Security/Firefox/Security Bug Life Cycle/Security Advisories: Difference between revisions

Security/Firefox/Security Bug Life Cycle/Security Advisories (view source)

Revision as of 20:06, 14 November 2019

184 bytes added , 14 November 2019

→‎Tag them

Tritter

124

edits

@@ Line 24: / Line 24: @@
 ==== Tag them ====
-# Query for bugs using the status-firefoxXX (with the release number) flag that are marked as “verified” or “fixed” that also do not have the status-firefoxXY flag for the previous release set to “fixed”, “verified”, “unaffected”, or “disabled” in bugzilla. Additionally, we query on whether the bugs have a “sec-” keyword or are in any security group in Bugzilla. TODO: Link to query generator
+# Query for bugs using the status-firefoxXX (with the release number) flag that are marked as “verified” or “fixed” that also do not have the status-firefoxXY flag for the previous release set to “fixed”, “verified”, “unaffected”, or “disabled” in bugzilla. Additionally, we query on whether the bugs have a “sec-” keyword or are in any security group in Bugzilla. [https://github.com/tomrittervg/secadv/blob/master/gen_queries.py I use a script that generates the bugzilla query for a given version.]  For example <tt>./gen_queries.py 71</tt> or <tt>./gen_queries.py 71 -v</tt>
 # For each bug, decide on an advisory, marking it with a whiteboard tag. A missing whiteboard tag helps us notice when new fixes land late in the release cycle, and in the future the whiteboard tag is useful for tracking when a vulnerability received an advisory.
 ## The whiteboard of the bug is tagged with [adv-mainXX+], [adv-mainXX-], [adv-ESRXX.X+], or [adv-ESRXX.X-] to mark whether an advisory is being created (a ‘+’) or explicitly not being created (a ‘-’) for a given Firefox or Firefox ESR release.