Add security notice to be shown after install and upgrade

cmd/krew/cmd/install.go

@@ -19,14 +19,15 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/golang/glog"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+
+	"sigs.k8s.io/krew/pkg/constants"
 	"sigs.k8s.io/krew/pkg/index"
 	"sigs.k8s.io/krew/pkg/index/indexscanner"
 	"sigs.k8s.io/krew/pkg/index/validation"
 	"sigs.k8s.io/krew/pkg/installation"
-
-	"github.com/golang/glog"
-	"github.com/pkg/errors"
-	"github.com/spf13/cobra"
 )
 
 func init() {
@@ -148,6 +149,9 @@ Remarks:
 			}
 			return ensureIndexUpdated(cmd, args)
 		},
+		PostRun: func(_ *cobra.Command, args []string) {
+			fmt.Fprintln(os.Stderr, constants.SecurityNotice)
+		},
 	}
 
 	manifest = installCmd.Flags().String("manifest", "", "(Development-only) specify plugin manifest directly.")

cmd/krew/cmd/upgrade.go

@@ -18,12 +18,13 @@ import (
 	"fmt"
 	"os"
 
-	"sigs.k8s.io/krew/pkg/index/indexscanner"
-	"sigs.k8s.io/krew/pkg/installation"
-
 	"github.com/golang/glog"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
+
+	"sigs.k8s.io/krew/pkg/constants"
+	"sigs.k8s.io/krew/pkg/index/indexscanner"
+	"sigs.k8s.io/krew/pkg/installation"
 )
 
 func init() {
@@ -81,6 +82,9 @@ kubectl krew upgrade foo bar"`,
 			}
 			return ensureIndexUpdated(cmd, args)
 		},
+		PostRun: func(_ *cobra.Command, args []string) {
+			fmt.Fprintln(os.Stderr, constants.SecurityNotice)
+		},
 	}
 
 	noUpdateIndex = upgradeCmd.Flags().Bool("no-update-index", false, "(Experimental) do not update local copy of plugin index before upgrading")

pkg/constants/constants.go

@@ -21,4 +21,9 @@ const (
 
 	// IndexURI points to the upstream index.
 	IndexURI = "https://github.com/kubernetes-sigs/krew-index.git"
+
+	SecurityNotice = `
+>> Plugins do not undergo any kind of security validation.
+>> Please keep in mind that you are running these plugins at your own risk.
+`
 )