Allow build hooks in sketch directory

[jgfoster]

I understand that hooks are available by modifying a recipe in the toolchain. The disadvantage of this approach is that someone who downloads my sketch or library must modify their toolchain, and this isn't trivial for a novice. Also the changes apply to all sketches, not just to my sketch.

My request is that the toolchain look in the sketch or library directory for custom hooks. That way I could rely on them being present without toolchain modifications. Specifically, I want to do something like git-describe-arduino.

Or perhaps I'm not understanding things (being a bit of an Arduino-novice myself!)

[matthijskooijman]

Even though sketch-specific hooks would definitely be useful, a lot of care must be taken to keep things secure. If any sketch can cause arbitrary commands to be ran during a build, that creates a security problem when people download and a compile an untrusted sketch.

This problem does not really exist for build hooks inside a third-party Arduino core/platform, since a platform already controls executing of the compiler, so build hooks add no extra attack surface here. In other words: When you install a third party platform, you can expect that it can execute arbitrary commands and should be more careful to review the source of the platform (if this really happens in practice, I'm not so sure), when you compile a third-party sketch, it would (IMHO) not be reasonable to expect that can execute arbitrary commands.

So if something like this is implemented (git-describe is definitely a usecase I would like to use), it must be done with care. Solutions that spring to mind would be having a whitelist of commands that are safe (not so flexible), or installing/whitelisting commands separately that can then be used by sketches, or asking in a prompt whether running a hook is ok (but that is fragile, people tend to just press "ok" without really checking).