Added PRESUBMIT check running gclient VERIFY.

PRESUBMIT.py

Index: PRESUBMIT.py
diff --git a/PRESUBMIT.py b/PRESUBMIT.py
index 8c55309ec627c7aed1718c54d86029cb75aa6e89..d1e56b140cc2c544c941873767f311eff4cc7944 100644
--- a/PRESUBMIT.py
+++ b/PRESUBMIT.py
@@ -396,6 +396,27 @@ def _CheckNoDEPSGIT(input_api, output_api):
   return []
 
 
+def _CheckValidHostsInDEPS(input_api, output_api):
+  """Checks that DEPS file deps are from allowed_hosts."""
+  # Run only if DEPS file has been modified to annoy fewer bystanders.
+  for f in input_api.AffectedFiles():
+    if f.LocalPath().endswith("DEPS"):
+      break

[iannucci, 2014/09/18 21:05:13]

why not

if 'DEPS' not in input_api.AffectedFiles():
  return []

since we really care about the root one?

[tandrii(chromium), 2014/09/18 22:01:36]

Good point, though AffectedFiles() isn't a list of LocalPaths.

+  else:
+    return []
+  # Outsource work to gclient verify
+  try:
+    input_api.subprocess.check_output(['gclient', 'verify'])
+    return []
+  except input_api.subprocess.CalledProcessError, error:
+    return [output_api.PresubmitError(
+        'DEPS file must have only git dependencies.',
+        # Python's subprocess.check_call docs says .output attribute contains
+        # output. However, the subprocess is our wrapper (in depot_tools),
+        # and it differs by storing stdout in stdout, and output is never set.
+        long_text=error.output or error.stdout)]

[iannucci, 2014/09/18 21:05:13]

ugh, this is exactly what I'm worried about.

[tandrii(chromium), 2014/09/18 22:01:36]

As you have already seen, https://codereview.chromium.org/582933002/ attempts to
fix that. I'd rather remove the "or" and leave one. Since that CL is not yet
committed, I made this CL future-proof with "or".

+
+
 def _CheckNoBannedFunctions(input_api, output_api):
   """Make sure that banned functions are not used."""
   warnings = []
@@ -1406,6 +1427,7 @@ def _CheckForIPCRules(input_api, output_api):
 def CheckChangeOnUpload(input_api, output_api):
   results = []
   results.extend(_CommonChecks(input_api, output_api))
+  results.extend(_CheckValidHostsInDEPS(input_api, output_api))
   results.extend(_CheckJavaStyle(input_api, output_api))
   return results