Unobvious "Not a branch" when lp: url resolves to https for a private branch

[Marc Tardif]

I'm using Bazaar (bzr) 1.3.1 and I'm trying to branch an existing project which happens to be private from Launchpad:

 bzr branch lp:~hardware-certification/hwtest-certify/trunk
 bzr: ERROR: Not a branch: "https://code.launchpad.net/".

The problem is simply that I did not call launchpad-login but the error message should be more obvious.

[Martin Albisetti (beuno)]

This has been fixed in bzr 1.5+

[John A Meinel (jameinel)]

Martin, I don't think it has been fixed for private branches.

The problem is that we can't really tell whether a branch exists or not if it is private and you haven't logged in.

The whole point of private branches on LP is that you shouldn't know whether they exist or not. (Otherwise you can try common names and see if something is secretly going on.) Right now there is already a bit of a security leak, in that if you browse to a "private" project, you get a 403 "Not Authorized" rather than a "404".

So I guess I don't really know what LP's official stance on private objects is. Are they meant to be completely hidden?

[John A Meinel (jameinel)]

Re-opening because this is about *private* branches, not just about the error message.

Although I do get this:
$ bzr branch lp:~hardware-certification/hwtest-certify/trunk
You have not informed bzr of your launchpad login. If you are attempting a
write operation and it fails, run "bzr launchpad-login YOUR_ID" and try again.
bzr: ERROR: Not a branch: "https://code.launchpad.net/".

The location is all wrong, and the *reason* for asking you to log-in is a bit bogus. But I suppose it does convey that to get access to your private branch you need to login.

I suppose we could put this as Fix Released if we feel that error message is good enough.