Merge ~lgp171188/launchpad:enforce-stricter-permission-check-when-a-bug-is-locked-down into launchpad:master

[Guruprasad]

* Add lock_status, lock_reason fields and lock, unlock methods to Bug
* Add a ModerateBug security adapter for IBugModerate

  This adapter uses the 'launchpad.Moderate' permission to allow users
  to lock and unlock a bug.
* Create bug change entries when locking and unlocking a bug
* Allow only the relevant roles to edit a locked bug
* Add unit tests for the previous changes related to bug (un)locking
* Add the updated sample data with the new fields
* Add the garbo job for backfilling lock_status

[Colin Watson (cjwatson)]

Thanks for working on this!

Having read this, I think I'd in fact prefer you to revert the sampledata changes from this MP. We need to make sure that we run tests on a database that has some rows with NULL lock_status, in order to avoid transitional mistakes. Sampledata can be updated once garbo has run.

Could you add screenshots of what (a) the ordinary bug log (i.e. what you see if you just load the bug's default web page) and the +activity page for the bug look like for a bug that has been locked? There are some fiddly interactions here, and I'd like to make sure that both of them come out looking reasonable.

review: Needs Fixing

[Colin Watson (cjwatson)]

Thanks for these updates. There are a few more things to fix (especially issues around the garbo job), but I think it's nearly there now.

review: Approve

diff --git a/lib/lp/bugs/adapters/bugchange.py b/lib/lp/bugs/adapters/bugchange.py
index ba0e99a..234cc0e 100644
--- a/lib/lp/bugs/adapters/bugchange.py
+++ b/lib/lp/bugs/adapters/bugchange.py
@@ -1,4 +1,4 @@
-# Copyright 2009-2016 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2022 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Implementations for bug changes."""
@@ -17,6 +17,8 @@ __all__ = [
     'BugDescriptionChange',
     'BugDuplicateChange',
     'BugInformationTypeChange',
+    'BugLocked',
+    'BugLockReasonSet',
     'BugTagsChange',
     'BugTaskAdded',
     'BugTaskAssigneeChange',
@@ -27,6 +29,7 @@ __all__ = [
     'BugTaskStatusChange',
     'BugTaskTargetChange',
     'BugTitleChange',
+    'BugUnlocked',
     'BugWatchAdded',
     'BugWatchRemoved',
     'CHANGED_DUPLICATE_MARKER',
@@ -52,7 +55,10 @@ from textwrap import dedent
 from zope.interface import implementer
 from zope.security.proxy import isinstance as zope_isinstance
 
-from lp.bugs.enums import BugNotificationLevel
+from lp.bugs.enums import (
+    BugLockStatus,
+    BugNotificationLevel,
+    )
 from lp.bugs.interfaces.bugchange import IBugChange
 from lp.bugs.interfaces.bugtask import (
     IBugTask,
@@ -735,6 +741,88 @@ class CveUnlinkedFromBug(BugChangeBase):
         return {'text': "** CVE removed: %s" % self.cve.url}
 
 
+class BugLocked(BugChangeBase):
+    """Used to represent the locking of a bug."""
+
+    def __init__(self, when, person, old_status,
+                 new_status, reason, **kwargs):
+        super().__init__(when, person)
+        self.old_status = old_status
+        self.new_status = new_status
+        self.reason = reason
+
+    def getBugActivity(self):
+        """See `IBugChange'."""
+        activity = dict(
+            whatchanged='lock status',
+            oldvalue=str(self.old_status),
+            newvalue=str(self.new_status),
+        )
+        if self.reason:
+            activity['message'] = self.reason
+
+        return activity
+
+    def getBugNotification(self):
+        """See `IBugChange`."""
+        text = "** Bug metadata locked and limited to project staff"
+        if self.reason:
+            text = "{}: {}".format(text, self.reason)
+
+        return {
+            'text': text
+        }
+
+class BugUnlocked(BugChangeBase):
+    """Used to represent the unlocking of a bug."""
+
+    def __init__(self, when, person, old_status, **kwargs):
+        super().__init__(when, person)
+        self.old_status = old_status
+
+    def getBugActivity(self):
+        """See `IBugChange'."""
+        return dict(
+            whatchanged='lock status',
+            newvalue=str(BugLockStatus.UNLOCKED),
+            oldvalue=str(self.old_status),
+        )
+
+    def getBugNotification(self):
+        """See `IBugChange`."""
+        return {
+            'text': "** Bug unlocked"
+        }
+
+
+class BugLockReasonSet(BugChangeBase):
+    """Used to represent setting of the Bug.lock_reason field."""
+
+    def __init__(self, when, person, old_reason, new_reason, **kwargs):
+        super().__init__(when, person)
+        self.old_reason = old_reason
+        self.new_reason = new_reason
+
+    def getBugActivity(self):
+        """See `IBugChange`."""
+        return dict(
+            whatchanged='lock reason',
+            oldvalue=self.old_reason if self.old_reason else 'unset',
+            newvalue=self.new_reason if self.new_reason else 'unset',
+        )
+
+    def getBugNotification(self):
+        """See `IBugChange`."""
+        if self.new_reason is None:
+            text = "Bug lock reason unset"
+        else:
+            text = '** Bug lock reason changed: {}'.format(self.new_reason)
+
+        return {
+            'text': text
+        }
+
+
 class BugTaskAttributeChange(AttributeChange):
     """Used to represent a change in a BugTask's attributes.
 
diff --git a/lib/lp/bugs/browser/bugtask.py b/lib/lp/bugs/browser/bugtask.py
index 1ae7e7c..76e1bb8 100644
--- a/lib/lp/bugs/browser/bugtask.py
+++ b/lib/lp/bugs/browser/bugtask.py
@@ -1,4 +1,4 @@
-# Copyright 2009-2021 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2022 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """IBugTask-related browser views."""
@@ -110,6 +110,7 @@ from lp.bugs.browser.widgets.bugtask import (
     BugTaskTargetWidget,
     DBItemDisplayWidget,
     )
+from lp.bugs.enums import BugLockStatus
 from lp.bugs.interfaces.bug import (
     IBug,
     IBugSet,
@@ -591,7 +592,7 @@ class BugTaskView(LaunchpadView, BugViewMixin, FeedsMixin):
             activity = self.context.bug.activity
         bug_change_re = (
             'affects|description|security vulnerability|information type|'
-            'summary|tags|visibility|bug task deleted')
+            'summary|tags|visibility|bug task deleted|lock status|lock reason')
         bugtask_change_re = (
             r'[a-z0-9][a-z0-9\+\.\-]+( \([A-Za-z0-9\s]+\))?: '
             r'(assignee|importance|milestone|status)')
@@ -2540,6 +2541,29 @@ class BugActivityItem:
                 else:
                     return_dict[key] = html_escape(return_dict[key])
 
+        elif attribute == 'lock status':
+            if self.newvalue == str(BugLockStatus.COMMENT_ONLY):
+                reason = " "
+                detail = (
+                    'Metadata changes locked{}and '
+                    'limited to project staff'
+                )
+                if self.message:
+                    reason = " ({}) ".format(html_escape(self.message))
+                return detail.format(reason)
+            else:
+                return 'Metadata changes unlocked'
+        elif attribute == 'lock reason':
+            if self.newvalue != "unset" and self.oldvalue != "unset":
+                # return a proper message with old and new values
+                return "{} → {}".format(
+                    html_escape(self.oldvalue), html_escape(self.newvalue)
+                )
+                pass
+            elif self.newvalue != "unset":
+                return "{}".format(self.newvalue)
+            else:
+                return "Unset"
         elif attribute == 'milestone':
             for key in return_dict:
                 if return_dict[key] is None:
diff --git a/lib/lp/bugs/browser/tests/bug-views.txt b/lib/lp/bugs/browser/tests/bug-views.txt
index 705ab03..ca716c2 100644
--- a/lib/lp/bugs/browser/tests/bug-views.txt
+++ b/lib/lp/bugs/browser/tests/bug-views.txt
@@ -692,8 +692,14 @@ for a bug, ordered by date.
 First, some set-up.
 
     >>> import pytz
-    >>> from datetime import datetime
-    >>> from lp.bugs.adapters.bugchange import BugTitleChange
+    >>> from datetime import datetime, timedelta
+    >>> from lp.bugs.adapters.bugchange import (
+    ...     BugLocked,
+    ...     BugLockReasonSet,
+    ...     BugTitleChange,
+    ...     BugUnlocked,
+    ... )
+    >>> from lp.bugs.enums import BugLockStatus
     >>> nowish = datetime(
     ...     2009, 3, 26, 21, 37, 45, tzinfo=pytz.timezone('UTC'))
 
@@ -705,6 +711,27 @@ First, some set-up.
     ...     old_value=bug.title, new_value="A new bug title")
     >>> bug.addChange(title_change)
 
+    >>> nowish = nowish + timedelta(days=1)
+    >>> locked = BugLocked(
+    ...     when=nowish,
+    ...     person=foo_bar, old_status=BugLockStatus.UNLOCKED,
+    ...     new_status=BugLockStatus.COMMENT_ONLY, reason='too hot')
+    >>> bug.addChange(locked)
+    >>> nowish = nowish + timedelta(days=1)
+    >>> lock_reason_updated = BugLockReasonSet(
+    ...     when=nowish, person=foo_bar, old_reason='too hot',
+    ...     new_reason='too hot!')
+    >>> bug.addChange(lock_reason_updated)
+    >>> nowish = nowish + timedelta(days=1)
+    >>> lock_reason_unset = BugLockReasonSet(
+    ...     when=nowish, person=foo_bar, old_reason='too hot!',
+    ...     new_reason=None)
+    >>> bug.addChange(lock_reason_unset)
+    >>> nowish = nowish + timedelta(days=1)
+    >>> unlocked = BugUnlocked(
+    ...     when=nowish, person=foo_bar,
+    ...     old_status=BugLockStatus.COMMENT_ONLY)
+    >>> bug.addChange(unlocked)
     >>> request = LaunchpadTestRequest(
     ...     method="POST",
     ...     form={'field.subject': bug.title,
@@ -775,6 +802,18 @@ order, the comments and activity that have taken place on a bug.
     Changed:
     * summary: A bug title => A new bug title
     -- name16 --
+    Changed:
+    * lock status: Unlocked => Comment-only
+    -- name16 --
+    Changed:
+    * lock reason: too hot => too hot!
+    -- name16 --
+    Changed:
+    * lock reason: too hot! => unset
+    -- name16 --
+    Changed:
+    * lock status: Comment-only => Unlocked
+    -- name16 --
     A comment, for the reading of.
     Changed in testproduct:
     * status: New => Confirmed
@@ -809,6 +848,18 @@ grouped with that comment.
     Changed:
     * summary: A bug title => A new bug title
     -- name16 --
+    Changed:
+    * lock status: Unlocked => Comment-only
+    -- name16 --
+    Changed:
+    * lock reason: too hot => too hot!
+    -- name16 --
+    Changed:
+    * lock reason: too hot! => unset
+    -- name16 --
+    Changed:
+    * lock status: Comment-only => Unlocked
+    -- name16 --
     A comment, for the reading of.
     -- name16 --
     I triaged it.
diff --git a/lib/lp/bugs/browser/tests/test_bugtask.py b/lib/lp/bugs/browser/tests/test_bugtask.py
index d53dd1b..f47860e 100644
--- a/lib/lp/bugs/browser/tests/test_bugtask.py
+++ b/lib/lp/bugs/browser/tests/test_bugtask.py
@@ -1,4 +1,4 @@
-# Copyright 2009-2021 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2022 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 from datetime import (
@@ -42,7 +42,10 @@ from lp.bugs.browser.bugtask import (
     BugTasksNominationsView,
     BugTasksTableView,
     )
-from lp.bugs.enums import BugNotificationLevel
+from lp.bugs.enums import (
+    BugLockStatus,
+    BugNotificationLevel,
+    )
 from lp.bugs.feed.bug import PersonBugsFeed
 from lp.bugs.interfaces.bugactivity import IBugActivitySet
 from lp.bugs.interfaces.bugnomination import IBugNomination
@@ -1886,6 +1889,91 @@ class TestBugActivityItem(TestCaseWithFactory):
             "- foo<br />+ bar &amp;&lt;&gt;",
             BugActivityItem(bug.activity[-1]).change_details)
 
+    def test_change_details_bug_locked_with_reason(self):
+        target = self.factory.makeProduct()
+        bug = self.factory.makeBug(owner=target.owner, target=target)
+        with person_logged_in(target.owner):
+            bug.lock(
+                status=BugLockStatus.COMMENT_ONLY,
+                who=target.owner,
+                reason='too hot'
+            )
+        self.assertEqual(
+            'Metadata changes locked (too hot) and limited to project staff',
+            BugActivityItem(bug.activity[-1]).change_details
+        )
+
+    def test_change_details_bug_locked_without_reason(self):
+        target = self.factory.makeProduct()
+        bug = self.factory.makeBug(owner=target.owner, target=target)
+        with person_logged_in(target.owner):
+            bug.lock(
+                status=BugLockStatus.COMMENT_ONLY,
+                who=target.owner,
+            )
+        self.assertEqual(
+            'Metadata changes locked and limited to project staff',
+            BugActivityItem(bug.activity[-1]).change_details
+        )
+
+    def test_change_details_bug_unlocked(self):
+        target = self.factory.makeProduct()
+        bug = self.factory.makeBug(owner=target.owner, target=target)
+        with person_logged_in(target.owner):
+            bug.lock(
+                status=BugLockStatus.COMMENT_ONLY,
+                who=target.owner,
+            )
+            bug.unlock(who=target.owner)
+        self.assertEqual(
+            'Metadata changes unlocked',
+            BugActivityItem(bug.activity[-1]).change_details
+        )
+
+    def test_change_details_bug_lock_reason_set(self):
+        target = self.factory.makeProduct()
+        bug = self.factory.makeBug(owner=target.owner, target=target)
+        with person_logged_in(target.owner):
+            bug.lock(
+                status=BugLockStatus.COMMENT_ONLY,
+                who=target.owner,
+            )
+            bug.setLockReason('too hot', who=target.owner)
+        self.assertEqual(
+            'too hot',
+            BugActivityItem(bug.activity[-1]).change_details
+        )
+
+    def test_change_details_bug_lock_reason_updated(self):
+        target = self.factory.makeProduct()
+        bug = self.factory.makeBug(owner=target.owner, target=target)
+        with person_logged_in(target.owner):
+            bug.lock(
+                status=BugLockStatus.COMMENT_ONLY,
+                who=target.owner,
+                reason='too hot',
+            )
+            bug.setLockReason('too hot!', who=target.owner)
+        self.assertEqual(
+            'too hot &rarr; too hot!',
+            BugActivityItem(bug.activity[-1]).change_details
+        )
+
+    def test_change_details_bug_lock_reason_unset(self):
+        target = self.factory.makeProduct()
+        bug = self.factory.makeBug(owner=target.owner, target=target)
+        with person_logged_in(target.owner):
+            bug.lock(
+                status=BugLockStatus.COMMENT_ONLY,
+                who=target.owner,
+                reason='too hot',
+            )
+            bug.setLockReason(None, who=target.owner)
+        self.assertEqual(
+            'Unset',
+            BugActivityItem(bug.activity[-1]).change_details
+        )
+
 
 class TestCommentCollapseVisibility(TestCaseWithFactory):
     """Test for the conditions around display of collapsed/hidden comments."""
diff --git a/lib/lp/bugs/configure.zcml b/lib/lp/bugs/configure.zcml
index 5b46af7..33f6685 100644
--- a/lib/lp/bugs/configure.zcml
+++ b/lib/lp/bugs/configure.zcml
@@ -1,4 +1,4 @@
-<!-- Copyright 2009-2021 Canonical Ltd.  This software is licensed under the
+<!-- Copyright 2009-2022 Canonical Ltd.  This software is licensed under the
      GNU Affero General Public License version 3 (see the file LICENSE).
 -->
 
@@ -740,6 +740,10 @@
                     tags
                     title
                     description"/>
+            <require
+                permission="launchpad.Moderate"
+                interface="lp.bugs.interfaces.bug.IBugModerate"
+                set_attributes="lock_reason"/>
         </class>
         <adapter
             for="lp.bugs.interfaces.bug.IBug"
diff --git a/lib/lp/bugs/enums.py b/lib/lp/bugs/enums.py
index 6290763..913e1bf 100644
--- a/lib/lp/bugs/enums.py
+++ b/lib/lp/bugs/enums.py
@@ -1,9 +1,11 @@
-# Copyright 2010-2012 Canonical Ltd.  This software is licensed under the
+# Copyright 2010-2022 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Enums for the Bugs app."""
 
 __all__ = [
+    'BugLockedStatus',
+    'BugLockStatus',
     'BugNotificationLevel',
     'BugNotificationStatus',
     ]
@@ -11,6 +13,7 @@ __all__ = [
 from lazr.enum import (
     DBEnumeratedType,
     DBItem,
+    use_template,
     )
 
 
@@ -74,3 +77,29 @@ class BugNotificationStatus(DBEnumeratedType):
         The notification is deferred.  The recipient list was not calculated
         at creation time but is done when processed.
         """)
+
+
+class BugLockStatus(DBEnumeratedType):
+    """
+    The lock status of a bug.
+    """
+
+    UNLOCKED = DBItem(0, """
+        Unlocked
+
+        The bug is unlocked and the usual permissions apply.
+        """)
+
+    COMMENT_ONLY = DBItem(1, """
+        Comment-only
+
+        The bug allows those without a relevant role to comment,
+        but not to edit metadata.
+        """)
+
+
+class BugLockedStatus(DBEnumeratedType):
+    """
+    The various locked status values of a bug.
+    """
+    use_template(BugLockStatus, exclude=('UNLOCKED',))
diff --git a/lib/lp/bugs/interfaces/bug.py b/lib/lp/bugs/interfaces/bug.py
index db94b63..7ffc619 100644
--- a/lib/lp/bugs/interfaces/bug.py
+++ b/lib/lp/bugs/interfaces/bug.py
@@ -1,4 +1,4 @@
-# Copyright 2009-2016 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2022 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Interfaces related to bugs."""
@@ -66,7 +66,11 @@ from lp.app.errors import NotFoundError
 from lp.app.interfaces.launchpad import IPrivacy
 from lp.app.validators.attachment import attachment_size_constraint
 from lp.app.validators.name import bug_name_validator
-from lp.bugs.enums import BugNotificationLevel
+from lp.bugs.enums import (
+    BugLockedStatus,
+    BugLockStatus,
+    BugNotificationLevel,
+    )
 from lp.bugs.interfaces.bugactivity import IBugActivity
 from lp.bugs.interfaces.bugattachment import IBugAttachment
 from lp.bugs.interfaces.bugbranch import IBugBranch
@@ -382,6 +386,21 @@ class IBugView(Interface):
             readonly=True,
             value_type=Reference(schema=IMessage)),
         exported_as='messages'))
+    lock_status = exported(
+        Choice(
+            title=_('Lock Status'), vocabulary=BugLockStatus,
+            default=BugLockStatus.UNLOCKED,
+            description=_("The lock status of this bug."),
+            readonly=True,
+            required=False),
+        as_of="devel")
+    lock_reason = exported(
+        Text(
+            title=_('Lock Reason'),
+            description=_('The reason for locking this bug.'),
+            readonly=True,
+            required=False),
+        as_of="devel")
 
     def getSpecifications(user):
         """List of related specifications that the user can view."""
@@ -978,9 +997,54 @@ class IBugAppend(Interface):
         Return None if no bugtask was edited.
         """
 
+class IBugModerate(Interface):
+    """IBug attributes that require the launchpad.Moderate permission."""
+
+    @operation_parameters(
+        status=copy_field(
+            IBugView['lock_status'],
+            vocabulary=BugLockedStatus,
+        ),
+        reason=copy_field(IBugView['lock_reason'])
+    )
+    @export_write_operation()
+    @call_with(who=REQUEST_USER)
+    @operation_for_version("devel")
+    def lock(who, status, reason=None):
+        """
+        Lock the bug metadata edits to the relevant roles.
+
+        :param status: The lock status of the bug - one of the values
+                       in the BugLockStatus enum.
+        :param reason: The reason for locking this bug.
+        :param who: The IPerson who is making the change.
+        """
+
+    @export_write_operation()
+    @call_with(who=REQUEST_USER)
+    @operation_for_version("devel")
+    def unlock(who):
+        """
+        Unlock the bug metadata edits to the default roles.
+
+        :param who: The IPerson who is making the change.
+        """
+
+    @mutator_for(IBugView['lock_reason'])
+    @operation_parameters(reason=copy_field(IBugView['lock_reason']))
+    @export_write_operation()
+    @call_with(who=REQUEST_USER)
+    @operation_for_version("devel")
+    def setLockReason(reason, who):
+        """Set the lock reason.
+
+            :reason: The reason for locking the bug.
+            :who: The IPerson who is making the change.
+        """
+
 
 @exported_as_webservice_entry()
-class IBug(IBugPublic, IBugView, IBugAppend, IHasLinkedBranches):
+class IBug(IBugPublic, IBugView, IBugAppend, IBugModerate, IHasLinkedBranches):
     """The core bug entry."""
 
     linked_bugbranches = exported(
diff --git a/lib/lp/bugs/model/bug.py b/lib/lp/bugs/model/bug.py
index f7c588c..6cb9825 100644
--- a/lib/lp/bugs/model/bug.py
+++ b/lib/lp/bugs/model/bug.py
@@ -1,4 +1,4 @@
-# Copyright 2009-2021 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2022 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Launchpad bug-related database table classes."""
@@ -10,6 +10,7 @@ __all__ = [
     'BugMute',
     'BugSet',
     'BugTag',
+    'CannotSetLockReason',
     'FileBugData',
     'generate_subscription_with',
     'get_also_notified_subscribers',
@@ -19,6 +20,7 @@ __all__ = [
 
 from email.utils import make_msgid
 from functools import wraps
+import http.client
 from io import BytesIO
 from itertools import chain
 import operator
@@ -26,6 +28,7 @@ import re
 
 from lazr.lifecycle.event import ObjectCreatedEvent
 from lazr.lifecycle.snapshot import Snapshot
+from lazr.restful.declarations import error_status
 import pytz
 from six.moves.collections_abc import (
     Iterable,
@@ -95,12 +98,18 @@ from lp.bugs.adapters.bugchange import (
     BranchUnlinkedFromBug,
     BugConvertedToQuestion,
     BugDuplicateChange,
+    BugLocked,
+    BugLockReasonSet,
+    BugUnlocked,
     BugWatchAdded,
     BugWatchRemoved,
     SeriesNominated,
     UnsubscribedFromBug,
     )
-from lp.bugs.enums import BugNotificationLevel
+from lp.bugs.enums import (
+    BugLockStatus,
+    BugNotificationLevel,
+    )
 from lp.bugs.errors import InvalidDuplicateValue
 from lp.bugs.interfaces.bug import (
     IBug,
@@ -237,6 +246,18 @@ from lp.services.webapp.snapshot import notify_modified
 from lp.services.xref.interfaces import IXRefSet
 
 
+@error_status(http.client.BAD_REQUEST)
+class CannotSetLockReason(Exception):
+    """Raised when someone tries to set lock_reason for an unlocked bug."""
+
+
+@error_status(http.client.BAD_REQUEST)
+class CannotLockBug(Exception):
+    """
+    Raised when someone tries to lock a bug already locked
+    with the same reason.
+    """
+
 def snapshot_bug_params(bug_params):
     """Return a snapshot of a `CreateBugParams` object."""
     return Snapshot(
@@ -387,6 +408,21 @@ class Bug(SQLBase, InformationTypeMixin):
     heat = IntCol(notNull=True, default=0)
     heat_last_updated = UtcDateTimeCol(default=None)
     latest_patch_uploaded = UtcDateTimeCol(default=None)
+    _lock_status = DBEnum(
+        name='lock_status', enum=BugLockStatus,
+        allow_none=True, default=BugLockStatus.UNLOCKED)
+    lock_reason = StringCol(notNull=False, default=None)
+
+    @property
+    def lock_status(self):
+        return (
+            BugLockStatus.UNLOCKED if self._lock_status is None
+            else self._lock_status
+        )
+
+    @lock_status.setter
+    def lock_status(self, value):
+        self._lock_status = value
 
     @property
     def linked_branches(self):
@@ -2198,6 +2234,63 @@ class Bug(SQLBase, InformationTypeMixin):
             BugActivity.datechanged <= end_date)
         return activity_in_range
 
+    def lock(self, who, status, reason=None):
+        """See `IBug`."""
+        if status == self.lock_status:
+            raise CannotLockBug(
+                "This bug is already locked "
+                "with the lock status '{}'.".format(
+                    status
+                )
+            )
+        else:
+            old_lock_status = self.lock_status
+            self.lock_status = BugLockStatus.items[status.value]
+            if reason:
+                self.lock_reason = reason
+
+            self.addChange(
+                BugLocked(
+                    when=UTC_NOW,
+                    person=who,
+                    old_status=old_lock_status,
+                    new_status=self.lock_status,
+                    reason=reason
+                )
+            )
+
+    def unlock(self, who):
+        """See `IBug`."""
+        if self.lock_status != BugLockStatus.UNLOCKED:
+            old_lock_status = self.lock_status
+            self.lock_status = BugLockStatus.UNLOCKED
+            self.lock_reason = None
+
+            self.addChange(
+                BugUnlocked(
+                    when=UTC_NOW,
+                    person=who,
+                    old_status=old_lock_status
+                )
+            )
+
+    def setLockReason(self, reason, who):
+        """See `IBug`."""
+        if self.lock_status == BugLockStatus.UNLOCKED:
+            raise CannotSetLockReason(
+                "Lock reason cannot be set for an unlocked bug."
+            )
+        if self.lock_reason != reason:
+            old_reason = self.lock_reason
+            self.lock_reason = reason
+            self.addChange(
+                BugLockReasonSet(
+                    when=UTC_NOW,
+                    person=who,
+                    old_reason=old_reason,
+                    new_reason=reason
+                )
+            )
 
 @ProxyFactory
 def get_also_notified_subscribers(
diff --git a/lib/lp/bugs/security.py b/lib/lp/bugs/security.py
index b60b426..beba8af 100644
--- a/lib/lp/bugs/security.py
+++ b/lib/lp/bugs/security.py
@@ -1,4 +1,4 @@
-# Copyright 2010-2020 Canonical Ltd.  This software is licensed under the
+# Copyright 2010-2022 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Security adapters for the bugs module."""
@@ -10,6 +10,7 @@ from lp.app.security import (
     AuthorizationBase,
     DelegatedAuthorization,
     )
+from lp.bugs.enums import BugLockStatus
 from lp.bugs.interfaces.bug import IBug
 from lp.bugs.interfaces.bugactivity import IBugActivity
 from lp.bugs.interfaces.bugattachment import IBugAttachment
@@ -166,6 +167,19 @@ class EditBug(AuthorizationBase):
                 user, permission='launchpad.Append'):
             # The user cannot even see the bug.
             return False
+
+        def in_allowed_roles():
+            return (
+                # Users with relevant roles can edit the bug.
+                user.in_admin or
+                user.in_commercial_admin or
+                user.in_registry_experts or
+                _has_any_bug_role(user, self.obj.bugtasks)
+            )
+
+        if self.obj.lock_status == BugLockStatus.COMMENT_ONLY:
+            return in_allowed_roles()
+
         return (
             # If the bug is private, then we don't need more elaborate
             # checks as they must have been explicitly subscribed.
@@ -173,18 +187,38 @@ class EditBug(AuthorizationBase):
             # If the user seems generally legitimate, let them through.
             self.forwardCheckAuthenticated(
                 user, permission='launchpad.AnyLegitimatePerson') or
-            # The bug reporter can always edit their own bug.
+            # The bug reporter can edit their own bug if it is unlocked.
             user.inTeam(self.obj.owner) or
-            # Users with relevant roles can edit the bug.
-            user.in_admin or user.in_commercial_admin or
-            user.in_registry_experts or
-            _has_any_bug_role(user, self.obj.bugtasks))
+            in_allowed_roles())
 
     def checkUnauthenticated(self):
         """Never allow unauthenticated users to edit a bug."""
         return False
 
 
+class ModerateBug(AuthorizationBase):
+    """Security adapter for moderating bugs.
+
+    This is used for operations like locking and unlocking a bug to the
+    relevant roles.
+    """
+    permission = 'launchpad.Moderate'
+    usedfor = IBug
+
+    def checkAuthenticated(self, user):
+        if not self.forwardCheckAuthenticated(
+                user, permission='launchpad.Append'):
+            # The user cannot even see the bug.
+            return False
+
+        return (
+            user.in_admin or
+            user.in_commercial_admin or
+            user.in_registry_experts or
+            _has_any_bug_role(user, self.obj.bugtasks)
+        )
+
+
 class PublicToAllOrPrivateToExplicitSubscribersForBug(AuthorizationBase):
     permission = 'launchpad.View'
     usedfor = IBug
diff --git a/lib/lp/bugs/tests/test_bug.py b/lib/lp/bugs/tests/test_bug.py
index 0c1e24b..ebe1e3b 100644
--- a/lib/lp/bugs/tests/test_bug.py
+++ b/lib/lp/bugs/tests/test_bug.py
@@ -1,17 +1,22 @@
-# Copyright 2009-2020 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2022 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Tests for lp.bugs.model.Bug."""
 
 from datetime import timedelta
+import json
 
 from lazr.lifecycle.snapshot import Snapshot
+from testtools.matchers import MatchesStructure
 from zope.component import getUtility
 from zope.interface import providedBy
 from zope.security.management import checkPermission
 from zope.security.proxy import removeSecurityProxy
 
-from lp.bugs.enums import BugNotificationLevel
+from lp.bugs.enums import (
+    BugLockStatus,
+    BugNotificationLevel,
+    )
 from lp.bugs.interfaces.bug import (
     CreateBugParams,
     IBugSet,
@@ -24,15 +29,23 @@ from lp.bugs.interfaces.bugtask import (
     UserCannotEditBugTaskImportance,
     UserCannotEditBugTaskMilestone,
     )
+from lp.bugs.model.bug import (
+    CannotLockBug,
+    CannotSetLockReason,
+    )
 from lp.registry.tests.test_person import KarmaTestMixin
+from lp.services.webapp.interfaces import OAuthPermission
 from lp.testing import (
     admin_logged_in,
+    ANONYMOUS,
+    api_url,
     celebrity_logged_in,
     person_logged_in,
     StormStatementRecorder,
     TestCaseWithFactory,
     )
 from lp.testing.layers import DatabaseFunctionalLayer
+from lp.testing.pages import webservice_for_person
 
 
 class TestBug(TestCaseWithFactory):
@@ -410,3 +423,426 @@ class TestBugPermissions(TestCaseWithFactory, KarmaTestMixin):
             person)
         with person_logged_in(person):
             self.assertTrue(checkPermission('launchpad.Edit', self.bug))
+
+
+class TestBugLocking(TestCaseWithFactory):
+    """
+    Tests for the bug locking functionality.
+    """
+
+    layer = DatabaseFunctionalLayer
+
+    def setUp(self):
+        super().setUp()
+        self.person = self.factory.makePerson()
+        self.target = self.factory.makeProduct()
+
+    def test_bug_lock_status_lock_reason_default_values(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        self.assertEqual(BugLockStatus.UNLOCKED, bug.lock_status)
+        self.assertIsNone(bug.lock_reason)
+
+    def test_bug_locking_when_bug_already_locked(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        with person_logged_in(self.target.owner):
+            bug.lock(who=self.target.owner, status=BugLockStatus.COMMENT_ONLY)
+            self.assertEqual(BugLockStatus.COMMENT_ONLY, bug.lock_status)
+            self.assertRaises(
+                CannotLockBug,
+                bug.lock,
+                who=self.target.owner,
+                status=BugLockStatus.COMMENT_ONLY
+            )
+            self.assertEqual(BugLockStatus.COMMENT_ONLY, bug.lock_status)
+
+    def test_bug_locking_with_a_reason_works(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        with person_logged_in(self.target.owner):
+            bug.lock(
+                who=self.person,
+                status=BugLockStatus.COMMENT_ONLY,
+                reason='too hot',
+            )
+            self.assertEqual('too hot', bug.lock_reason)
+
+    def test_updating_bug_lock_reason_not_set_before(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        with person_logged_in(self.target.owner):
+            bug.lock(who=self.person, status=BugLockStatus.COMMENT_ONLY)
+            self.assertIsNone(bug.lock_reason)
+            bug.setLockReason('too hot', who=self.target.owner)
+            self.assertEqual('too hot', bug.lock_reason)
+
+    def test_updating_existing_bug_lock_reason_to_none(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        with person_logged_in(self.target.owner):
+            bug.lock(
+                who=self.person,
+                status=BugLockStatus.COMMENT_ONLY,
+                reason='too hot',
+            )
+            self.assertEqual('too hot', bug.lock_reason)
+            bug.setLockReason(None, who=self.target.owner)
+            self.assertIsNone(bug.lock_reason)
+
+    def test_bug_unlocking_clears_the_reason(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        with person_logged_in(self.target.owner):
+            bug.lock(
+                who=self.person,
+                status=BugLockStatus.COMMENT_ONLY,
+                reason='too hot',
+            )
+            bug.unlock(who=self.person)
+            self.assertIsNone(bug.lock_reason)
+
+    def test_bug_locking_unlocking_adds_bug_activity_entries(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        self.assertEqual(1, bug.activity.count())
+        with person_logged_in(self.target.owner):
+            bug.lock(
+                who=self.target.owner,
+                status=BugLockStatus.COMMENT_ONLY,
+                reason='too hot'
+            )
+            self.assertEqual(2, bug.activity.count())
+            self.assertThat(
+                bug.activity[1],
+                MatchesStructure.byEquality(
+                    person=self.target.owner,
+                    whatchanged='lock status',
+                    oldvalue=str(BugLockStatus.UNLOCKED),
+                    newvalue=str(BugLockStatus.COMMENT_ONLY),
+                )
+            )
+            bug.unlock(who=self.target.owner)
+            self.assertEqual(3, bug.activity.count())
+            self.assertThat(
+                bug.activity[2],
+                MatchesStructure.byEquality(
+                    person=self.target.owner,
+                    whatchanged='lock status',
+                    oldvalue=str(BugLockStatus.COMMENT_ONLY),
+                    newvalue=str(BugLockStatus.UNLOCKED),
+                )
+            )
+
+    def test_cannot_set_lock_reason_for_an_unlocked_bug(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        with person_logged_in(self.target.owner):
+            self.assertRaises(
+                CannotSetLockReason,
+                bug.setLockReason,
+                'too hot',
+                who=self.target.owner
+            )
+
+    def test_edit_permission_restrictions_when_a_bug_is_locked(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        another_person = self.factory.makePerson()
+
+        with person_logged_in(self.target.owner):
+            bug.lock(who=self.target.owner, status=BugLockStatus.COMMENT_ONLY)
+
+        self.assertEqual(BugLockStatus.COMMENT_ONLY, bug.lock_status)
+
+        # A user without the relevant role cannot edit a locked bug.
+        with person_logged_in(another_person):
+            self.assertFalse(checkPermission('launchpad.Edit', bug))
+
+        # The bug reporter cannot edit a locked bug.
+        with person_logged_in(self.person):
+            self.assertFalse(checkPermission('launchpad.Edit', bug))
+
+        # Target driver can edit a locked bug.
+        new_person = self.factory.makePerson()
+        removeSecurityProxy(bug.default_bugtask.target).driver = new_person
+        with person_logged_in(new_person):
+            self.assertTrue(checkPermission('launchpad.Edit', bug))
+
+        # Admins can edit a locked bug.
+        with admin_logged_in():
+            self.assertTrue(checkPermission('launchpad.Edit', bug))
+
+        # Commercial admins can edit a locked bug.
+        with celebrity_logged_in('commercial_admin'):
+            self.assertTrue(checkPermission('launchpad.Edit', bug))
+
+        # Registry experts can edit a locked bug.
+        with celebrity_logged_in('registry_experts'):
+            self.assertTrue(checkPermission('launchpad.Edit', bug))
+
+
+    def test_only_those_with_moderate_permission_can_lock_unlock_a_bug(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        another_person = self.factory.makePerson()
+
+        # Unauthenticated person cannot moderate a bug.
+        self.assertFalse(checkPermission('launchpad.Moderate', bug))
+
+        # A user without the relevant role cannot moderate a bug.
+        with person_logged_in(another_person):
+            self.assertFalse(checkPermission('launchpad.Moderate', bug))
+
+        # The bug reporter cannot moderate a bug.
+        with person_logged_in(self.person):
+            self.assertFalse(checkPermission('launchpad.Moderate', bug))
+
+        # Admins can moderate a bug.
+        with admin_logged_in():
+            self.assertTrue(checkPermission('launchpad.Moderate', bug))
+
+        # Commercial admins can moderate a bug.
+        with celebrity_logged_in('commercial_admin'):
+            self.assertTrue(checkPermission('launchpad.Moderate', bug))
+
+        # Registry experts can moderate a bug.
+        with celebrity_logged_in('registry_experts'):
+            self.assertTrue(checkPermission('launchpad.Moderate', bug))
+
+        # Target owner can moderate a bug.
+        with person_logged_in(
+                removeSecurityProxy(bug.default_bugtask.target).owner
+        ):
+            self.assertTrue(checkPermission('launchpad.Moderate', bug))
+
+        # Target driver can moderate a bug.
+        new_person = self.factory.makePerson()
+        removeSecurityProxy(bug.default_bugtask.target).driver = new_person
+        with person_logged_in(new_person):
+            self.assertTrue(checkPermission('launchpad.Moderate', bug))
+
+        yet_another_person = self.factory.makePerson()
+        removeSecurityProxy(
+            bug.default_bugtask.target
+        ).bug_supervisor = yet_another_person
+        with person_logged_in(yet_another_person):
+            self.assertTrue(checkPermission('launchpad.Moderate', bug))
+
+
+class TestBugLockingWebService(TestCaseWithFactory):
+    """Tests for the bug locking and unlocking web service methods."""
+
+    layer = DatabaseFunctionalLayer
+
+    def setUp(self):
+        super().setUp()
+        self.person = self.factory.makePerson()
+        self.target = self.factory.makeProduct()
+
+    def test_bug_lock_status_invalid_values(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        invalid_values_list = ["test", 1.23, 123, "Unlocked"]
+        webservice = webservice_for_person(
+            self.target.owner,
+            permission=OAuthPermission.WRITE_PRIVATE
+        )
+        bug_url = api_url(bug)
+        webservice.default_api_version = "devel"
+        for invalid_value in invalid_values_list:
+            response = webservice.named_post(
+                bug_url, 'lock', status=invalid_value
+            )
+            self.assertEqual(400, response.status)
+
+    def test_who_value_for_lock_is_correctly_set(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        self.assertEqual(bug.activity.count(), 1)
+        self.assertEqual(BugLockStatus.UNLOCKED, bug.lock_status)
+
+        bug_url = api_url(bug)
+        webservice = webservice_for_person(
+            self.target.owner,
+            permission=OAuthPermission.WRITE_PRIVATE
+        )
+        webservice.default_api_version = "devel"
+
+        response = webservice.named_post(
+            bug_url, 'lock', status="Comment-only",
+        )
+        self.assertEqual(200, response.status)
+
+        with person_logged_in(ANONYMOUS):
+            self.assertEqual(2, bug.activity.count())
+            self.assertThat(
+                bug.activity[1],
+                MatchesStructure.byEquality(
+                    person=self.target.owner,
+                    whatchanged='lock status',
+                    oldvalue=str(BugLockStatus.UNLOCKED),
+                    newvalue=str(BugLockStatus.COMMENT_ONLY)
+                )
+            )
+
+    def test_who_value_for_unlock_is_correctly_set(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        self.assertEqual(1, bug.activity.count())
+        with person_logged_in(self.target.owner):
+            bug.lock(who=self.target.owner, status=BugLockStatus.COMMENT_ONLY)
+        self.assertEqual(2, bug.activity.count())
+        bug_url = api_url(bug)
+        webservice = webservice_for_person(
+            self.target.owner,
+            permission=OAuthPermission.WRITE_PRIVATE
+        )
+        webservice.default_api_version = "devel"
+
+        response = webservice.named_post(
+            bug_url, 'unlock'
+        )
+        self.assertEqual(200, response.status)
+        with person_logged_in(ANONYMOUS):
+            self.assertEqual(3, bug.activity.count())
+            self.assertThat(
+                bug.activity[2],
+                MatchesStructure.byEquality(
+                    person=self.target.owner,
+                    whatchanged='lock status',
+                    oldvalue=str(BugLockStatus.COMMENT_ONLY),
+                    newvalue=str(BugLockStatus.UNLOCKED),
+                )
+            )
+
+    def test_lock_status_lock_reason_values_unlocked_bug(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        bug_url = api_url(bug)
+
+        webservice = webservice_for_person(
+            self.target.owner,
+            permission=OAuthPermission.WRITE_PRIVATE
+        )
+        webservice.default_api_version = 'devel'
+
+        response = webservice.get(bug_url)
+        self.assertEqual(200, response.status)
+        response_json = response.jsonBody()
+        self.assertEqual(
+            str(BugLockStatus.UNLOCKED),
+            response_json['lock_status']
+        )
+        self.assertIsNone(response_json['lock_reason'])
+
+    def test_lock_status_lock_reason_values_after_locking(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        bug_url = api_url(bug)
+
+        with person_logged_in(self.target.owner):
+            bug.lock(
+                who=self.target.owner,
+                status=BugLockStatus.COMMENT_ONLY,
+                reason='too hot'
+            )
+
+        webservice = webservice_for_person(
+            self.target.owner,
+            permission=OAuthPermission.WRITE_PRIVATE
+        )
+        webservice.default_api_version = 'devel'
+
+        response = webservice.get(bug_url)
+        self.assertEqual(200, response.status)
+        response_json = response.jsonBody()
+        self.assertEqual(
+            str(BugLockStatus.COMMENT_ONLY),
+            response_json['lock_status']
+        )
+        self.assertEqual(
+            response_json['lock_reason'],
+            'too hot'
+        )
+
+    def test_setting_lock_reason_for_an_unlocked_bug(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        bug_url = api_url(bug)
+        webservice = webservice_for_person(
+            self.target.owner,
+            permission=OAuthPermission.WRITE_PRIVATE
+        )
+        webservice.default_api_version = 'devel'
+
+        response = webservice.patch(
+            bug_url, "application/json",
+            json.dumps({'lock_reason': 'too hot'})
+        )
+        self.assertThat(
+            response,
+            MatchesStructure.byEquality(
+                status=400,
+                body=b'Lock reason cannot be set for an unlocked bug.'
+            )
+        )
+
+    def test_setting_lock_reason_for_a_locked_bug_without_a_reason(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        with person_logged_in(self.target.owner):
+            bug.lock(who=self.target.owner, status=BugLockStatus.COMMENT_ONLY)
+
+        self.assertEqual(BugLockStatus.COMMENT_ONLY, bug.lock_status)
+        self.assertIsNone(bug.lock_reason)
+
+        bug_url = api_url(bug)
+        webservice = webservice_for_person(
+            self.target.owner,
+            permission=OAuthPermission.WRITE_PRIVATE
+        )
+        webservice.default_api_version = 'devel'
+
+        response = webservice.patch(
+            bug_url, "application/json",
+            json.dumps({'lock_reason': 'too hot'})
+        )
+        self.assertEqual(209, response.status)
+        self.assertEqual('too hot', response.jsonBody()['lock_reason'])
+
+
+    def test_setting_lock_reason_for_a_locked_bug_with_a_reason(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        with person_logged_in(self.target.owner):
+            bug.lock(
+                who=self.target.owner,
+                status=BugLockStatus.COMMENT_ONLY,
+                reason='too hot'
+            )
+
+        self.assertEqual(BugLockStatus.COMMENT_ONLY, bug.lock_status)
+        self.assertEqual('too hot', bug.lock_reason)
+
+        bug_url = api_url(bug)
+        webservice = webservice_for_person(
+            self.target.owner,
+            permission=OAuthPermission.WRITE_PRIVATE
+        )
+        webservice.default_api_version = 'devel'
+
+        response = webservice.patch(
+            bug_url, "application/json",
+            json.dumps({'lock_reason': 'too hot!'})
+        )
+        self.assertEqual(209, response.status)
+        self.assertEqual('too hot!', response.jsonBody()['lock_reason'])
+
+    def test_removing_lock_reason_for_a_locked_bug_with_a_reason(self):
+        bug = self.factory.makeBug(owner=self.person, target=self.target)
+        with person_logged_in(self.target.owner):
+            bug.lock(
+                who=self.target.owner,
+                status=BugLockStatus.COMMENT_ONLY,
+                reason='too hot'
+            )
+
+        self.assertEqual(BugLockStatus.COMMENT_ONLY, bug.lock_status)
+        self.assertEqual('too hot', bug.lock_reason)
+
+        bug_url = api_url(bug)
+        webservice = webservice_for_person(
+            self.target.owner,
+            permission=OAuthPermission.WRITE_PRIVATE
+        )
+        webservice.default_api_version = 'devel'
+
+        response = webservice.patch(
+            bug_url, "application/json",
+            json.dumps({'lock_reason': None})
+        )
+        self.assertEqual(209, response.status)
+        self.assertEqual(None, response.jsonBody()['lock_reason'])
diff --git a/lib/lp/scripts/garbo.py b/lib/lp/scripts/garbo.py
index 5eabeb6..da3f2f7 100644
--- a/lib/lp/scripts/garbo.py
+++ b/lib/lp/scripts/garbo.py
@@ -51,6 +51,7 @@ from zope.component import getUtility
 from zope.security.proxy import removeSecurityProxy
 
 from lp.answers.model.answercontact import AnswerContact
+from lp.bugs.enums import BugLockStatus
 from lp.bugs.interfaces.bug import IBugSet
 from lp.bugs.model.bug import Bug
 from lp.bugs.model.bugattachment import BugAttachment
@@ -1762,6 +1763,42 @@ class PopulateSnapBuildStoreRevision(TunableLoop):
         transaction.commit()
 
 
+class PopulateBugLockStatusDefaultUnlocked(TunableLoop):
+    """
+    Populates Bug.lock_status to BugLockStatus.UNLOCKED if not set
+    """
+
+    maximum_chunk_size = 5000
+
+    def __init__(self, log, abort_time=None):
+        super().__init__(log, abort_time)
+        self.store = IMasterStore(Bug)
+        self.start_at = 1
+
+    def findBugsLockStatusNone(self):
+        return self.store.find(
+            Bug.id,
+            Bug.id >= self.start_at,
+            Bug._lock_status == None,
+        ).order_by(Bug.id)
+
+    def setBugLockStatusUnlocked(self, bug_ids):
+        self.store.find(Bug, Bug.id.is_in(bug_ids)).set(
+            _lock_status=BugLockStatus.UNLOCKED
+        )
+
+    def isDone(self):
+        return self.findBugsLockStatusNone().is_empty()
+
+    def __call__(self, chunk_size):
+        bug_ids = [
+            bug_id for bug_id in self.findBugsLockStatusNone()[:chunk_size]
+        ]
+        self.setBugLockStatusUnlocked(bug_ids)
+        self.start_at = bug_ids[-1] + 1
+        transaction.commit()
+
+
 class BaseDatabaseGarbageCollector(LaunchpadCronScript):
     """Abstract base class to run a collection of TunableLoops."""
     script_name = None  # Script name for locking and database user. Override.
@@ -2053,6 +2090,7 @@ class DailyDatabaseGarbageCollector(BaseDatabaseGarbageCollector):
         OCIFilePruner,
         ObsoleteBugAttachmentPruner,
         OldTimeLimitedTokenDeleter,
+        PopulateBugLockStatusDefaultUnlocked,
         PopulateSnapBuildStoreRevision,
         POTranslationPruner,
         PreviewDiffPruner,
diff --git a/lib/lp/scripts/tests/test_garbo.py b/lib/lp/scripts/tests/test_garbo.py
index 36c64e6..94c2c2d 100644
--- a/lib/lp/scripts/tests/test_garbo.py
+++ b/lib/lp/scripts/tests/test_garbo.py
@@ -96,6 +96,7 @@ from lp.scripts.garbo import (
     load_garbo_job_state,
     LoginTokenPruner,
     OpenIDConsumerAssociationPruner,
+    PopulateBugLockStatusDefaultUnlocked,
     PopulateSnapBuildStoreRevision,
     ProductVCSPopulator,
     save_garbo_job_state,
@@ -2045,6 +2046,21 @@ class TestGarbo(FakeAdapterMixin, TestCaseWithFactory):
         switch_dbuser('testadmin')
         self.assertEqual(build1._store_upload_revision, 1)
 
+    def test_PopulateBugLockStatusDefaultUnlocked(self):
+        switch_dbuser('testadmin')
+        populator = PopulateBugLockStatusDefaultUnlocked(log=None)
+        for _ in range(5):
+            bug = self.factory.makeBug()
+            removeSecurityProxy(bug).lock_status = None
+
+        result_set = populator.findBugsLockStatusNone()
+        self.assertGreater(result_set.count(), 0)
+
+        self.runDaily()
+
+        result_set = populator.findBugsLockStatusNone()
+        self.assertTrue(result_set.is_empty())
+
 
 class TestGarboTasks(TestCaseWithFactory):
     layer = LaunchpadZopelessLayer