wgrant, got it. I guess we have 2 options in this case:
1- We don't add at all the the `refs/merge/<xxx>` if the source repository is private; or 2- We do extra permission checks on refs on Turnip on every operation, and not only pushes as it seems to be implemented today. The first option brings some complexity in terms of changing a repository to/from private after the virtual ref is already created, but is simple to implement. I prefer the second option, as it seems cleaner and better for the long term IMHO, although it might require (a small) extra implementation effort now. Any thoughts on this? -- https://code.launchpad.net/~pappacena/launchpad/+git/launchpad/+merge/390581 Your team Launchpad code reviewers is requested to review the proposed merge of ~pappacena/launchpad:create-mp-refs into launchpad:master. _______________________________________________ Mailing list: https://launchpad.net/~launchpad-reviewers Post to : [email protected] Unsubscribe : https://launchpad.net/~launchpad-reviewers More help : https://help.launchpad.net/ListHelp
