bundle: prevent implicite bundling of internal changeset

Now that the two mains source of on-disk bundle are preventing the inclusion of
internal changesets in their bundling. We can add a lower level check that
would prevent any other leakage of internal-phase changesets.

We keep the door open to some usage, like the temporary bundle using during
strip for example.

mercurial/bundle2.py

@@ -1703,6 +1703,7 b' def writenewbundle('
     vfs=None,
     compression=None,
     compopts=None,
+    allow_internal=False,
 ):
     if bundletype.startswith(b'HG10'):
         cg = changegroup.makechangegroup(repo, outgoing, b'01', source)
@@ -1718,6 +1719,14 b' def writenewbundle('
     elif not bundletype.startswith(b'HG20'):
         raise error.ProgrammingError(b'unknown bundle type: %s' % bundletype)
 
+    # enforce that no internal phase are to be bundled
+    bundled_internal = repo.revs(b"%ln and _internal()", outgoing.ancestorsof)
+    if bundled_internal and not allow_internal:
+        count = len(repo.revs(b'%ln and _internal()', outgoing.missing))
+        msg = "backup bundle would contains %d internal changesets"
+        msg %= count
+        raise error.ProgrammingError(msg)
+
     caps = {}
     if opts.get(b'obsolescence', False):
         caps[b'obsmarkers'] = (b'V1',)

mercurial/repair.py

@@ -36,7 +36,14 b' from .utils import ('
 
 
 def backupbundle(
-    repo, bases, heads, node, suffix, compress=True, obsolescence=True
+    repo,
+    bases,
+    heads,
+    node,
+    suffix,
+    compress=True,
+    obsolescence=True,
+    tmp_backup=False,
 ):
     """create a bundle with the specified revisions as a backup"""
 
@@ -83,6 +90,7 b' def backupbundle('
         contentopts,
         vfs,
         compression=comp,
+        allow_internal=tmp_backup,
     )
 
 
@@ -199,6 +207,7 b' def strip(ui, repo, nodelist, backup=Tru'
             b'temp',
             compress=False,
             obsolescence=False,
+            tmp_backup=True,
         )
 
     with ui.uninterruptible():