Security/Firefox/Security Bug Life Cycle/Security Advisories: Difference between revisions

Typically done a day or two before the release, assign CVEs to the bugs in bugzilla, and in the yml file. This needs to be done by a person with CVE Services credentials and Bugzilla security access, and can be automated with the '''assign_cve_ids''' script in the [https://github.com/mozilla/foundation-security-advisories foundation-security-advisories] repository.

That script will automatically reserve a new CVEs, insert them into the yml file, and set the CVE IDs as aliases on Bugzilla. You can use it by running <tt>pip i && assign_cve_ids</tt> in the root of the repository. You can provide the required credentials through the '''CVE_USER''', '''CVE_ORG''', '''CVE_API_KEY''', '''CVE_ENV''', and '''BUGZILLA_API_KEY''' environment variables. Before running the script, make sure to set the names of the advisories that should get a CVE ID to '''MFSA-RESERVE-{YEAR}-{BUG_ID}''', where '''{YEAR}''' is the year that should be associated with the CVE, and '''{BUG_ID}''' is the id of a Bugzilla bug that should get the CVE ID as an alias. If you do not want to have a alias set for the advisory, use a small unique number instead. If you have used the [[#Generate_and_edit_the_YML_File|'''gen_yml.py''' script from the previous step]] to generate your yml file, the advisories should already have this format.