net/docs/bug-triage.md

   1 # Chrome Network Bug Triage
   2
   3 The Chrome network team uses a two day bug triage rotation. The goal is to
   4 review outstanding issues and keep things moving forward. The rotation is time
   5 based rather than objective based. Sheriffs are expected to spend the majority
   6 of their two days working on bug triage/investigation.
   7
   8 ## 1. Review untriaged bugs
   9
  10 Look through [this list of untriaged
  11 bugs](https://bugs.chromium.org/p/chromium/issues/list?sort=pri%20-stars%20-opened&q=status%3Aunconfirmed%2Cuntriaged%20-Needs%3DFeedback%20-Label%3ANetwork-Triaged%20-has:NextAction%20component%3DInternals%3ENetwork%2CInternals%3ENetwork%3ECache%2CInternals%3ENetwork%3ESSL%2CInternals%3ENetwork%3EQUIC%2CInternals%3ENetwork%3EAuth%2CInternals%3ENetwork%3EHTTP2%2CInternals%3ENetwork%3EProxy%2CInternals%3ENetwork%3ELibrary%2CInternals%3ENetwork%3ELogging%2CInternals%3ENetwork%3EConnectivity%2CInternals%3ENetwork%3EDomainSecurityPolicy%2CInternals%3ENetwork%3ETrustTokens%2CInternals%3ENetwork%3EFTP).
  12
  13 The goal is for this query to be empty. Bugs can be removed from the triage queue
  14 by doing any of the following:
  15
  16 * Changing the bug status - marking the bug Available, or closing it.
  17 * Removing the `Internals>Network` component or subcomponent.
  18 * Adding the label `Network-Triaged` (when there are multiple components).
  19
  20 For each bug try to:
  21
  22 * Remove the `Internals>Network` component or subcomponent if it belongs
  23   elsewhere
  24 * Dupe it against an existing bug
  25 * Close it as `WontFix`.
  26 * Give the bug a priority. Refer to [this document for guidelines](https://docs.google.com/document/d/1JOtp1LS7suqTjMuv41jQFc7aCTR33zJKPoGjKpvVFCA)
  27 * If the bug is a potential security issue (Allows for code execution from remote
  28   site, allows crossing security boundaries, unchecked array bounds, etc) mark
  29   it `Type-Bug-Security`.
  30 * If the bug has privacy implications mark it with component `Privacy`.
  31 * Set the type to `Task` or `Feature` when it is not a bug.
  32 * Pay extra attention to possible regressions. Ask the reporter to narrow down using
  33   [bisect-builds-py](https://www.chromium.org/developers/bisect-builds-py). To
  34   view suspicious changelists in a regression window, you can use the Change Log
  35   form on [OmahaProxy](https://omahaproxy.appspot.com/)
  36 * CC others who may be able to help
  37 * Mark it as `Needs-Feedback` and request more information if needed.
  38 * In cases where the bug has multiple components, but primary ownership falls
  39   outside of networking, further network triage may not be possible. In those
  40   cases, if possible remove the networking component. Otherwise, add the
  41   `Network-Triaged` label to the bug, and add a comment explaining which team
  42   should triage further. Adding the `Network-Triaged` serves to filter the
  43   bug from our untriaged bug list.
  44 * Avoid spending time deep-diving into ambiguous issues when you suspect it is
  45   an out of scope server or network problem, and is not clearly high priority
  46   (for instance, it affects only 1 user and is not a regression).
  47   Instead:
  48   * Mark the bug as `Available` with Priority 3.
  49   * Add the `Needs-Feedback` label
  50   * Add a comment thanking the reporter, but explaining the issue is ambiguous
  51     and they need to do the debugging to demonstrate it is an actual Chrome bug.
  52     * Point them to `chrome://net-export` and the
  53       [NetLog Viewer](https://netlog-viewer.appspot.com/).
  54     * Ask them to confirm whether it is a Chromium regression. (Regressions are
  55       treated as high priority)
  56 * Request a NetLog that captures the problem. You can paste this on the bug:
  57   ```
  58   Please collect and attach a chrome://net-export log.
  59   Instructions can be found here:
  60   https://chromium.org/for-testers/providing-network-details
  61   ```
  62 * If a NetLog was provided, try to spend a bit of time reviewing it. See
  63   [crash-course-in-net-internals.md](crash-course-in-net-internals.md) for an
  64   introduction.
  65 * Move to a subcomponent of `Internals>Network` if appropriate. See
  66   [bug-triage-labels.md](bug-triage-labels.md) for an overview of the components.
  67 * If the bug is a crash, see [internal: Dealing with a crash
  68   ID](https://goto.google.com/network_triage_internal#dealing-with-a-crash-id)
  69 and [internal: Investigating
  70 crashers](https://goto.google.com/network_triage_internal#investigating-crashers)
  71
  72 ## 2. Follow-up on issues with the Needs-Feedback label
  73
  74 Look through [this list of Needs=Feedback
  75 bugs](https://bugs.chromium.org/p/chromium/issues/list?sort=-modified%20-modified&q=Needs%3DFeedback%20component%3DInternals%3ENetwork%2CInternals%3ENetwork%3ECache%2CInternals%3ENetwork%3ESSL%2CInternals%3ENetwork%3EQUIC%2CInternals%3ENetwork%3EAuth%2CInternals%3ENetwork%3EHTTP2%2CInternals%3ENetwork%3EProxy%2CInternals%3ENetwork%3ELibrary%2CInternals%3ENetwork%3ELogging%2CInternals%3ENetwork%3EConnectivity%2CInternals%3ENetwork%3EDomainSecurityPolicy%2CInternals%3ENetwork%3ETrustTokens%2CInternals%3ENetwork%3EFTP).
  76
  77 * If the requested feedback was provided, review the new information and repeat
  78   the same steps as (1) to re-triage based on the new information.
  79 * If the bug had the `Needs-Feedback` label for over 30 days, and the
  80   feedback needed to make progress was not yet provided, archive the bug.
  81
  82 ## 3. Ensure P0 and P1 bugs have an owner
  83
  84 Look through [the list of unowned high priority
  85 bugs](https://bugs.chromium.org/p/chromium/issues/list?sort=pri%20-stars%20-opened&q=Pri%3A0%2C1%20-has%3Aowner%20-label%3ANetwork-Triaged%20component%3DInternals%3ENetwork%2CInternals%3ENetwork%3ECache%2CInternals%3ENetwork%3ESSL%2CInternals%3ENetwork%3EQUIC%2CInternals%3ENetwork%3EAuth%2CInternals%3ENetwork%3EHTTP2%2CInternals%3ENetwork%3EProxy%2CInternals%3ENetwork%3ELibrary%2CInternals%3ENetwork%3ELogging%2CInternals%3ENetwork%3EConnectivity%2CInternals%3ENetwork%3EDomainSecurityPolicy%2CInternals%3ENetwork%3ETrustTokens%2CInternals%3ENetwork%3EFTP).
  86 These bugs should either have an owner, or be downgraded to a lower priority.
  87
  88 ## 4. (Optional) Look through crash reports
  89
  90 Top crashes will already be entered into the bug system by a different process,
  91 so will be handled by the triage steps above.
  92
  93 However if you have time to look through lower threshold crashes, see
  94 [internal: Looking for new crashers](https://goto.google.com/network_triage_internal#looking-for-new-crashers)
  95
  96 ## 5. Send out a sheriff report
  97
  98 On the final day of your rotation, send a brief summary to net-dev@chromium.org
  99 detailing any interesting or concerning trends. Do not discuss any restricted
 100 bugs on the public mailing list.
 101
 102 ## Covered bug components
 103
 104 Not all of the subcomponents of `Interals>Network` are handled by this rotation.
 105
 106 The ones that are included are:
 107
 108 ```
 109 Internals>Network
 110 Internals>Network>Auth
 111 Internals>Network>Cache
 112 Internals>Network>Connectivity
 113 Internals>Network>DomainSecurityPolicy
 114 Internals>Network>FTP
 115 Internals>Network>HTTP2
 116 Internals>Network>Library
 117 Internals>Network>Logging
 118 Internals>Network>Proxy
 119 Internals>Network>QUIC
 120 Internals>Network>SSL
 121 Internals>Network>TrustTokens
 122 ```
 123
 124 The rest of the `Internals>Network` subcomponents are out of scope,
 125 and covered by separate rotations:
 126
 127 ```
 128 Internals>Network>Certificate
 129 Internals>Network>CertTrans
 130 Internals>Network>Cookies
 131 Internals>Network>DataProxy
 132 Internals>Network>DataUse
 133 Internals>Network>DNS
 134 Internals>Network>DoH
 135 Internals>Network>EV
 136 Internals>Network>NetInfo
 137 Internals>Network>NetworkQuality
 138 Internals>Network>ReportingAndNEL
 139 Internals>Network>VPN
 140 ```
 141
 142 ## Management
 143
 144 * Your rotation will appear in Google Calendar as two days. You are expected to
 145   work on it full-time (as best you can) during those calendar days, during your
 146   ordinary working hours.
 147
 148 * Google Calendar [google.com_52n2p39ad82hah9v7j26vek830@group.calendar.google.com](https://calendar.google.com/calendar/embed?src=google.com_52n2p39ad82hah9v7j26vek830%40group.calendar.google.com&ctz=America%2FLos_Angeles)
 149
 150 * Owners for the network bug triage rotation can find instructions on
 151 generating and modifying shifts
 152 [here (internal-only)](https://goto.google.com/pflvb).
 153
 154 * An overview of bug trends can be seen on [Chromium
 155   Dashboard](https://chromiumdash.appspot.com/components/Internals/Network?project=Chromium)
 156
 157 * There is also an [internal dashboard with bug trends for Web
 158   Platform](https://goto.google.com/vufyq) that includes network issues.
 159
 160 * The issue tracker doesn't track any official mappings between components and
 161   OWNERS. This [internal document](https://goto.google.com/kojfj) enumerates
 162   the known owners for subcomponents.
 163
 164 * [Web Platform Team SLOs](https://docs.google.com/document/d/18ylPve6jd43m8B7Dil6xmS4G9MHL2_DhQon72je-O9o/edit)
 165
 166 * [Web Platform bug triage guidelines](https://docs.google.com/document/d/1JOtp1LS7suqTjMuv41jQFc7aCTR33zJKPoGjKpvVFCA)