add prechangegroup and pretxnchangegroup hooks.

prechangegroup lets you stop push, pull or unbundle before it begins.
pretxnchangegroup lets you inspect changegroup before transaction is
committed, and roll back if you not like it.

doc/hgrc.5.txt

@@ -146,8 +146,8 b' hooks::'
     incoming.autobuild = /my/build/hook
 
   changegroup;;
-    Run after a changegroup has been added via push or pull. Passed
-    the ID of the first new changeset in $NODE.
+    Run after a changegroup has been added via push, pull or
+    unbundle. Passed the ID of the first new changeset in $NODE.
   commit;;
     Run after a changeset has been created in the local repository.
     Passed the ID of the newly created changeset in environment
@@ -156,6 +156,10 b' hooks::'
     Run after a changeset has been pulled, pushed, or unbundled into
     the local repository.  Passed the ID of the newly arrived
     changeset in environment variable $NODE.
+  prechangegroup;;
+    Run before a changegroup is added via push, pull or unbundle.
+    Exit status 0 allows the changegroup to proceed.  Non-zero status
+    will cause the push, pull or unbundle to fail.
   precommit;;
     Run before starting a local commit.  Exit status 0 allows the
     commit to proceed.  Non-zero status will cause the commit to
@@ -165,6 +169,14 b' hooks::'
     created.  Non-zero status will cause the tag to fail.  ID of
     changeset to tag in $NODE.  Name of tag in $TAG.  Tag is local if
     $LOCAL=1, in repo if $LOCAL=0.
+  pretxnchangegroup;;
+    Run after a changegroup has been added via push, pull or unbundle,
+    but before the transaction has been committed.  Changegroup is
+    visible to hook program.  This lets you validate incoming changes
+    before accepting them.  Passed the ID of the first new changeset
+    in $NODE.  Exit status 0 allows the transaction to commit.
+    Non-zero status will cause the transaction to be rolled back and
+    the push, pull or unbundle will fail.
   pretxncommit;;
     Run after a changeset has been created but the transaction not yet
     committed.  Changeset is visible to hook program.  This lets you

mercurial/localrepo.py

@@ -1342,6 +1342,9 b' class localrepository(object):'
 
         if not source:
             return
+
+        self.hook('prechangegroup', throw=True)
+
         changesets = files = revisions = 0
 
         tr = self.transaction()
@@ -1384,6 +1387,9 b' class localrepository(object):'
                          " with %d changes to %d files%s\n")
                          % (changesets, revisions, files, heads))
 
+        self.hook('pretxnchangegroup', throw=True,
+                  node=hex(self.changelog.node(cor+1)))
+
         tr.close()
 
         if changesets > 0: