Recipe auditing, security and maintenance - Seal of approval
//www.gstatic.com/images/branding/product/1x/groups_32dp.png
./autopkg verify-trust-info AdobeFlashPlayer.munki

AdobeFlashPlayer.munki: NO TRUST INFO

Currently an autopkg run will not warn the admin that the override doesn't contain trust information.

2. Perhaps a new preference: RequireOverrideTrustInfo. If someone attempts to remove the trust information from an override, autopkg will refuse to run that particular override. Perhaps this key would also require each recipe that is ran to have an override, containing the trust info. You would not be able to run the default recipes.

3. The git diffs will only work if you are using autopkg repo-add. If you are managing repos and ignoring each recipe repo's own git information, this information will not be generated. I think for the few people doing something like this, that will be OK.

Other than that, it looks really good.