[infra] Add and check 'allowed_hosts' in DEPS file

Change-Id: I3f9bb1b903c36da537357d6cdc629e0802b6393a
Reviewed-on: https://dart-review.googlesource.com/32680
Reviewed-by: Siva Annamalai <asiva@google.com>
Commit-Queue: Zach Anderson <zra@google.com>

DEPS

@@ -6,6 +6,13 @@
 # Before adding or updating dependencies, please review the documentation here:
 # https://github.com/dart-lang/sdk/wiki/Adding-and-Updating-Dependencies
 
+allowed_hosts = [
+  'boringssl.googlesource.com',
+  'chromium.googlesource.com',
+  'dart.googlesource.com',
+  'fuchsia.googlesource.com',
+]
+
 vars = {
   # The dart_root is the root of our sdk checkout. This is normally
   # simply sdk, but if using special gclient specs it can be different.

PRESUBMIT.py

@@ -225,14 +225,31 @@ def _CheckStatusFiles(input_api, output_api):
   return []
 
 
+def _CheckValidHostsInDEPS(input_api, output_api):
+  """Checks that DEPS file deps are from allowed_hosts."""
+  # Run only if DEPS file has been modified to annoy fewer bystanders.
+  if all(f.LocalPath() != 'DEPS' for f in input_api.AffectedFiles()):
+    return []
+  # Outsource work to gclient verify
+  try:
+    input_api.subprocess.check_output(['gclient', 'verify'])
+    return []
+  except input_api.subprocess.CalledProcessError, error:
+    return [output_api.PresubmitError(
+        'DEPS file must have only dependencies from allowed hosts.',
+        long_text=error.output)]
+
+
 def CheckChangeOnCommit(input_api, output_api):
-  return (_CheckBuildStatus(input_api, output_api) +
+  return (_CheckValidHostsInDEPS(input_api, output_api) +
+          _CheckBuildStatus(input_api, output_api) +
           _CheckNewTests(input_api, output_api) +
           _CheckDartFormat(input_api, output_api) +
           _CheckStatusFiles(input_api, output_api))
 
 
 def CheckChangeOnUpload(input_api, output_api):
-  return (_CheckNewTests(input_api, output_api) +
+  return (_CheckValidHostsInDEPS(input_api, output_api) +
+          _CheckNewTests(input_api, output_api) +
           _CheckDartFormat(input_api, output_api) +
           _CheckStatusFiles(input_api, output_api))