tree d20ffbc8160430782680e10ce121b678cdc8e940
parent 69297c1b771bbbd05b63e965a524de6860d15d8c
author Mike Frysinger <vapier@google.com> 1471310624 -0400
committer Mike Frysinger <vapier@google.com> 1471366972 -0400

RepoHook: allow users to approve hooks via manifests

The constant prompting when registered hooks change can be tedious and
has a large multiplication factor when the project is large (e.g. the
AOSP).  It gets worse as people want to write more checks, hooks, docs,
and tests (or fix bugs), but every CL that goes in will trigger a new
prompt to approve.

Let's tweak our trust model when it comes to hooks.  Since people start
off by calling `repo init` with a URL to a manifest, and that manifest
defines all the hooks, anchor trust in that.  This requires that we get
the manifest over a trusted link (e.g. https or ssh) so that it can't
be MITM-ed.  If the user chooses to use an untrusted link (e.g. git or
http), then we'll fallback to the existing hash based approval.

Bug: Issue 226
Change-Id: I77be9e4397383f264fcdaefb582e345ea4069a13