General way to marking a hook as trusted/untrusted about brigade

[bacongobbler]

Comment by technosophos
2017-10-10 20:58:59

---

I would strongly prefer that this is a configurable thing via the Project.

[technosophos]

We implemented a specific fix for the GitHub gateway. Might still be a way to do a general fix.

[technosophos]

So I think the general design of this would be to add an attribute on the event that was something like trusted: false. The Worker's index.ts would then wipe out the project.secrets.

But the problem is that the worker can still manually load the project and bypass the taint. So really this doesn't get us much more than a band-aid.

[krancour]

Closing due to staleness. Please do re-open if appropriate.