bzr branches should be private by default if linked to a private bug

[Mathias Gug]

While pushing a bzr branch for an Ubuntu package scheduled to be uploaded as a Stable Release Update (https://code.launchpad.net/~ccheney/ubuntu/lucid/eucalyptus/lucid-sru), it turned out that the branch included a fix for a private bug (bug 579942). It would be useful to have the bzr branch marked as private by default if linked to at least one private bug in order to avoid leaking security fixes.

[Robert Collins (lifeless)]

This is actually a very complex thing:
 - we don't know if a branch is linked to a bug in a revision until we scan the branch
 - branches are (currently) made public|private by a policy on creation
 - so there is a huge race condition :) the branch could be public for 5-10 minutes before a revision is found that links it to a private bug

Secondly, the obvious route to implementation will let any branch be made private at any point in time, with no way for this to be undone (outside of projects that have a commercial subscription for private branches).

I think this probably needs a LEP all of its own, to cover off the corner cases and UI complications.

[Martin Pool (mbp)]

I believe there is a separate bug about letting the bzr client set the
policy when it first creates the branch. (There may already be an API
and all that's needed is a client ui.)

Possibly fixing that would satisfy the underlying case.

If we do want to do the bug/branch check then we could do it on the
bzr client, though that might have a performance cost to check all
related bugs.

Martin

[Robert Collins (lifeless)]

So, I'm going to wontfix this in LP, all things considered: let bzr make branches private on push and I think users will be happy; bzr could even enforce this particular request itself. I'll add a bzr task for that.