Added PRESUBMIT check running gclient VERIFY.

PRESUBMIT.py

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 """Top-level presubmit script for Chromium.
 
 See http://dev.chromium.org/developers/how-tos/depottools/presubmit-scripts
 for more details about the presubmit API built into gcl.
 """
 
@@ skipping 378 matching lines @@
       input_api.AffectedFiles()):
     return [output_api.PresubmitError(
       'Never commit changes to .DEPS.git. This file is maintained by an\n'
       'automated system based on what\'s in DEPS and your changes will be\n'
       'overwritten.\n'
       'See https://sites.google.com/a/chromium.org/dev/developers/how-tos/get-the-code#Rolling_DEPS\n'
       'for more information')]
   return []
 
 
+def _CheckValidHostsInDEPS(input_api, output_api):
+  """Checks that DEPS file deps are from allowed_hosts."""
+  # Run only if DEPS file has been modified to annoy fewer bystanders.
+  for f in input_api.AffectedFiles():
+    if f.LocalPath().endswith("DEPS"):
+      break

[iannucci, 2014/09/18 21:05:13]

why not

if 'DEPS' not in input_api.AffectedFiles():
  return []

since we really care about the root one?

[tandrii(chromium), 2014/09/18 22:01:36]

Good point, though AffectedFiles() isn't a list of LocalPaths.

+  else:
+    return []
+  # Outsource work to gclient verify
+  try:
+    input_api.subprocess.check_output(['gclient', 'verify'])
+    return []
+  except input_api.subprocess.CalledProcessError, error:
+    return [output_api.PresubmitError(
+        'DEPS file must have only git dependencies.',
+        # Python's subprocess.check_call docs says .output attribute contains
+        # output. However, the subprocess is our wrapper (in depot_tools),
+        # and it differs by storing stdout in stdout, and output is never set.
+        long_text=error.output or error.stdout)]

[iannucci, 2014/09/18 21:05:13]

ugh, this is exactly what I'm worried about.

[tandrii(chromium), 2014/09/18 22:01:36]

As you have already seen, https://codereview.chromium.org/582933002/ attempts to
fix that. I'd rather remove the "or" and leave one. Since that CL is not yet
committed, I made this CL future-proof with "or".

+
+
 def _CheckNoBannedFunctions(input_api, output_api):
   """Make sure that banned functions are not used."""
   warnings = []
   errors = []
 
   file_filter = lambda f: f.LocalPath().endswith(('.mm', '.m', '.h'))
   for f in input_api.AffectedFiles(file_filter=file_filter):
     for line_num, line in f.ChangedContents():
       for func_name, message, error in _BANNED_OBJC_FUNCTIONS:
         matched = False
@@ skipping 990 matching lines @@
   if problems:
     return [output_api.PresubmitPromptWarning(
         _IPC_ENUM_TRAITS_DEPRECATED, problems)]
   else:
     return []
 
 
 def CheckChangeOnUpload(input_api, output_api):
   results = []
   results.extend(_CommonChecks(input_api, output_api))
+  results.extend(_CheckValidHostsInDEPS(input_api, output_api))
   results.extend(_CheckJavaStyle(input_api, output_api))
   return results
 
 
 def GetTryServerMasterForBot(bot):
   """Returns the Try Server master for the given bot.
 
   It tries to guess the master from the bot name, but may still fail
   and return None.  There is no longer a default master.
   """
@@ skipping 202 matching lines @@
     builders.extend(['cros_x86'])
 
   # The AOSP bot doesn't build the chrome/ layer, so ignore any changes to it
   # unless they're .gyp(i) files as changes to those files can break the gyp
   # step on that bot.
   if (not all(re.search('^chrome', f) for f in files) or
       any(re.search('\.gypi?$', f) for f in files)):
     builders.extend(['android_aosp'])
 
   return GetDefaultTryConfigs(builders)