Security/Firefox/Security Bug Life Cycle: Difference between revisions

Testcases for vulnerability fixes should be split into a separate patch for this "sec-approval" process. These testcases should land ''after'' we have shipped the fix in Release, usually by a few weeks to give users time to have applied the update. We '''must''' track the task of landing these patches later. You have two main options and either is fine. A task bug is more upfront work but more straightforward; the flag is easy but requires more follow-up.

# Create a task bug assigned to yourself ("Land tests for bug XXXX") that depends on the vulnerability bug. It must be a hidden security bug like the main vulnerability. Add the keyword '''sec-other'''

# Or, track it in the original bug using the '''in-testsuite?''' flag. If you go this route you must remember to check for un-landed tests (queries below). Once the tests are landed change the flag to '''in-testsuite+'''.