[MERGE/RFC] Add transport jail to bzr smart server; add ignore_fallbacks option to BzrDir.open_branch

[Martin Pool]

>> > Robert and I would very much like to hear other people's opinions on the
>> > explicit-flag vs. automatic-check-for-jail question, because we haven't
>> > yet been able to convince each other.
>>
>> Indeed :).
>
> This still holds!  People who aren't Robert: share your thoughts!

I'd be inclined to start with less magic and then add magic if needed.
 If I understand correctly, if we have any code paths that insist on
opening the fallbacks they will fail when run on the server, and then
we can fix those bugs.

We would still have the option later on to decide that there are so
many bugs like this that in fact it's not worth fixing them one by one
and in fact they are not individual bugs and so we want to add the
automatic behavior.

I think too that there should be relatively few places in bzr that
open a branch.  I haven't grepped, but most of them should be opening
it just once, and the calls we do have are probably in the commands
layer and so won't run on the server.  For the few we do have, it may
be good to make an explicit decision as to whether it needs them or
not.  Particularly because for performance reasons we should generally
be trying not to open fallbacks unless we really need to.

I do think it's crucially important that we guard against bugs
originating in confusion about "this branch/repository has no
fallbacks" vs "i'm doing this without thinking about fallbacks that
may or may not exist."  It would be good if in the second case any
operations that actually need the fallbacks will fail rather than
continuing as if there were none, but that's probably out of the scope
of this.

Discussion of this sort of flag reminds me that there at least used to
be too many convenience methods for opening branches...

Hope that helps.
-- 
Martin <http://launchpad.net/~mbp/>