View source for SecurityEngineering/PSM Bug Triage

== Bug Triage in PSM ==
PSM essentially consists of Gecko code in [https://dxr.mozilla.org/mozilla-central/source/security security/] that is not in any of the subdirectories [https://dxr.mozilla.org/mozilla-central/source/security/nss nss/], [https://dxr.mozilla.org/mozilla-central/source/security/patches patches/], or [https://dxr.mozilla.org/mozilla-central/source/security/sandbox sandbox/]. The Bugzilla product/component for PSM is [https://bugzilla.mozilla.org/buglist.cgi?resolution=---&query_format=advanced&component=Security%3A%20PSM&product=Core Core :: Security: PSM].

For team interoperability, PSM follows the new standardized [[Bugmasters/Process/Triage|Triage]] process. In short, every new bug should either be prioritized as P1, P2, P3, or P5, moved to a different component, or needinfo should be requested from someone. P1 means the bug should be fixed before the current Nightly branches to Beta (and even uplifted as appropriate). P2 means the bug will be worked on "next" (basically, after P1s are taken care of). P3 means the bug is in the "should be fixed" backlog. Tracking or meta bugs are also P3. P5 is for bugs where patches would be reviewed and taken from contributors if appropriate, but otherwise won't be worked on. If a bug has had an unanswered needinfo flag for more than 2 weeks, it should be reevaluated (closing as incomplete, needinfo-ing another person, etc.). Similarly, if a P1 bug has no activity for 2 weeks, its priority should be revisited.

After branching, bug priorities should be revisited. If a P1 is still open, it either needs to be deprioritized (maybe it isn't really a P1) or whatever is blocking its completion needs to be identified and dealt with. P2s and P3s should be considered for promotion to a higher priority. Assignees should be found for any bugs promoted to P1.

This is the list of [https://bugzilla.mozilla.org/buglist.cgi?product=Core&component=Security%3A%20PSM&priority=--&n1=1&f1=flagtypes.name&o1=substring&v1=needinfo&resolution=---&chfield=&#91;Bug%20creation&#93;&chfieldto=Now&query_format=advanced&chfieldfrom=2016-06-01 untriaged bugs] according to the new process.

This is the list of [https://bugzilla.mozilla.org/buglist.cgi?product=Core&component=Security%3A%20PSM&f1=flagtypes.name&o1=substring&v1=needinfo&f2=delta_ts&o2=lessthan&v2=14d&resolution=---&query_format=advanced bugs waiting on needinfo for more than 2 weeks] according to the new process.

Internally, PSM makes use of a number of whiteboard tags for organizational and prioritization purposes. They are as follows:

* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-assigned&#93; &#91;psm-assigned&#93;] are bugs that currently have an assignee. These should all be P1. Ideally there will always be consistent progress on these bugs until they are resolved. If this is not the case, their priority should be reconsidered or any blocking issues should be addressed.
* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-backlog&#93; &#91;psm-backlog&#93;] consists of the backlog of bugs we should fix in PSM. These should all be P2 or P3. If they are P1, they should have an assignee and the tag should be &#91;psm-assigned&#93;.
* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-cleanup&#93; &#91;psm-cleanup&#93;] consists of code maintenance bugs that would make development easier, but don't directly impact functionality. These are probably mostly P3 or P5.
* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-tracking&#93; &#91;psm-tracking&#93;] are meta bugs that track larger work. These should all be P3.
* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-deprecation&#93; &#91;psm-deprecation&#93;] are bugs that involve deprecating weak cryptography
* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-clientauth&#93; &#91;psm-clientauth&#93;] consists of bugs involved with TLS client authentication
* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-smartcard&#93; &#91;psm-smartcard&#93;] are bugs involving PKCS#11 devices
* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-documentation&#93; &#91;psm-documentation&#93;] are bugs on writing or improving PSM documentation
* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-waiting&#93; &#91;psm-waiting&#93;] are bugs that are waiting on some external input
* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-blocked&#93; &#91;psm-blocked&#93;] are bugs that are blocked on other work
* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-intermittent&#93; &#91;psm-intermittent&#93;] are bugs filed for intermittently failing tests in PSM
* [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=&#91;psm-would-take&#93; &#91;psm-would-take&#93;] are bugs where we would review patches from contributors, but otherwise we won't be working on them. These should be P5.

These are the [https://bugzilla.mozilla.org/buglist.cgi?cmdtype=runnamed&namedcmd=psm-untriaged remaining untriaged bugs] with respect to internal bug management.