Merge ~pappacena/launchpad:mp-refs-privacy-change into launchpad:master

[Thiago F. Pappacena]

Background job to add/remove merge proposal's virtual refs when a repository has its privacy changed

Unmerged commits

cca2a0f... by Thiago F. Pappacena on 2020-09-17

Merge branch 'create-mp-refs' into mp-refs-privacy-change

2ca86e6... by Thiago F. Pappacena on 2020-09-17

Fixing test

ebd11bb... by Thiago F. Pappacena on 2020-09-17

Adding job to reconcile mp virtual refs

3c2ffb2... by Thiago F. Pappacena on 2020-09-17

Trigger MP reconciliation job when changing repository privacy setting

30c88c7... by Thiago F. Pappacena on 2020-09-16

Merge branch 'githosting-copy-and-delete-refs' into create-mp-refs

a803723... by Thiago F. Pappacena on 2020-09-16

Fixing interface method definition

7e11cb0... by Thiago F. Pappacena on 2020-09-16

Refactoring virtual refs creation and preparing privacy code

1f7f371... by Thiago F. Pappacena on 2020-09-11

Adding feature flag and triggering copy on MP creation

50eeb2e... by Thiago F. Pappacena on 2020-09-11

Adding feature flag to control mp virtual refs creation

84d5c5f... by Thiago F. Pappacena on 2020-09-10

Logging error

diff --git a/lib/lp/code/configure.zcml b/lib/lp/code/configure.zcml
index 898e645..4adc8d0 100644
--- a/lib/lp/code/configure.zcml
+++ b/lib/lp/code/configure.zcml
@@ -1111,6 +1111,11 @@
       provides="lp.code.interfaces.gitjob.IGitRepositoryModifiedMailJobSource">
     <allow interface="lp.code.interfaces.gitjob.IGitRepositoryModifiedMailJobSource" />
   </securedutility>
+  <securedutility
+      component="lp.code.model.gitjob.GitRepositoryVirtualRefsSyncJob"
+      provides="lp.code.interfaces.gitjob.IGitRepositoryVirtualRefsSyncJobSource">
+    <allow interface="lp.code.interfaces.gitjob.IGitRepositoryVirtualRefsSyncJobSource" />
+  </securedutility>
   <class class="lp.code.model.gitjob.GitRefScanJob">
     <allow interface="lp.code.interfaces.gitjob.IGitJob" />
     <allow interface="lp.code.interfaces.gitjob.IGitRefScanJob" />
@@ -1123,6 +1128,10 @@
     <allow interface="lp.code.interfaces.gitjob.IGitJob" />
     <allow interface="lp.code.interfaces.gitjob.IGitRepositoryModifiedMailJob" />
   </class>
+    <class class="lp.code.model.gitjob.GitRepositoryVirtualRefsSyncJob">
+    <allow interface="lp.code.interfaces.gitjob.IGitJob" />
+    <allow interface="lp.code.interfaces.gitjob.IGitRepositoryVirtualRefsSyncJob" />
+  </class>
 
   <lp:help-folder folder="help" name="+help-code" />
 
diff --git a/lib/lp/code/errors.py b/lib/lp/code/errors.py
index 85de140..bed7db5 100644
--- a/lib/lp/code/errors.py
+++ b/lib/lp/code/errors.py
@@ -1,4 +1,4 @@
-# Copyright 2009-2019 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Errors used in the lp/code modules."""
@@ -34,6 +34,7 @@ __all__ = [
     'ClaimReviewFailed',
     'DiffNotFound',
     'GitDefaultConflict',
+    'GitReferenceDeletionFault',
     'GitRepositoryBlobNotFound',
     'GitRepositoryBlobUnsupportedRemote',
     'GitRepositoryCreationException',
@@ -493,6 +494,10 @@ class GitRepositoryDeletionFault(Exception):
     """Raised when there is a fault deleting a repository."""
 
 
+class GitReferenceDeletionFault(Exception):
+    """Raised when there is a fault deleting a repository's ref."""
+
+
 class GitTargetError(Exception):
     """Raised when there is an error determining a Git repository target."""
 
diff --git a/lib/lp/code/interfaces/githosting.py b/lib/lp/code/interfaces/githosting.py
index 378930a..d7b048f 100644
--- a/lib/lp/code/interfaces/githosting.py
+++ b/lib/lp/code/interfaces/githosting.py
@@ -1,4 +1,4 @@
-# Copyright 2015-2018 Canonical Ltd.  This software is licensed under the
+# Copyright 2015-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Interface for communication with the Git hosting service."""
@@ -129,3 +129,21 @@ class IGitHostingClient(Interface):
         :param logger: An optional logger.
         :return: A binary string with the blob content.
         """
+
+    def copyRefs(path, operations, logger=None):
+        """Executes the copy of refs or commits between different
+        repositories.
+
+        :param path: Physical path of the repository on the hosting service.
+        :param operations: A list of RefCopyOperation objects describing
+                           source and target of the copy.
+        :param logger: An optional logger.
+        """
+
+    def deleteRef(path, ref, logger=None):
+        """Deletes a reference on the given git repository.
+
+        :param path: Physical path of the repository on the hosting service.
+        :param ref: The reference to be delete.
+        :param logger: An optional logger.
+        """
diff --git a/lib/lp/code/interfaces/gitjob.py b/lib/lp/code/interfaces/gitjob.py
index 4f31b19..7c3c038 100644
--- a/lib/lp/code/interfaces/gitjob.py
+++ b/lib/lp/code/interfaces/gitjob.py
@@ -1,4 +1,4 @@
-# Copyright 2015 Canonical Ltd.  This software is licensed under the
+# Copyright 2015-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """GitJob interfaces."""
@@ -11,6 +11,8 @@ __all__ = [
     'IGitRefScanJobSource',
     'IGitRepositoryModifiedMailJob',
     'IGitRepositoryModifiedMailJobSource',
+    'IGitRepositoryVirtualRefsSyncJob',
+    'IGitRepositoryVirtualRefsSyncJobSource',
     'IReclaimGitRepositorySpaceJob',
     'IReclaimGitRepositorySpaceJobSource',
     ]
@@ -93,3 +95,16 @@ class IGitRepositoryModifiedMailJobSource(IJobSource):
         :param repository_delta: An `IGitRepositoryDelta` describing the
             changes.
         """
+
+
+class IGitRepositoryVirtualRefsSyncJob(IRunnableJob):
+    """A job to synchronize all MPs virtual refs related to this repository."""
+
+
+class IGitRepositoryVirtualRefsSyncJobSource(IJobSource):
+
+    def create(repository):
+        """Send email about repository modifications.
+
+        :param repository: The `IGitRepository` that needs sync.
+        """
diff --git a/lib/lp/code/interfaces/gitrepository.py b/lib/lp/code/interfaces/gitrepository.py
index 344bc43..9e4c129 100644
--- a/lib/lp/code/interfaces/gitrepository.py
+++ b/lib/lp/code/interfaces/gitrepository.py
@@ -8,6 +8,8 @@ __metaclass__ = type
 __all__ = [
     'ContributorGitIdentity',
     'GitIdentityMixin',
+    'GIT_CREATE_MP_VIRTUAL_REF',
+    'GIT_MP_VIRTUAL_REF_FORMAT',
     'GIT_REPOSITORY_NAME_VALIDATION_ERROR_MESSAGE',
     'git_repository_name_validator',
     'IGitRepository',
@@ -105,6 +107,11 @@ valid_git_repository_name_pattern = re.compile(
     r"^(?i)[a-z0-9][a-z0-9+\.\-@_]*\Z")
 
 
+# Virtual ref where we automatically put a copy of any open merge proposal.
+GIT_MP_VIRTUAL_REF_FORMAT = 'refs/merge/{mp.id}/head'
+GIT_CREATE_MP_VIRTUAL_REF = 'git.mergeproposal_virtualref.enabled'
+
+
 def valid_git_repository_name(name):
     """Return True iff the name is valid as a Git repository name.
 
@@ -595,11 +602,15 @@ class IGitRepositoryView(IHasRecipes):
     def updateLandingTargets(paths):
         """Update landing targets (MPs where this repository is the source).
 
-        For each merge proposal, create `UpdatePreviewDiffJob`s.
+        For each merge proposal, create `UpdatePreviewDiffJob`s, and runs
+        the appropriate GitHosting.copyRefs operation to allow having
+        virtual merge refs with the updated branch version.
 
         :param paths: A list of reference paths.  Any merge proposals whose
             source is this repository and one of these paths will have their
             diffs updated.
+        :return: Returns a tuple with the list of background jobs created,
+                 and the lits of refs copy requested to GitHosting.
         """
 
     def markRecipesStale(paths):
diff --git a/lib/lp/code/model/branchmergeproposal.py b/lib/lp/code/model/branchmergeproposal.py
index 2a346b4..bd804a8 100644
--- a/lib/lp/code/model/branchmergeproposal.py
+++ b/lib/lp/code/model/branchmergeproposal.py
@@ -12,6 +12,7 @@ __all__ = [
 
 from collections import defaultdict
 from email.utils import make_msgid
+import logging
 from operator import attrgetter
 import sys
 
@@ -83,7 +84,12 @@ from lp.code.interfaces.codereviewcomment import ICodeReviewComment
 from lp.code.interfaces.codereviewinlinecomment import (
     ICodeReviewInlineCommentSet,
     )
+from lp.code.interfaces.githosting import IGitHostingClient
 from lp.code.interfaces.gitref import IGitRef
+from lp.code.interfaces.gitrepository import (
+    GIT_CREATE_MP_VIRTUAL_REF,
+    GIT_MP_VIRTUAL_REF_FORMAT,
+    )
 from lp.code.mail.branch import RecipientReason
 from lp.code.model.branchrevision import BranchRevision
 from lp.code.model.codereviewcomment import CodeReviewComment
@@ -93,6 +99,7 @@ from lp.code.model.diff import (
     IncrementalDiff,
     PreviewDiff,
     )
+from lp.code.model.githosting import RefCopyOperation
 from lp.registry.interfaces.person import (
     IPerson,
     IPersonSet,
@@ -122,6 +129,7 @@ from lp.services.database.sqlbase import (
     quote,
     SQLBase,
     )
+from lp.services.features import getFeatureFlag
 from lp.services.helpers import shortlist
 from lp.services.job.interfaces.job import JobStatus
 from lp.services.job.model.job import Job
@@ -143,6 +151,9 @@ from lp.soyuz.enums import (
     )
 
 
+logger = logging.getLogger(__name__)
+
+
 def is_valid_transition(proposal, from_state, next_state, user=None):
     """Is it valid for this user to move this proposal to to next_state?
 
@@ -968,6 +979,8 @@ class BranchMergeProposal(SQLBase, BugLinkTargetMixin):
             branch_merge_proposal=self.id):
             job.destroySelf()
         self._preview_diffs.remove()
+        self.deleteGitHostingVirtualRefs()
+
         self.destroySelf()
 
     def getUnlandedSourceBranchRevisions(self):
@@ -1214,6 +1227,68 @@ class BranchMergeProposal(SQLBase, BugLinkTargetMixin):
             for diff in diffs)
         return [diff_dict.get(revisions) for revisions in revision_list]
 
+    def getGitHostingRefCopyOperations(self):
+        """Gets the list of GitHosting copy operations that should be done
+        in order to keep this MP's virtual refs up-to-date."""
+        if (not self.target_git_repository
+                or not getFeatureFlag(GIT_CREATE_MP_VIRTUAL_REF)):
+            return []
+        # If the source repository is private and it's opening a MP to
+        # another repository, we should not risk to to have the private code
+        # undisclosed to everyone with permission to see the target repo:
+        private_source = self.source_git_repository.private
+        same_repo = self.source_git_repository == self.target_git_repository
+        same_owner = self.source_git_repository.owner.inTeam(
+            self.target_git_repository.owner)
+        if private_source and not (same_repo or same_owner):
+            return []
+        return [RefCopyOperation(
+            self.source_git_commit_sha1,
+            self.target_git_repository.getInternalPath(),
+            GIT_MP_VIRTUAL_REF_FORMAT.format(mp=self))]
+
+    def copyGitHostingVirtualRefs(self, logger=logger):
+        """Requests virtual refs copy operations on GitHosting in order to
+        keep them up-to-date with current MP's state.
+
+        :return: The list of copy operations requested."""
+        copy_operations = self.getGitHostingRefCopyOperations()
+        if copy_operations:
+            hosting_client = getUtility(IGitHostingClient)
+            hosting_client.copyRefs(
+                self.source_git_repository.getInternalPath(),
+                copy_operations, logger=logger)
+        return copy_operations
+
+    def deleteGitHostingVirtualRefs(self, except_refs=None, logger=None):
+        """Deletes on git code hosting service all virtual refs, except
+        those ones in the given list."""
+        if self.source_git_ref is None:
+            return
+        if not getFeatureFlag(GIT_CREATE_MP_VIRTUAL_REF):
+            # XXX pappacena 2020-09-15: Do not try to remove virtual refs if
+            # the feature is disabled. It might be disabled due to bug on
+            # the first versions, for example, and we should have a way to
+            # skip this feature entirely.
+            # Once the feature is stable, we should actually always delete
+            # the virtual refs, since we don't know if the feature was
+            # enabled or not when the branch was created.
+            return
+        ref = GIT_MP_VIRTUAL_REF_FORMAT.format(mp=self)
+        if ref not in (except_refs or []):
+            hosting_client = getUtility(IGitHostingClient)
+            hosting_client.deleteRef(
+                self.target_git_repository.getInternalPath(), ref,
+                logger=logger)
+
+    def syncGitHostingVirtualRefs(self, logger=None):
+        """Requests all copies and deletion of virtual refs to make git code
+        hosting in sync with this MP."""
+        operations = self.copyGitHostingVirtualRefs(logger=logger)
+        copied_refs = [i.target_ref for i in operations]
+        self.deleteGitHostingVirtualRefs(
+            except_refs=copied_refs, logger=logger)
+
     def scheduleDiffUpdates(self, return_jobs=True):
         """See `IBranchMergeProposal`."""
         from lp.code.model.branchmergeproposaljob import (
diff --git a/lib/lp/code/model/githosting.py b/lib/lp/code/model/githosting.py
index 94d6538..12a7d2f 100644
--- a/lib/lp/code/model/githosting.py
+++ b/lib/lp/code/model/githosting.py
@@ -1,4 +1,4 @@
-# Copyright 2015-2019 Canonical Ltd.  This software is licensed under the
+# Copyright 2015-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Communication with the Git hosting service."""
@@ -6,6 +6,7 @@
 __metaclass__ = type
 __all__ = [
     'GitHostingClient',
+    'RefCopyOperation',
     ]
 
 import base64
@@ -14,7 +15,10 @@ import sys
 
 from lazr.restful.utils import get_current_browser_request
 import requests
-from six import reraise
+from six import (
+    ensure_text,
+    reraise,
+    )
 from six.moves.urllib.parse import (
     quote,
     urljoin,
@@ -22,10 +26,12 @@ from six.moves.urllib.parse import (
 from zope.interface import implementer
 
 from lp.code.errors import (
+    GitReferenceDeletionFault,
     GitRepositoryBlobNotFound,
     GitRepositoryCreationFault,
     GitRepositoryDeletionFault,
     GitRepositoryScanFault,
+    GitTargetError,
     )
 from lp.code.interfaces.githosting import IGitHostingClient
 from lp.services.config import config
@@ -41,6 +47,18 @@ class RequestExceptionWrapper(requests.RequestException):
     """A non-requests exception that occurred during a request."""
 
 
+class RefCopyOperation:
+    """A description of a ref (or commit) copy between repositories.
+
+    This class is just a helper to define copy operations parameters on
+    IGitHostingClient.copyRefs method.
+    """
+    def __init__(self, source_ref, target_repo, target_ref):
+        self.source_ref = source_ref
+        self.target_repo = target_repo
+        self.target_ref = target_ref
+
+
 @implementer(IGitHostingClient)
 class GitHostingClient:
     """A client for the internal API provided by the Git hosting system."""
@@ -237,3 +255,46 @@ class GitHostingClient:
         except Exception as e:
             raise GitRepositoryScanFault(
                 "Failed to get file from Git repository: %s" % unicode(e))
+
+    def copyRefs(self, path, operations, logger=None):
+        """See `IGitHostingClient`."""
+        json_data = {
+            "operations": [{
+                "from": i.source_ref,
+                "to": {"repo": i.target_repo, "ref": i.target_ref}
+            } for i in operations]
+        }
+        try:
+            if logger is not None:
+                logger.info(
+                    "Copying refs from %s to %s targets" %
+                    (path, len(operations)))
+            url = "/repo/%s/refs-copy" % path
+            self._post(url, json=json_data)
+        except requests.RequestException as e:
+            if (e.response is not None and
+                    e.response.status_code == requests.codes.NOT_FOUND):
+                raise GitTargetError(
+                    "Could not find repository %s or one of its refs" %
+                    ensure_text(path))
+            else:
+                raise GitRepositoryScanFault(
+                    "Could not copy refs: HTTP %s" % e.response.status_code)
+
+    def deleteRef(self, path, ref, logger=None):
+        try:
+            if logger is not None:
+                logger.info("Delete from repo %s the ref %s" % (path, ref))
+            url = "/repo/%s/%s" % (path, ref)
+            self._delete(url)
+        except requests.RequestException as e:
+            if (e.response is not None and
+                    e.response.status_code == requests.codes.NOT_FOUND):
+                if logger is not None:
+                    logger.info(
+                        "Tried to delete a ref that doesn't exist: %s (%s)" %
+                        (path, ref))
+                return
+            raise GitReferenceDeletionFault(
+                "Error deleting %s from repo %s: HTTP %s" %
+                (ref, path, e.response.status_code))
diff --git a/lib/lp/code/model/gitjob.py b/lib/lp/code/model/gitjob.py
index 3c041da..a18d28e 100644
--- a/lib/lp/code/model/gitjob.py
+++ b/lib/lp/code/model/gitjob.py
@@ -1,4 +1,4 @@
-# Copyright 2015-2018 Canonical Ltd.  This software is licensed under the
+# Copyright 2015-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 __metaclass__ = type
@@ -45,6 +45,8 @@ from lp.code.interfaces.gitjob import (
     IGitRefScanJobSource,
     IGitRepositoryModifiedMailJob,
     IGitRepositoryModifiedMailJobSource,
+    IGitRepositoryVirtualRefsSyncJob,
+    IGitRepositoryVirtualRefsSyncJobSource,
     IReclaimGitRepositorySpaceJob,
     IReclaimGitRepositorySpaceJobSource,
     )
@@ -100,6 +102,13 @@ class GitJobType(DBEnumeratedType):
         modifications.
         """)
 
+    SYNC_MP_VIRTUAL_REFS = DBItem(3, """
+        Sync merge proposals virtual refs
+
+        This job runs against a repository to synchronize the virtual refs
+        from all merge proposals related to this repository.
+        """)
+
 
 @implementer(IGitJob)
 class GitJob(StormBase):
@@ -404,3 +413,35 @@ class GitRepositoryModifiedMailJob(GitJobDerived):
     def run(self):
         """See `IGitRepositoryModifiedMailJob`."""
         self.getMailer().sendAll()
+
+
+@implementer(IGitRepositoryVirtualRefsSyncJob)
+@provider(IGitRepositoryVirtualRefsSyncJobSource)
+class GitRepositoryVirtualRefsSyncJob(GitJobDerived):
+    """A Job that scans a Git repository for its current list of references."""
+    class_job_type = GitJobType.SYNC_MP_VIRTUAL_REFS
+
+    max_retries = 5
+
+    retry_error_types = tuple()
+
+    config = config.IGitRepositoryVirtualRefsSyncJobSource
+
+    @classmethod
+    def create(cls, repository):
+        metadata = {}
+        git_job = GitJob(repository, cls.class_job_type, metadata)
+        job = cls(git_job)
+        job.celeryRunOnCommit()
+        return job
+
+    def run(self):
+        log.info(
+            "Starting to re-sync virtual refs from repository %s",
+            self.repository)
+        for mp in self.repository.landing_targets:
+            log.info("Re-syncing virtual refs from MP %s", mp)
+            mp.syncGitHostingVirtualRefs(logger=log)
+        log.info(
+            "Finished re-syncing virtual refs from repository %s",
+            self.repository)
diff --git a/lib/lp/code/model/gitrepository.py b/lib/lp/code/model/gitrepository.py
index 77a4bbd..f9958c8 100644
--- a/lib/lp/code/model/gitrepository.py
+++ b/lib/lp/code/model/gitrepository.py
@@ -116,7 +116,10 @@ from lp.code.interfaces.gitcollection import (
     IGitCollection,
     )
 from lp.code.interfaces.githosting import IGitHostingClient
-from lp.code.interfaces.gitjob import IGitRefScanJobSource
+from lp.code.interfaces.gitjob import (
+    IGitRefScanJobSource,
+    IGitRepositoryVirtualRefsSyncJobSource,
+    )
 from lp.code.interfaces.gitlookup import IGitLookup
 from lp.code.interfaces.gitnamespace import (
     get_git_namespace,
@@ -865,6 +868,7 @@ class GitRepository(StormBase, WebhookTargetMixin, GitIdentityMixin):
             raise CannotChangeInformationType("Forbidden by project policy.")
         # XXX cjwatson 2019-03-29: Check privacy rules on snaps that use
         # this repository.
+        was_private = self.private
         self.information_type = information_type
         self._reconcileAccess()
         if (information_type in PRIVATE_INFORMATION_TYPES and
@@ -882,6 +886,12 @@ class GitRepository(StormBase, WebhookTargetMixin, GitIdentityMixin):
         # subscriptions.
         getUtility(IRemoveArtifactSubscriptionsJobSource).create(user, [self])
 
+        # If privacy changed, we need to re-sync all virtual refs from
+        # all MPs to avoid disclosing private code, or to add the virtual
+        # refs to the now public code.
+        if was_private != self.private:
+            getUtility(IGitRepositoryVirtualRefsSyncJobSource).create(self)
+
     def setName(self, new_name, user):
         """See `IGitRepository`."""
         self.namespace.moveRepository(self, user, new_name=new_name)
@@ -1160,9 +1170,15 @@ class GitRepository(StormBase, WebhookTargetMixin, GitIdentityMixin):
     def updateLandingTargets(self, paths):
         """See `IGitRepository`."""
         jobs = []
+        copy_operations = []
         for merge_proposal in self.getActiveLandingTargets(paths):
             jobs.extend(merge_proposal.scheduleDiffUpdates())
-        return jobs
+            copy_operations += merge_proposal.getGitHostingRefCopyOperations()
+
+        if copy_operations:
+            hosting_client = getUtility(IGitHostingClient)
+            hosting_client.copyRefs(self.getInternalPath(), copy_operations)
+        return jobs, copy_operations
 
     def _getRecipes(self, paths=None):
         """Undecorated version of recipes for use by `markRecipesStale`."""
diff --git a/lib/lp/code/model/tests/test_branchmergeproposal.py b/lib/lp/code/model/tests/test_branchmergeproposal.py
index 0d2457d..277650c 100644
--- a/lib/lp/code/model/tests/test_branchmergeproposal.py
+++ b/lib/lp/code/model/tests/test_branchmergeproposal.py
@@ -66,6 +66,10 @@ from lp.code.interfaces.branchmergeproposal import (
     IBranchMergeProposalGetter,
     IBranchMergeProposalJobSource,
     )
+from lp.code.interfaces.gitrepository import (
+    GIT_CREATE_MP_VIRTUAL_REF,
+    GIT_MP_VIRTUAL_REF_FORMAT,
+    )
 from lp.code.model.branchmergeproposal import (
     BranchMergeProposal,
     BranchMergeProposalGetter,
@@ -96,6 +100,7 @@ from lp.testing import (
     ExpectedException,
     launchpadlib_for,
     login,
+    login_admin,
     login_person,
     person_logged_in,
     TestCaseWithFactory,
@@ -255,6 +260,136 @@ class TestBranchMergeProposalPrivacy(TestCaseWithFactory):
             self.assertContentEqual([owner, team], subscriptions)
 
 
+class TestGitBranchMergeProposalVirtualRefs(TestCaseWithFactory):
+    """Ensure that BranchMergeProposal creation run the appropriate copy
+    and delete of virtual refs, like ref/merge/<id>/head."""
+
+    layer = DatabaseFunctionalLayer
+
+    def setUp(self):
+        super(TestGitBranchMergeProposalVirtualRefs, self).setUp()
+        self.hosting_fixture = self.useFixture(GitHostingFixture())
+
+    def test_copy_git_merge_virtual_ref(self):
+        self.useFixture(FeatureFixture({GIT_CREATE_MP_VIRTUAL_REF: "on"}))
+        mp = self.factory.makeBranchMergeProposalForGit()
+
+        copy_operations = mp.getGitHostingRefCopyOperations()
+        self.assertEqual(1, len(copy_operations))
+        self.assertThat(copy_operations[0], MatchesStructure(
+            source_ref=Equals(mp.source_git_commit_sha1),
+            target_repo=Equals(mp.target_git_repository.getInternalPath()),
+            target_ref=Equals("refs/merge/%s/head" % mp.id),
+        ))
+
+        self.assertEqual(1, self.hosting_fixture.copyRefs.call_count)
+        args, kwargs = self.hosting_fixture.copyRefs.calls[0]
+        arg_path, arg_copy_operations = args
+        self.assertEqual({'logger': None}, kwargs)
+        self.assertEqual(mp.source_git_repository.getInternalPath(), arg_path)
+        self.assertEqual(1, len(arg_copy_operations))
+        self.assertThat(arg_copy_operations[0], MatchesStructure(
+            source_ref=Equals(mp.source_git_commit_sha1),
+            target_repo=Equals(mp.target_git_repository.getInternalPath()),
+            target_ref=Equals("refs/merge/%s/head" % mp.id),
+        ))
+
+    def test_getGitHostingRefCopyOperations_private_source(self):
+        self.useFixture(FeatureFixture({GIT_CREATE_MP_VIRTUAL_REF: "on"}))
+        login_admin()
+        source_repo = self.factory.makeGitRepository(
+            information_type=InformationType.PRIVATESECURITY)
+        target_repo = self.factory.makeGitRepository(target=source_repo.target)
+        [source] = self.factory.makeGitRefs(source_repo)
+        [target] = self.factory.makeGitRefs(target_repo)
+        mp = self.factory.makeBranchMergeProposalForGit(
+            source_ref=source, target_ref=target)
+        self.assertEqual([], mp.getGitHostingRefCopyOperations())
+
+    def test_getGitHostingRefCopyOperations_private_source_same_repo(self):
+        self.useFixture(FeatureFixture({GIT_CREATE_MP_VIRTUAL_REF: "on"}))
+        login_admin()
+        repo = self.factory.makeGitRepository(
+            information_type=InformationType.PRIVATESECURITY)
+        [source, target] = self.factory.makeGitRefs(
+            repo, ['refs/heads/bugfix', 'refs/heads/master'])
+        mp = self.factory.makeBranchMergeProposalForGit(
+            source_ref=source, target_ref=target)
+        operations = mp.getGitHostingRefCopyOperations()
+        self.assertEqual(1, len(operations))
+        self.assertThat(operations[0], MatchesStructure(
+            source_ref=Equals(mp.source_git_commit_sha1),
+            target_repo=Equals(mp.target_git_repository.getInternalPath()),
+            target_ref=Equals(GIT_MP_VIRTUAL_REF_FORMAT.format(mp=mp))
+        ))
+
+    def test_getGitHostingRefCopyOperations_private_source_same_owner(self):
+        self.useFixture(FeatureFixture({GIT_CREATE_MP_VIRTUAL_REF: "on"}))
+        login_admin()
+        source_repo = self.factory.makeGitRepository(
+            information_type=InformationType.PRIVATESECURITY)
+        target_repo = self.factory.makeGitRepository(
+            target=source_repo.target, owner=source_repo.owner)
+        [source] = self.factory.makeGitRefs(source_repo)
+        [target] = self.factory.makeGitRefs(target_repo)
+        mp = self.factory.makeBranchMergeProposalForGit(
+            source_ref=source, target_ref=target)
+        operations = mp.getGitHostingRefCopyOperations()
+        self.assertEqual(1, len(operations))
+        self.assertThat(operations[0], MatchesStructure(
+            source_ref=Equals(mp.source_git_commit_sha1),
+            target_repo=Equals(mp.target_git_repository.getInternalPath()),
+            target_ref=Equals(GIT_MP_VIRTUAL_REF_FORMAT.format(mp=mp))
+        ))
+
+    def test_syncGitHostingVirtualRefs(self):
+        self.useFixture(FeatureFixture({GIT_CREATE_MP_VIRTUAL_REF: "on"}))
+        login_admin()
+        login_admin()
+        source_repo = self.factory.makeGitRepository()
+        target_repo = self.factory.makeGitRepository(target=source_repo.target)
+        [source] = self.factory.makeGitRefs(source_repo)
+        [target] = self.factory.makeGitRefs(target_repo)
+        mp = self.factory.makeBranchMergeProposalForGit(
+            source_ref=source, target_ref=target)
+
+        # mp.syncGitHostingVirtualRefs should have been triggered by event.
+        # Check lp.code.subscribers.branchmergeproposal.merge_proposal_created.
+        self.assertEqual(1, self.hosting_fixture.copyRefs.call_count)
+        args, kwargs = self.hosting_fixture.copyRefs.calls[0]
+        self.assertEquals({'logger': None}, kwargs)
+        self.assertEqual(args[0], source_repo.getInternalPath())
+        self.assertEqual(1, len(args[1]))
+        self.assertThat(args[1][0], MatchesStructure(
+            source_ref=Equals(mp.source_git_commit_sha1),
+            target_repo=Equals(mp.target_git_repository.getInternalPath()),
+            target_ref=Equals("refs/merge/%s/head" % mp.id),
+        ))
+
+        self.assertEqual(0, self.hosting_fixture.deleteRef.call_count)
+
+    def test_syncGitHostingVirtualRefs_private_source_deletes_ref(self):
+        self.useFixture(FeatureFixture({GIT_CREATE_MP_VIRTUAL_REF: "on"}))
+        login_admin()
+        source_repo = self.factory.makeGitRepository(
+            information_type=InformationType.PRIVATESECURITY)
+        target_repo = self.factory.makeGitRepository(target=source_repo.target)
+        [source] = self.factory.makeGitRefs(source_repo)
+        [target] = self.factory.makeGitRefs(target_repo)
+        mp = self.factory.makeBranchMergeProposalForGit(
+            source_ref=source, target_ref=target)
+
+        # mp.syncGitHostingVirtualRefs should have been triggered by event.
+        # Check lp.code.subscribers.branchmergeproposal.merge_proposal_created.
+        self.assertEqual(0, self.hosting_fixture.copyRefs.call_count)
+        self.assertEqual(1, self.hosting_fixture.deleteRef.call_count)
+        args, kwargs = self.hosting_fixture.deleteRef.calls[0]
+        self.assertEqual({'logger': None}, kwargs)
+        self.assertEqual(
+            (target_repo.getInternalPath(), "refs/merge/%s/head" % mp.id),
+            args)
+
+
 class TestBranchMergeProposalTransitions(TestCaseWithFactory):
     """Test the state transitions of branch merge proposals."""
 
@@ -1184,6 +1319,10 @@ class TestMergeProposalWebhooks(WithVCSScenarios, TestCaseWithFactory):
     def test_delete_triggers_webhooks(self):
         # When an existing merge proposal is deleted, any relevant webhooks
         # are triggered.
+        self.useFixture(FeatureFixture({
+            GIT_CREATE_MP_VIRTUAL_REF: "on",
+            BRANCH_MERGE_PROPOSAL_WEBHOOKS_FEATURE_FLAG: "on"}))
+        hosting_fixture = self.useFixture(GitHostingFixture())
         logger = self.useFixture(FakeLogger())
         source = self.makeBranch()
         target = self.makeBranch(same_target_as=source)
@@ -1204,8 +1343,11 @@ class TestMergeProposalWebhooks(WithVCSScenarios, TestCaseWithFactory):
             old=MatchesDict(self.getExpectedPayload(proposal, redact=True)))
         proposal.deleteProposal()
         delivery = hook.deliveries.one()
+        self.assertIsNotNone(delivery)
         self.assertCorrectDelivery(expected_payload, hook, delivery)
         self.assertCorrectLogging(expected_redacted_payload, hook, logger)
+        self.assertEqual(
+            1 if self.git else 0, hosting_fixture.deleteRef.call_count)
 
 
 class TestGetAddress(TestCaseWithFactory):
@@ -1506,6 +1648,18 @@ class TestBranchMergeProposalDeletion(TestCaseWithFactory):
         self.assertRaises(
             SQLObjectNotFound, BranchMergeProposalJob.get, job_id)
 
+    def test_deleteProposal_for_git_removes_virtual_ref(self):
+        self.useFixture(FeatureFixture({GIT_CREATE_MP_VIRTUAL_REF: "on"}))
+        hosting_fixture = self.useFixture(GitHostingFixture())
+        proposal = self.factory.makeBranchMergeProposalForGit()
+        proposal.deleteProposal()
+
+        self.assertEqual(1, hosting_fixture.deleteRef.call_count)
+        args = hosting_fixture.deleteRef.calls[0]
+        self.assertEqual((
+            (proposal.target_git_repository.getInternalPath(),
+             'refs/merge/%s/head' % proposal.id), {'logger': None}), args)
+
 
 class TestBranchMergeProposalBugs(WithVCSScenarios, TestCaseWithFactory):
 
diff --git a/lib/lp/code/model/tests/test_githosting.py b/lib/lp/code/model/tests/test_githosting.py
index d966dbe..04f7a8e 100644
--- a/lib/lp/code/model/tests/test_githosting.py
+++ b/lib/lp/code/model/tests/test_githosting.py
@@ -2,7 +2,7 @@
 # NOTE: The first line above must stay first; do not move the copyright
 # notice to the top.  See http://www.python.org/dev/peps/pep-0263/.
 #
-# Copyright 2016-2019 Canonical Ltd.  This software is licensed under the
+# Copyright 2016-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Unit tests for `GitHostingClient`.
@@ -37,12 +37,16 @@ from zope.interface import implementer
 from zope.security.proxy import removeSecurityProxy
 
 from lp.code.errors import (
+    GitReferenceDeletionFault,
     GitRepositoryBlobNotFound,
     GitRepositoryCreationFault,
     GitRepositoryDeletionFault,
     GitRepositoryScanFault,
+    GitTargetError,
+    NoSuchGitReference,
     )
 from lp.code.interfaces.githosting import IGitHostingClient
+from lp.code.model.githosting import RefCopyOperation
 from lp.services.job.interfaces.job import (
     IRunnableJob,
     JobStatus,
@@ -400,6 +404,46 @@ class TestGitHostingClient(TestCase):
                 " (256 vs 0)",
                 self.client.getBlob, "123", "dir/path/file/name")
 
+    def getCopyRefOperations(self):
+        return [
+            RefCopyOperation("1a2b3c4", "999", "refs/merge/123"),
+            RefCopyOperation("9a8b7c6", "666", "refs/merge/989"),
+        ]
+
+    def test_copyRefs(self):
+        with self.mockRequests("POST", status=202):
+            self.client.copyRefs("123", self.getCopyRefOperations())
+        self.assertRequest("repo/123/refs-copy", {
+            "operations": [
+                {
+                    "from": "1a2b3c4",
+                    "to": {"repo": "999", "ref": "refs/merge/123"}
+                }, {
+                    "from": "9a8b7c6",
+                    "to": {"repo": "666", "ref": "refs/merge/989"}
+                }
+            ]
+        }, "POST")
+
+    def test_copyRefs_refs_not_found(self):
+        with self.mockRequests("POST", status=404):
+            self.assertRaisesWithContent(
+                GitTargetError,
+                "Could not find repository 123 or one of its refs",
+                self.client.copyRefs, "123", self.getCopyRefOperations())
+
+    def test_deleteRef(self):
+        with self.mockRequests("DELETE", status=202):
+            self.client.deleteRef("123", "refs/merge/123")
+        self.assertRequest("repo/123/refs/merge/123", method="DELETE")
+
+    def test_deleteRef_refs_request_error(self):
+        with self.mockRequests("DELETE", status=500):
+            self.assertRaisesWithContent(
+                GitReferenceDeletionFault,
+                "Error deleting refs/merge/123 from repo 123: HTTP 500",
+                self.client.deleteRef, "123", "refs/merge/123")
+
     def test_works_in_job(self):
         # `GitHostingClient` is usable from a running job.
         @implementer(IRunnableJob)
diff --git a/lib/lp/code/model/tests/test_gitjob.py b/lib/lp/code/model/tests/test_gitjob.py
index 5964944..cc6ac49 100644
--- a/lib/lp/code/model/tests/test_gitjob.py
+++ b/lib/lp/code/model/tests/test_gitjob.py
@@ -1,4 +1,4 @@
-# Copyright 2015-2019 Canonical Ltd.  This software is licensed under the
+# Copyright 2015-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Tests for `GitJob`s."""
@@ -16,6 +16,7 @@ import hashlib
 from fixtures import FakeLogger
 from lazr.lifecycle.snapshot import Snapshot
 import pytz
+from storm.store import Store
 from testtools.matchers import (
     ContainsDict,
     Equals,
@@ -24,9 +25,11 @@ from testtools.matchers import (
     MatchesStructure,
     )
 import transaction
+from zope.component import getUtility
 from zope.interface import providedBy
 from zope.security.proxy import removeSecurityProxy
 
+from lp.app.enums import InformationType
 from lp.code.adapters.gitrepository import GitRepositoryDelta
 from lp.code.enums import (
     GitGranteeType,
@@ -38,8 +41,10 @@ from lp.code.interfaces.branchmergeproposal import (
 from lp.code.interfaces.gitjob import (
     IGitJob,
     IGitRefScanJob,
+    IGitRepositoryVirtualRefsSyncJobSource,
     IReclaimGitRepositorySpaceJob,
     )
+from lp.code.interfaces.gitrepository import GIT_CREATE_MP_VIRTUAL_REF
 from lp.code.model.gitjob import (
     describe_repository_delta,
     GitJob,
@@ -484,5 +489,35 @@ class TestDescribeRepositoryDelta(TestCaseWithFactory):
             snapshot, repository)
 
 
+class TestGitRepositoryVirtualRefsSyncJob(TestCaseWithFactory):
+    """Tests for `GitRepositoryVirtualRefsSyncJob`."""
+
+    layer = ZopelessDatabaseLayer
+
+    def test_changing_repo_to_private_deletes_refs(self):
+        self.useFixture(FeatureFixture({GIT_CREATE_MP_VIRTUAL_REF: "on"}))
+        hosting_fixture = self.useFixture(GitHostingFixture())
+        mp = self.factory.makeBranchMergeProposalForGit()
+        source_repo = mp.source_git_repository
+        target_repo = mp.target_git_repository
+        source_repo.transitionToInformationType(
+            InformationType.PRIVATESECURITY, source_repo.owner, False)
+        Store.of(source_repo).flush()
+
+        hosting_fixture.copyRefs.resetCalls()
+        hosting_fixture.deleteRef.resetCalls()
+        with dbuser("branchscanner"):
+            job_set = JobRunner.fromReady(
+                getUtility(IGitRepositoryVirtualRefsSyncJobSource))
+            job_set.runAll()
+            self.assertEqual(1, len(job_set.completed_jobs))
+
+        self.assertEqual(0, hosting_fixture.copyRefs.call_count)
+        self.assertEqual(1, hosting_fixture.deleteRef.call_count)
+        args, kwargs = hosting_fixture.deleteRef.calls[0]
+        self.assertEqual(
+            (target_repo.getInternalPath(), 'refs/merge/%s/head' % mp.id),
+            args)
+
 # XXX cjwatson 2015-03-12: We should test that the jobs work via Celery too,
 # but that isn't feasible until we have a proper turnip fixture.
diff --git a/lib/lp/code/model/tests/test_gitrepository.py b/lib/lp/code/model/tests/test_gitrepository.py
index 62bf865..6a9fa20 100644
--- a/lib/lp/code/model/tests/test_gitrepository.py
+++ b/lib/lp/code/model/tests/test_gitrepository.py
@@ -18,6 +18,7 @@ from datetime import (
 import email
 from functools import partial
 import hashlib
+import itertools
 import json
 
 from breezy import urlutils
@@ -89,6 +90,7 @@ from lp.code.interfaces.defaultgit import ICanHasDefaultGitRepository
 from lp.code.interfaces.gitjob import (
     IGitRefScanJobSource,
     IGitRepositoryModifiedMailJobSource,
+    IGitRepositoryVirtualRefsSyncJobSource,
     )
 from lp.code.interfaces.gitlookup import IGitLookup
 from lp.code.interfaces.gitnamespace import (
@@ -96,6 +98,7 @@ from lp.code.interfaces.gitnamespace import (
     IGitNamespaceSet,
     )
 from lp.code.interfaces.gitrepository import (
+    GIT_CREATE_MP_VIRTUAL_REF,
     IGitRepository,
     IGitRepositorySet,
     IGitRepositoryView,
@@ -113,6 +116,7 @@ from lp.code.model.branchmergeproposaljob import (
     )
 from lp.code.model.codereviewcomment import CodeReviewComment
 from lp.code.model.gitactivity import GitActivity
+from lp.code.model.githosting import RefCopyOperation
 from lp.code.model.gitjob import (
     GitJob,
     GitJobType,
@@ -146,6 +150,7 @@ from lp.registry.interfaces.personociproject import IPersonOCIProjectFactory
 from lp.registry.interfaces.personproduct import IPersonProductFactory
 from lp.registry.tests.test_accesspolicy import get_policies_for_artifact
 from lp.services.authserver.xmlrpc import AuthServerAPIView
+from lp.services.compat import mock
 from lp.services.config import config
 from lp.services.database.constants import UTC_NOW
 from lp.services.database.interfaces import IStore
@@ -180,6 +185,7 @@ from lp.testing import (
     verifyObject,
     )
 from lp.testing.dbuser import dbuser
+from lp.testing.fixture import ZopeUtilityFixture
 from lp.testing.layers import (
     DatabaseFunctionalLayer,
     LaunchpadFunctionalLayer,
@@ -782,6 +788,7 @@ class TestGitRepositoryDeletion(TestCaseWithFactory):
         # Make sure that the tests all flush the database changes.
         self.addCleanup(Store.of(self.repository).flush)
         login_person(self.user)
+        self.hosting_fixture = self.useFixture(GitHostingFixture())
 
     def test_deletable(self):
         # A newly created repository can be deleted without any problems.
@@ -823,7 +830,6 @@ class TestGitRepositoryDeletion(TestCaseWithFactory):
 
     def test_code_import_does_not_disable_deletion(self):
         # A repository that has an attached code import can be deleted.
-        self.useFixture(GitHostingFixture())
         code_import = self.factory.makeCodeImport(
             target_rcs_type=TargetRevisionControlSystems.GIT)
         repository = code_import.git_repository
@@ -983,6 +989,7 @@ class TestGitRepositoryDeletionConsequences(TestCaseWithFactory):
         # unsubscribe the repository owner here.
         self.repository.unsubscribe(
             self.repository.owner, self.repository.owner)
+        self.hosting_fixture = self.useFixture(GitHostingFixture())
 
     def test_plain_repository(self):
         # A fresh repository has no deletion requirements.
@@ -1114,7 +1121,6 @@ class TestGitRepositoryDeletionConsequences(TestCaseWithFactory):
 
     def test_code_import_requirements(self):
         # Code imports are not included explicitly in deletion requirements.
-        self.useFixture(GitHostingFixture())
         code_import = self.factory.makeCodeImport(
             target_rcs_type=TargetRevisionControlSystems.GIT)
         # Remove the implicit repository subscription first.
@@ -1125,7 +1131,6 @@ class TestGitRepositoryDeletionConsequences(TestCaseWithFactory):
 
     def test_code_import_deletion(self):
         # break_references allows deleting a code import repository.
-        self.useFixture(GitHostingFixture())
         code_import = self.factory.makeCodeImport(
             target_rcs_type=TargetRevisionControlSystems.GIT)
         code_import_id = code_import.id
@@ -1181,7 +1186,6 @@ class TestGitRepositoryDeletionConsequences(TestCaseWithFactory):
 
     def test_DeleteCodeImport(self):
         # DeleteCodeImport.__call__ must delete the CodeImport.
-        self.useFixture(GitHostingFixture())
         code_import = self.factory.makeCodeImport(
             target_rcs_type=TargetRevisionControlSystems.GIT)
         code_import_id = code_import.id
@@ -1520,6 +1524,10 @@ class TestGitRepositoryRefs(TestCaseWithFactory):
 
     layer = DatabaseFunctionalLayer
 
+    def setUp(self):
+        super(TestGitRepositoryRefs, self).setUp()
+        self.hosting_fixture = self.useFixture(GitHostingFixture())
+
     def test__convertRefInfo(self):
         # _convertRefInfo converts a valid info dictionary.
         sha1 = unicode(hashlib.sha1("").hexdigest())
@@ -1788,18 +1796,17 @@ class TestGitRepositoryRefs(TestCaseWithFactory):
         # planRefChanges excludes some ref prefixes by default, and can be
         # configured otherwise.
         repository = self.factory.makeGitRepository()
-        hosting_fixture = self.useFixture(GitHostingFixture())
         repository.planRefChanges("dummy")
         self.assertEqual(
             [{"exclude_prefixes": ["refs/changes/"]}],
-            hosting_fixture.getRefs.extract_kwargs())
-        hosting_fixture.getRefs.calls = []
+            self.hosting_fixture.getRefs.extract_kwargs())
+        self.hosting_fixture.getRefs.calls = []
         self.pushConfig(
             "codehosting", git_exclude_ref_prefixes="refs/changes/ refs/pull/")
         repository.planRefChanges("dummy")
         self.assertEqual(
             [{"exclude_prefixes": ["refs/changes/", "refs/pull/"]}],
-            hosting_fixture.getRefs.extract_kwargs())
+            self.hosting_fixture.getRefs.extract_kwargs())
 
     def test_fetchRefCommits(self):
         # fetchRefCommits fetches detailed tip commit metadata for the
@@ -1871,9 +1878,8 @@ class TestGitRepositoryRefs(TestCaseWithFactory):
     def test_fetchRefCommits_empty(self):
         # If given an empty refs dictionary, fetchRefCommits returns early
         # without contacting the hosting service.
-        hosting_fixture = self.useFixture(GitHostingFixture())
         GitRepository.fetchRefCommits("dummy", {})
-        self.assertEqual([], hosting_fixture.getCommits.calls)
+        self.assertEqual([], self.hosting_fixture.getCommits.calls)
 
     def test_synchroniseRefs(self):
         # synchroniseRefs copes with synchronising a repository where some
@@ -1916,7 +1922,6 @@ class TestGitRepositoryRefs(TestCaseWithFactory):
         self.assertThat(repository.refs, MatchesSetwise(*matchers))
 
     def test_set_default_branch(self):
-        hosting_fixture = self.useFixture(GitHostingFixture())
         repository = self.factory.makeGitRepository()
         self.factory.makeGitRefs(
             repository=repository,
@@ -1927,22 +1932,20 @@ class TestGitRepositoryRefs(TestCaseWithFactory):
         self.assertEqual(
             [((repository.getInternalPath(),),
              {"default_branch": "refs/heads/new"})],
-            hosting_fixture.setProperties.calls)
+            self.hosting_fixture.setProperties.calls)
         self.assertEqual("refs/heads/new", repository.default_branch)
 
     def test_set_default_branch_unchanged(self):
-        hosting_fixture = self.useFixture(GitHostingFixture())
         repository = self.factory.makeGitRepository()
         self.factory.makeGitRefs(
             repository=repository, paths=["refs/heads/master"])
         removeSecurityProxy(repository)._default_branch = "refs/heads/master"
         with person_logged_in(repository.owner):
             repository.default_branch = "master"
-        self.assertEqual([], hosting_fixture.setProperties.calls)
+        self.assertEqual([], self.hosting_fixture.setProperties.calls)
         self.assertEqual("refs/heads/master", repository.default_branch)
 
     def test_set_default_branch_imported(self):
-        hosting_fixture = self.useFixture(GitHostingFixture())
         repository = self.factory.makeGitRepository(
             repository_type=GitRepositoryType.IMPORTED)
         self.factory.makeGitRefs(
@@ -1955,7 +1958,7 @@ class TestGitRepositoryRefs(TestCaseWithFactory):
                 "Cannot modify non-hosted Git repository %s." %
                     repository.display_name,
                 setattr, repository, "default_branch", "new")
-        self.assertEqual([], hosting_fixture.setProperties.calls)
+        self.assertEqual([], self.hosting_fixture.setProperties.calls)
         self.assertEqual("refs/heads/master", repository.default_branch)
 
     def test_exception_unset_default_branch(self):
@@ -2576,18 +2579,59 @@ class TestGitRepositoryUpdateLandingTargets(TestCaseWithFactory):
 
     layer = DatabaseFunctionalLayer
 
-    def test_schedules_diff_updates(self):
+    def setUp(self):
+        super(TestGitRepositoryUpdateLandingTargets, self).setUp()
+        self.hosting_fixture = self.useFixture(GitHostingFixture())
+
+    def assertSchedulesDiffUpdate(self, with_mp_virtual_ref):
         """Create jobs for all merge proposals."""
         bmp1 = self.factory.makeBranchMergeProposalForGit()
         bmp2 = self.factory.makeBranchMergeProposalForGit(
             source_ref=bmp1.source_git_ref)
-        jobs = bmp1.source_git_repository.updateLandingTargets(
+
+        # Only enable this virtual ref here, since
+        # self.factory.makeBranchMergeProposalForGit also tries to create
+        # the virtual refs.
+        if with_mp_virtual_ref:
+            self.useFixture(FeatureFixture({GIT_CREATE_MP_VIRTUAL_REF: "on"}))
+        else:
+            self.useFixture(FeatureFixture({GIT_CREATE_MP_VIRTUAL_REF: ""}))
+        jobs, ref_copies = bmp1.source_git_repository.updateLandingTargets(
             [bmp1.source_git_path])
         self.assertEqual(2, len(jobs))
         bmps_to_update = [
             removeSecurityProxy(job).branch_merge_proposal for job in jobs]
         self.assertContentEqual([bmp1, bmp2], bmps_to_update)
 
+        if not with_mp_virtual_ref:
+            self.assertEqual(0, self.hosting_fixture.copyRefs.call_count)
+        else:
+            self.assertEqual(1, self.hosting_fixture.copyRefs.call_count)
+            args, kwargs = self.hosting_fixture.copyRefs.calls[0]
+            self.assertEqual({}, kwargs)
+            self.assertEqual(2, len(args))
+            path, operations = args
+            self.assertEqual(
+                path, bmp1.source_git_repository.getInternalPath())
+            self.assertThat(operations[0], MatchesStructure(
+                source_ref=Equals(bmp1.source_git_commit_sha1),
+                target_repo=Equals(
+                    bmp1.target_git_repository.getInternalPath()),
+                target_ref=Equals("refs/merge/%s/head" % bmp1.id),
+            ))
+            self.assertThat(operations[1], MatchesStructure(
+                source_ref=Equals(bmp2.source_git_commit_sha1),
+                target_repo=Equals(
+                    bmp2.target_git_repository.getInternalPath()),
+                target_ref=Equals("refs/merge/%s/head" % bmp2.id),
+            ))
+
+    def test_schedules_diff_updates_with_mp_virtual_ref(self):
+        self.assertSchedulesDiffUpdate(True)
+
+    def test_schedules_diff_updates_without_mp_virtual_ref(self):
+        self.assertSchedulesDiffUpdate(False)
+
     def test_ignores_final(self):
         """Diffs for proposals in final states aren't updated."""
         [source_ref] = self.factory.makeGitRefs()
@@ -2599,8 +2643,15 @@ class TestGitRepositoryUpdateLandingTargets(TestCaseWithFactory):
         for bmp in source_ref.landing_targets:
             if bmp.queue_status not in FINAL_STATES:
                 removeSecurityProxy(bmp).deleteProposal()
-        jobs = source_ref.repository.updateLandingTargets([source_ref.path])
+
+        # Enable the feature here, since factory.makeBranchMergeProposalForGit
+        # would also trigger the copy refs call.
+        self.useFixture(FeatureFixture({GIT_CREATE_MP_VIRTUAL_REF: "on"}))
+        jobs, ref_copies = source_ref.repository.updateLandingTargets(
+            [source_ref.path])
         self.assertEqual(0, len(jobs))
+        self.assertEqual(0, len(ref_copies))
+        self.assertEqual(0, self.hosting_fixture.copyRefs.call_count)
 
 
 class TestGitRepositoryMarkRecipesStale(TestCaseWithFactory):
@@ -4616,3 +4667,61 @@ class TestGitRepositoryMacaroonIssuer(MacaroonTestMixin, TestCaseWithFactory):
                 ["Caveat check for '%s' failed." %
                  find_caveats_by_name(macaroon2, "lp.expires")[0].caveat_id],
                 issuer, macaroon2, repository, user=repository.owner)
+
+
+class TestGitRepositoryPrivacyChangeSyncVirtualRefs(TestCaseWithFactory):
+    layer = DatabaseFunctionalLayer
+
+    def assertChangePrivacyTriggersSync(
+            self, from_list, to_list, should_trigger_sync=True):
+        """Runs repository.transitionToInformationType from every item in
+        `from_list` to each item in `to_list`, and checks if the virtual
+        refs sync was triggered or not, depending on `should_trigger_sync`."""
+        sync_job = mock.Mock()
+        self.useFixture(ZopeUtilityFixture(
+            sync_job, IGitRepositoryVirtualRefsSyncJobSource))
+
+        admin = self.factory.makeAdministrator()
+        login_person(admin)
+        for from_type, to_type in itertools.product(from_list, to_list):
+            if from_type == to_type:
+                continue
+            repository = self.factory.makeGitRepository()
+            naked_repo = removeSecurityProxy(repository)
+            naked_repo.information_type = from_type
+            # Skip access policy reconciliation.
+            naked_repo._reconcileAccess = mock.Mock()
+            naked_repo.transitionToInformationType(to_type, admin, False)
+
+            if should_trigger_sync:
+                sync_job.create.assert_called_with(repository)
+            else:
+                self.assertEqual(
+                    0, sync_job.create.call_count,
+                    "Changing from %s to %s should't trigger vrefs sync"
+                    % (from_type, to_type))
+                sync_job.reset_mock()
+
+    def test_setting_repo_public_triggers_ref_sync_job(self):
+        self.assertChangePrivacyTriggersSync(
+            PRIVATE_INFORMATION_TYPES,
+            PUBLIC_INFORMATION_TYPES,
+            should_trigger_sync=True)
+
+    def test_setting_repo_private_triggers_ref_sync_job(self):
+        self.assertChangePrivacyTriggersSync(
+            PUBLIC_INFORMATION_TYPES,
+            PRIVATE_INFORMATION_TYPES,
+            should_trigger_sync=True)
+
+    def test_keeping_repo_private_dont_trigger_ref_sync_job(self):
+        self.assertChangePrivacyTriggersSync(
+            PRIVATE_INFORMATION_TYPES,
+            PRIVATE_INFORMATION_TYPES,
+            should_trigger_sync=False)
+
+    def test_keeping_repo_public_dont_trigger_ref_sync_job(self):
+        self.assertChangePrivacyTriggersSync(
+            PUBLIC_INFORMATION_TYPES,
+            PUBLIC_INFORMATION_TYPES,
+            should_trigger_sync=False)
diff --git a/lib/lp/code/subscribers/branchmergeproposal.py b/lib/lp/code/subscribers/branchmergeproposal.py
index a214c8f..b394388 100644
--- a/lib/lp/code/subscribers/branchmergeproposal.py
+++ b/lib/lp/code/subscribers/branchmergeproposal.py
@@ -1,4 +1,4 @@
-# Copyright 2010-2016 Canonical Ltd.  This software is licensed under the
+# Copyright 2010-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Event subscribers for branch merge proposals."""
@@ -63,9 +63,13 @@ def _trigger_webhook(merge_proposal, payload):
 def merge_proposal_created(merge_proposal, event):
     """A new merge proposal has been created.
 
-    Create a job to update the diff for the merge proposal; trigger webhooks.
+    Create a job to update the diff for the merge proposal; trigger webhooks
+    and copy virtual refs as needed.
     """
     getUtility(IUpdatePreviewDiffJobSource).create(merge_proposal)
+
+    merge_proposal.syncGitHostingVirtualRefs()
+
     if getFeatureFlag(BRANCH_MERGE_PROPOSAL_WEBHOOKS_FEATURE_FLAG):
         payload = {
             "action": "created",
diff --git a/lib/lp/code/tests/helpers.py b/lib/lp/code/tests/helpers.py
index 0e784f0..90a7a87 100644
--- a/lib/lp/code/tests/helpers.py
+++ b/lib/lp/code/tests/helpers.py
@@ -368,6 +368,8 @@ class GitHostingFixture(fixtures.Fixture):
         self.getBlob = FakeMethod(result=blob)
         self.delete = FakeMethod()
         self.disable_memcache = disable_memcache
+        self.copyRefs = FakeMethod()
+        self.deleteRef = FakeMethod()
 
     def _setUp(self):
         self.useFixture(ZopeUtilityFixture(self, IGitHostingClient))
diff --git a/lib/lp/services/config/schema-lazr.conf b/lib/lp/services/config/schema-lazr.conf
index bb8afcd..3921da2 100644
--- a/lib/lp/services/config/schema-lazr.conf
+++ b/lib/lp/services/config/schema-lazr.conf
@@ -1828,6 +1828,10 @@ module: lp.code.interfaces.gitjob
 dbuser: send-branch-mail
 crontab_group: MAIN
 
+[IGitRepositoryVirtualRefsSyncJobSource]
+module: lp.code.interfaces.gitjob
+dbuser: branchscanner
+
 [IInitializeDistroSeriesJobSource]
 module: lp.soyuz.interfaces.distributionjob
 dbuser: initializedistroseries
diff --git a/lib/lp/testing/fakemethod.py b/lib/lp/testing/fakemethod.py
index 4bba8d3..b4895ce 100644
--- a/lib/lp/testing/fakemethod.py
+++ b/lib/lp/testing/fakemethod.py
@@ -1,4 +1,4 @@
-# Copyright 2009-2011 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 __metaclass__ = type
@@ -57,3 +57,6 @@ class FakeMethod:
     def extract_kwargs(self):
         """Return just the calls' keyword-arguments dicts."""
         return [kwargs for args, kwargs in self.calls]
+
+    def resetCalls(self):
+        self.calls = []