drupalorg drush not enforcing certain constraints on libraries, only projects

Of course it's possible. ;)

Are you asking if I have time in the near future to fix this? That's less likely. But, I'll see what I can do...

Meanwhile, if anyone else wants to take a stab, the relevant code is this chunk from drupalorg_drush.drush.inc:

    if (!empty($info['libraries'])) {
      if ($drupal_org === 'core') {
        make_error('BUILD_ERROR', dt('Defining libraries in a drupal-org-core.make file is not permitted.'));
        $pass = FALSE;
      }
      else {
        $library_transformer = new DrushMakeDo_LibraryWhitelist('make');
        if ($library_transformer->whitelist_loaded()) {
          foreach ($info['libraries'] as $library => $library_data) {
            drush_log(dt("Running transformer DrushMakeDo_LibraryWhitelist on .make file for library !library", array('!library' => $library)), 'debug');
            if ($library_transformer->verify($library_data, $library)) {
              if (drupalorg_drush_metadata_file()) {
                drupalorg_drush_metadata('library', $library, drupalorg_drush_get_library_metadata($library_data));
              }
            }
            else {
              $pass = FALSE;
            }
            $info['libraries'][$library] = $library_data;
          }
        }
        else {
          $pass = FALSE;
        }
      }
    }

Therefore, right now, all we verify is the download URL for libraries (that's what DrushMakeDo_LibraryWhitelist is enforcing). Everything else is permitted. The case above this for other kinds of projects (modules, themes, etc) has an array of transformers, and for each project, we iterate over all the transformers and call verify() on each one:

      foreach ($info['projects'] as $project => $project_data) {
        ...
        foreach ($transformers['project'] as $transformer) {
          drush_log(dt("Running transformer !transformer on .make file for project !project", array('!transformer' => $transformer, '!project' => $project)), 'debug');
          $object = new $transformer('make');
          if (!$object->verify($project_data, $project, $info['core'])) {
            $pass = FALSE;
          }
        }
      }

So:

A) We need to decide what directives are allowed/denied for libraries.
B) We need to do something similar where we iterate over a list of transformers for libraries.
C) We need decide which of the project transformers can be reused for libraries (if any).
D) We (might) need to write/customize other transformers to finish implementing the policy in A.
E) We need to write tests that check this.

Anyone could be working on A (and potentially E), even if you're not comfortable enough with B, C and D (although it's pretty obvious code once you look around a bit).

Cheers,
-Derek