zp|42*fTe0SAyQPE6sQThM{811j3<Q9ThzCOKp&EF^9szdi|gf2#&2&wgQd~4i;noY
zjS5}7vRvaxG%FWPc{4;|6W8a?OTDWI-dy{P4E7iC(h4nXG?YLVcd#48-&=EOOZ5ec
zeVuj?XU|893T{wXM4H49{9Ra$%3^FrEbkVvxzp~uOQF7|C?ZK83HpNVWgElO16~@>
zR{nKxw<qH$Kh0yn*Z8x6v|<@cwL!z-Dw__(8CHe^p3lknL`sLsOacrxOVh+)A6$6t
z9YmJ(2Y|G6(DUae&zxAJ5)zQO@k`rvzYD)36JmQa)SRrtSTMj?JTO&MSnZBQV`NqF
zaX9Dnd(>=xsmVBMbFM9iuAskf1s&;gA>;j;b`e6Bp3|k<Eu|81A3=%S_~J68x_Vbo
zYOsAoNv$CyXHrFxe@$~&<kqH|;;=oHC{57bb0@k+Q~gKm*)2>&WE}Q&4wJ+CJ6g0w
z!079L>4#K&iw6PGVjeKt39D(D=lNXQ;BVcsw%7c;`#6US9sz30$rQ-Q|0q%STVXaS
zI8ifCXKvF6+t^-e5U~7)<6MT+oAw?dAFjRiIAzSW6}ZVShPHki%LP0q(*DwY`vHy|
zk#jU!j!zuu&&<<T^NgAcD7+)1>U=HdYj?f_o<m;MaeXHvk_)PPQ%1gU4T>LPN?sqC
z%0XpTG{EOxG}QrY-$6FsSrjEgHxp^KvQfJ%T(}?4rRm9a_Xyp|xrIqwMegfdgT9(B
zydGLlB8)l1aWg4nb<0PxLx!Fjz-=_?X^n$u!#$1-2Lc6u%1Cd;Nfl{K;5h8aQ9Vg+
z^w&vSH+jPj-xdw+r-TsE2sJ;u-D5A(5v&=_CsxaS(=0$;t>C%Dt1U%vvkq=G7)6_?
zxzDA+lU}h9ntV;I`=+vOq@?ZSxu-1Xhm3^|pFfY*b=p~FAHV6E?762!h@`QN>kyx!
z0LLS((o(xvc}T2n&%_}<D$VqyJ)kPUdP}=oL8<%12u|bKGg`($zt7FB2n8`o4rTMk
z`&Sl&(fQ;&EbHEE6Fcq$wrpIKsK_T~hdF2}>ICxBFu0w7?}Ohff`(agXjM(^fQg|l
zB^@Bbb4qN7-MSBJRwJ+zNKm_m8CA5PZ2f68J$K2eD8=;4Iw<u4+#6;6DvHz+b5Del
znaef(sY-Ov(o}sl>y3+J&XppY&R33u1^G4SGNoI$LDYfPEVv*BRwwSSsChmx!v{HG
z%!Xg`_z+}2+$K$;+t~~ERIz$Bva=R@HWhH;HaXL@8FG~F*SBub<a$T49B(EsAC$$%
zfe=*tZdH-6CyFpm%`@i=Ak_Rki>ryI1qV)!WaI|p#WV-)(veQd0$<iBing&ZkF`+l
zSaXy1+d8aCE?|X9k@OK1Q*rtfd%|Mn5ju7uZM;@TrberDo^OD|BlaumlTa`X^#tbG
z!>Uce>F}qcE+ze-MSFF+v){_kndbe<%x%w}ElyRd9c;Bqe!m%0TGLBr#S?t`@v;lz
zDx3XVP4vCfy@+oNh1RWI>#<)Hl6Z?f)mw;iQ_3+fUQ#fhlUq-!qVz451~untdppEp
zyv>bqi;<sbo6iYU%u1_n4@QAMOE^Y8JywzM!$#x%u+?QF8FRXo53-0qM=n>9G{eNh
z`)eKBNr@e)aT(VO5^N|4X~50l?$)W)l`YCE61==51N=8BYA@n+gs(`kkqiJ}2V5hm
z4W@>YpfG*<ZBq2w#QT53S5(pq)isKB*mw({@&$#gJmhx&^QKFAp9rUtMH{yYap=OJ
z^MT6W=C+%S`&5Sv9ejE*BCDX!vf2e@@0wQz&4`&vY~Se1htu|H(L1$$aX+trX^qx3
zzLf$u7=E`u9e4&%uemEIBE#yN_OA2Bg66NARj51M+L2Z0CGoE%6obz1w+sqrxndCm
z`vVkfm!I{_<r#D0gUpK0A=i25KQEAou~pp3+0RQPg+?D7XUJ^_!>=d)4yHO!7n2r1
z$ON&!EMy;k&H0g4L(M#5s)7otEy{x!UT0VxwV3YS=Akc58hCRfSRf&ckB*PBhf82j
z*;CC{a~0qIviR4>X2(~x?)->_D&&zw&{sF9kJ~ojwDX27j{kL*r}e$J>!<;MWz07a
zKgw(IKI6r!ALo>PIZu7rTIA*F1<e`4$e{RscbP!q6rX+=g_KLCqw}M)`TBX#@6rbi
zD#F{J&<D%EDpD&xeoK&ib>8$7S?TW&XT$2Mt<wZa&X>nVAN~II<MJF4Ab<Q_GkKf4
zMz6Y0@|@=ccX_n2gTf+3d%dF9lq;2SRVXFP(?OHZYCA-_vbCTLu7D2JdGx$8>xz6?
z`|Fj*msOGnTN>xXej{|0;f2lkaU~mAW~u~d$I?<j@;q}{s%KM~tWLUD&4d2S-Nrc{
z_b=PMkxw&{=dF)j%IvXh%*0Lnx6{1)!CqKJ8`bSt8SMNuY%^t>$4and2P*F`Hq=;K
z@tJGkc7O?M^kVe})oN2VOdj<k=dgAxiE3s?iwSh*bnz{PMA<M>?N$-5>hnn9nswox
zx6pJSGyjX4S6>e=Q`<+7G7$Vg#mAB1DQ|g5juqV^!9(#;m_K`=n@r-xVWkB3IDhMp
zo0a`MlIL#T7tfea&daVRt6y5Ld7+{^T`GHj@9gU}l|GlgPY6UYcN{-W?wKS<cW*2W
z<~ZJc+HaNKLDb&U`yt-JL)+d$sSTwZFdaLU%UR(du>opUGhURf@~g$64`0LFURAgx
zm-b(lA9C+^Z8<#-zA?voa{8-*QIjsPdN<}_$w4&FtrI)J=jNcfIQt&#O?gz9)}Q&A
zij{okhO}U_iTWeWBQaI<ljx1;8a(m$fo5`rVEInDHLXeY`Rh=Kj2@J<)U|zV2qgUd
z*&7h0j)?O}`lEK^J#^Uu$EBK2D>hc&lE&)xI!z~LPm2A#|FC^tMD>|m&|cN8_yWSm
zcs)?Y*KuhuanbI!PG`at+5*)Bv~|4Q{&^LA^j3uP)<*#m&ZQe~dexsf{Yr!Afg-;)
zJ>q-lEJ9jc=i?VkC)d+6+$bKL^~)Xd)6vAw*O1jKyEt5?nV4>zOt4JkRgGyJ8X4Mr
zV7F`$+g^DjnOL^@y-0BUoj}e5KW&kVKfJ7eHcfnnQ7j0g6a563VLAo{xeFxYc&@2V
z${{1%nLhc3S+f($@m!Y%=*kKd0y0^<$HS%WHOG_SDIdZVrbgL@m7)yZK|~{bK9_0o
z58o{8%8TX|0Fz`YK<Pu4DKzZ~5eiZ9Bm!gf)$y+}G&uG8C~bl5o>YgKd~GFsw1MN=
z(%9C)PEM1=2&!=HS2Ifaa&s+X@IrD<P37!(A48l;9jv!mefjc2lI{Fn`uIomlf0xm
z<Ca!It^(7vdZ0Vu3{-G&Fhk1_J$=>cDwq^nz~JEsqT+z0bUrUK7IHBg5S;cCg!h(c
z#Ejlv#RDZ?Quc>+!G&T@=Wsyu7d?PmmOGGxOtZB!q^KJ72BpMI^ht4@0T?V*Nb>_u
zrJ%gFhO_kaX@fwZSmvnuWRQ1@7&3lEzo`EAh3vjq#6ns%N%tgz6h@i`=^#S@BSZCz
zr0zfV)y1v4;@gBuNWN=2Vp)!5J;t)iSmy^G7f+PncAZ^2QZiDB$uYt;`1Qig1NFGf
zNoZyr<GLTpU8)fx5!TBz<s1X?Ee;5ch_kMBqqyHVYKw%)KGKzy?Y>c>sB>cJY3B(e
zg*VYe-D=a;^5<7#|LG_@wDEzK%=q3VZkB4SqH!vcB5TyMlwdoCdm7!U9?UCMypShV
zoaV;jvC6e^mxhi<imhV>y%mBU*6+KQ{rimz<O3F!L&+#{pwImtzEE9<O>kki?TA;u
zj?}Zg^JWP~8r~M(MIGvlr+IC{nj6Le;^Bs|+7!xlmx#sC1gGxazs-_uu(4dt;!5*6
zY^F?@6cVgwH*{COuXfBRH;c1V%a&yT56ACng$T=mU%^~D?c3Uzrk*&IvA9~P<fVA`
zfecXZjKUZ2-frYb{u$8K_${(}QU*)0yuR^iH!nQnlry|s9SiXl1t82_-JYG<<FHfL
zj`6XK9$-6hs8n$Z1Go`>81zXj{CnuaLT!K1EdqLL7yex%5V<i&81=qeb#5lylB((z
zHKlQYunxC;@Z437-_tqB*qh;m<ZXWy3UjE>!kPI=qo+`+SO`J2hLGt5+1=AjAm8wF
zmkJ8%hX(~+U4d$rVv>IhHk|J*t7(<VQoxggUFWZ&&B`=8xs%kiHDt$Fpfk{PG`=O5
zU+XIMGPAV>Didy3Td->PvzN(STV&(IRopB!;%_i~6_J1Bm@%wVJ#s$|wGJH1ExwVS
z@4rm<hK0QtET#c;2Hi3NQV6G;t~sYaP_G#%sU~RD;C6?l9rkoSXh;Z(xXaUfTI;c#
z{tyluVeUUB5MaNgi_a$(OJo&ck)GE=aX7xtuv7Itkbw{U=UDP*p~ZqF34-C{mYG>a
zGgt3^&<uU}!i#>Vr2!_CIg9P&X!Q89fvZ6m!A&8QiemkQuDT$causM8pAE3%_Tjci
z!t2K!s(TjH>tw+UMI#6AiP_)e;=Hh%c!`f1oNc}e?P<Ir2^{2iD!R0oLeiO(Cy!`n
z>fcAd{C;-qIa%bc&%&;ZkD$A}0b1X7W~T6G+1b4t;-bH6Tj`GCR?WMD$o3P!pdZ_j
ztC+igCe!Q!E%seY$sIDYf<+BweXWYlG(ZEp!`)rkn6yV>**r?hji3B2EIpkMxqB;m
z@hVnjUqE~E2vRyDP}Cr#ZNxt2y1QE^VjP#dH#+*|OT(CZJ?l;#<6l6x_5HL_@;X-%
zbHDbiI^(?Ul{cuCHbYWaXkTbcySD;;8pAsycU5obQz;MDF=Y>xHMB>ie7%L|lyn@P
zw&dgxa+57ohhY8F7O89H=b)VA>6RL0%gSW`TC5`tn9a<=J!g~(HKoii!ojzPZ!maz
z`TW>R8!|<DYuGYQrZIvAB$z46g_L;;m!hJHjhMs<7;4dXHh1g&pKPL%PGJ0se5lI=
z&^e-UUSj)2nDDjSSqS~kG^@7hOsBR=Cgy2Zmd}$sPx5O7GbbamMe%2hzXNXH(tZC3
z^yHRs^($M~teOzA&?{~V3uGb<H{+3JRUYO;?rw}IH#*?qjVaYyrh2;HT&J#f{s-Ll
z{;sXiE-Ev=rG-|b(LJ=ei;^uFSH)fC4}YydFOJ9uaLEf<Im(#0{?a<(j{Nh5=ox&k
z*@DkY{L>S^cEv0Yp}*>+!7U#W0UcHJM&QX&25?=LfRrmA7{p`h0B)8mzPIGmo$CQn
zgt%avM;Kg<;v{B^g|ZUWS=dKcNR*j*)usPXqo9!*hV3r7w`1ECZp@avul`GfJv&9@
zOYRoH*RaveKB9Cgi;lo{Mr8nclzIcSFUAcDWOdj*9RknQ>Qh?|PV0nX^r=4$Nx3A!
zZGV9%48o~|>T(36CO;#kwk#-VD!SZtEMV_3h<jO%@Vq>P-Ammt!ec|y2uoc%!fIFx
zig$t?l<`@PPIR1BOE<h)_teem35&z1P7}-Y+nrN=&8EF_r{L@Lbc<QTBTRea1EzU)
zyLJfOP{NE2j5H$r^%>=1cQ^run@|qg#lwSkXV57}5$qM?lC2xJ{yLs|d?78GGmZ_f
z@8KCkl-t`Ey*lt6!eGRX_npj67MFw74ADfB&7ACx&4mWnq4v0{CL)~K<UE`n*%O#*
zCK*^MGO_4ue$+`UYL@IR?H^ADFIYBNTT1X8wkPg<v^lR0X2UU|%B4rG3a^C2^p&w(
z8PY@2+v)iWuct5m-AW)mJsk1hX<Ma0Kmr%~WpN{>4pdxvS}QHxN~TpZqvgJJ^NWFh
zU@RD${ksVfEiT@{QLFWV_U7X|q09d9vM+Z7<|O5q^AqpZOW9HKFoRDIO00-9BhXk@
zC5<0i8U|Jzhz`n!`VV7OYj+DfU(_h;4HqQK6>tdhx?600{^VY^z_#$Up7Aa9pYP5}
zF^&A&HcV^F#-OzmLh`K)OM$9$Hq1@YNpin(mNMsBN--D-s?P08L&Fb0f+N2NFWfNb
zde2W&56oLfzjNY;ZBtQdRiU+6$u&zx@kH%JRgH{?J>bV`E!PCh_%T>;bD`)CE7T#K
zS<H;l-ZC5)x4h54=+vDYC0zbsNS-X5Q|JAgROz`VPog5gP0?YHd4)oz`Uh<N-wNiE
z-tN(TA(NpFL*2O1B7+ly(hP|P@~iTZ?<B2gtck08lPWOtmh+8%T%JK_u&oY;nnG^J
z^^X^A`ot<ZUY|pMKXa{_gPSDVB+P&%)C9dUj$S+&>vOCXrM-;?(lt;xC+m-I<^D7x
zQ7LXT_t2uSukFr+V4o??JM;c_Uz_-*nlU`~VI0Eb`naS}VR;;1aIdElx*s^CGVQlz
zO%ZCjQMHLQweIRW^NGY5N>Ml3ZVYF<8))rOE<7L#O}sw&p#9P?^T)Yvra$g>(Sf(}
zvmuf_(EaIIHI)87d2PJJ7%A01A8Z(RX(N(u%y((-e}C){q*+L|F~`#U-2bgNuMqW5
zd3mLrFu~O97y}u4&VQtoDgXffC**Hu4uok2v13wXZeFc`lTioV<M|gXU-<ZYIAI>a
zSTOuBc9O>!6_^Hz9R>w6AaTG9!4xI`Ka&45sgLOYz%|AI#*CqsWhd1Y!wAXpbN&lI
zS2{V06aZlOPwtgRCysHHRk`^|5&&@Yaxi%A<^4j^&fEL%hhd;gPVsjv?N$AFC9n}P
HfA{_mMSQp9

diff --git a/src/Sarif.Multitool/Rules/RuleResources.Designer.cs b/src/Sarif.Multitool/Rules/RuleResources.Designer.cs
index 57d1f078c..8ecf66420 100644
--- a/src/Sarif.Multitool/Rules/RuleResources.Designer.cs
+++ b/src/Sarif.Multitool/Rules/RuleResources.Designer.cs
@@ -425,7 +425,7 @@ internal static string SARIF2002_ProvideMessageArguments_Warning_Default_Text {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to Placeholder_SARIF2003_ProvideVersionControlProvenance_FullDescription_Text.
+        ///   Looks up a localized string similar to Provide &apos;versionControlProvenance&apos; to record which version of the code was analyzed, and to enable paths to be expressed relative to the root of the repository..
         /// </summary>
         internal static string SARIF2003_ProvideVersionControlProvenance_FullDescription_Text {
             get {
@@ -434,7 +434,7 @@ internal static string SARIF2003_ProvideVersionControlProvenance_FullDescription
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to {0}: Placeholder.
+        ///   Looks up a localized string similar to {0}: This run does not provide &apos;versionControlProvenance&apos;. As a result, it is not possible to determine which version of code was analyzed, nor to map relative paths to their locations within the repository..
         /// </summary>
         internal static string SARIF2003_ProvideVersionControlProvenance_Note_Default_Text {
             get {
diff --git a/src/Sarif.Multitool/Rules/RuleResources.resx b/src/Sarif.Multitool/Rules/RuleResources.resx
index 6f2e7d0d1..5b7e7fad1 100644
--- a/src/Sarif.Multitool/Rules/RuleResources.resx
+++ b/src/Sarif.Multitool/Rules/RuleResources.resx
@@ -280,10 +280,10 @@ Many tools follow a conventional format for the 'reportingDescriptor.id' propert
     <value>{0}: The 'message' property of this result contains a 'text' property. Consider replacing it with 'id' and 'arguments' properties. This potentially reduces the log file size, allows the message text to be improved without modifying the log file, and enables localization.</value>
   </data>
   <data name="SARIF2003_ProvideVersionControlProvenance_FullDescription_Text" xml:space="preserve">
-    <value>Placeholder_SARIF2003_ProvideVersionControlProvenance_FullDescription_Text</value>
+    <value>Provide 'versionControlProvenance' to record which version of the code was analyzed, and to enable paths to be expressed relative to the root of the repository.</value>
   </data>
   <data name="SARIF2003_ProvideVersionControlProvenance_Note_Default_Text" xml:space="preserve">
-    <value>{0}: Placeholder</value>
+    <value>{0}: This run does not provide 'versionControlProvenance'. As a result, it is not possible to determine which version of code was analyzed, nor to map relative paths to their locations within the repository.</value>
   </data>
   <data name="SARIF2004_OptimizeFileSize_Warning_EliminateIdOnlyRules_Text" xml:space="preserve">
     <value>Placeholder_SARIF2004_OptimizeFileSize_Warning_EliminateIdOnlyRules_Text</value>
diff --git a/src/Sarif.Multitool/Rules/SARIF2003.ProvideVersionControlProvenance.cs b/src/Sarif.Multitool/Rules/SARIF2003.ProvideVersionControlProvenance.cs
index c36838c84..1f8bc9ffc 100644
--- a/src/Sarif.Multitool/Rules/SARIF2003.ProvideVersionControlProvenance.cs
+++ b/src/Sarif.Multitool/Rules/SARIF2003.ProvideVersionControlProvenance.cs
@@ -13,7 +13,8 @@ public class ProvideVersionControlProvenance : SarifValidationSkimmerBase
         public override string Id => RuleId.ProvideVersionControlProvenance;
 
         /// <summary>
-        /// Placeholder
+        /// Provide 'versionControlProvenance' to record which version of the code was analyzed,
+        /// and to enable paths to be expressed relative to the root of the repository.
         /// </summary>
         public override MultiformatMessageString FullDescription => new MultiformatMessageString { Text = RuleResources.SARIF2003_ProvideVersionControlProvenance_FullDescription_Text };
 
@@ -27,7 +28,9 @@ protected override void Analyze(Run run, string runPointer)
         {
             if (run.VersionControlProvenance == null || run.VersionControlProvenance.Count == 0)
             {
-                // {0}: Placeholder
+                // {0}: This run does not provide 'versionControlProvenance'. As a result, it is
+                // not possible to determine which version of code was analyzed, nor to map
+                // relative paths to their locations within the repository.
                 LogResult(
                     runPointer,
                     nameof(RuleResources.SARIF2003_ProvideVersionControlProvenance_Note_Default_Text));
diff --git a/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2003.ProvideVersionControlProvenance_Invalid.sarif b/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2003.ProvideVersionControlProvenance_Invalid.sarif
index 7a32c3e14..0361642c2 100644
--- a/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2003.ProvideVersionControlProvenance_Invalid.sarif
+++ b/src/Test.FunctionalTests.Sarif/TestData/Multitool/ValidateCommand/ExpectedOutputs/SARIF2003.ProvideVersionControlProvenance_Invalid.sarif
@@ -11,14 +11,14 @@
               "id": "SARIF2003",
               "name": "ProvideVersionControlProvenance",
               "shortDescription": {
-                "text": "Placeholder_SARIF2003_ProvideVersionControlProvenance_FullDescription_Text."
+                "text": "Provide 'versionControlProvenance' to record which version of the code was analyzed, and to enable paths to be expressed relative to the root of the repository."
               },
               "fullDescription": {
-                "text": "Placeholder_SARIF2003_ProvideVersionControlProvenance_FullDescription_Text"
+                "text": "Provide 'versionControlProvenance' to record which version of the code was analyzed, and to enable paths to be expressed relative to the root of the repository."
               },
               "messageStrings": {
                 "Note_Default": {
-                  "text": "{0}: Placeholder"
+                  "text": "{0}: This run does not provide 'versionControlProvenance'. As a result, it is not possible to determine which version of code was analyzed, nor to map relative paths to their locations within the repository."
                 }
               },
               "helpUri": "http://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html"