Forbid uncommits over the network

[Jelmer Vernooij]

Lasse Kliemann wrote:
> The uncommit feature makes me worried. I very much learned to 
> appreciate Subversion's policy that revisions are immutable. This 
> makes a central repository which is accessible only over the 
> network a well-organized append-only storage and thus a superb 
> backup infrastructure for many applications.
> 
> I read that uncommitted revisions in Bazaar are not lost; they 
> can be restored by a pull when one knows their id. The uncommit 
> command even prints that information after successful operation.  
> However, in order to restore something, one has to know that it 
> was lost in the first place. Yet commit logs do not show 
> uncommits. There is a command 'bzr heads --dead-only' in 
> Bzrtools, which could be used. However, one would have to use 
> that regularly to check whether there happened any unwanted 
> uncommits. Moreover, as I found out, on a branch or checkout that 
> was created after the uncommit, even the 'heads' command does not 
> show the uncommitted revision.
> 
> The easiest would perhaps be to add a '--disallow-uncommit' 
> option, or such, to the Bazaar smart server.
> 
> I think that *local* uncommits are a nice feature. But it should 
> be possible to configure a central repository in a way that a 
> revision is immutable once pushed or committed to it. This might 
> lead to a conflicting situation when a user locally uncommits 
> beyond a revision that already has been sent to such a server. 
> Maybe a warning could be displayed in such a case. 
> 
> What are your thoughts on this?
You can set the "append_revisions_only" setting in the branches' config
to disallow revisions being removed from the mainline. This also
prevents uncommits I think (or at least it should).

Cheers,

Jelmer