From 07e3e1ea6a1971f1caed4c7108699b773a19f6e8 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Thu, 13 Feb 2020 12:54:17 -0600
Subject: [PATCH 01/10] remove nosetest --exe flag

No longer needed without the old xenial permissions workaround that set
the entire /home/travis with 777 perms.
---
 Makefile |  2 +-
 tox.ini  | 24 ++++++++++++------------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/Makefile b/Makefile
index b922bcde15..cbde6b1f36 100644
--- a/Makefile
+++ b/Makefile
@@ -672,7 +672,7 @@ endif
 		echo "-----------------------------------------------------------"; \
 		. $(VIRTUALENV_DIR)/bin/activate; \
 		    COVERAGE_FILE=.coverage.integration.$$(echo $$component | tr '/' '.') \
-		    nosetests $(NOSE_OPTS) -s -v --exe $(NOSE_COVERAGE_FLAGS) \
+		    nosetests $(NOSE_OPTS) -s -v $(NOSE_COVERAGE_FLAGS) \
 		    $(NOSE_COVERAGE_PACKAGES) \
 		    $$component/tests/integration || exit 1; \
 		echo "-----------------------------------------------------------"; \
diff --git a/tox.ini b/tox.ini
index 3832b40c02..4e6070fe5a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -93,15 +93,15 @@ deps = virtualenv
        -e{toxinidir}/st2client
        -e{toxinidir}/st2common
 commands =
-    nosetests --rednose --immediate -sv --exe st2actions/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2api/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2common/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2debug/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2exporter/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2reactor/tests/integration/
-    nosetests --rednose --immediate -sv --exe contrib/runners/action_chain_runner/tests/integration/
-    nosetests --rednose --immediate -sv --exe contrib/runners/local_runner/tests/integration/
-    nosetests --rednose --immediate -sv --exe contrib/runners/mistral_v2/tests/integration/
-    nosetests --rednose --immediate -sv --exe contrib/runners/orquesta_runner/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2tests/integration/orquesta/
-    nosetests --rednose --immediate -sv --exe contrib/runners/python_runner/tests/integration/
+    nosetests --rednose --immediate -sv st2actions/tests/integration/
+    nosetests --rednose --immediate -sv st2api/tests/integration/
+    nosetests --rednose --immediate -sv st2common/tests/integration/
+    nosetests --rednose --immediate -sv st2debug/tests/integration/
+    nosetests --rednose --immediate -sv st2exporter/tests/integration/
+    nosetests --rednose --immediate -sv st2reactor/tests/integration/
+    nosetests --rednose --immediate -sv contrib/runners/action_chain_runner/tests/integration/
+    nosetests --rednose --immediate -sv contrib/runners/local_runner/tests/integration/
+    nosetests --rednose --immediate -sv contrib/runners/mistral_v2/tests/integration/
+    nosetests --rednose --immediate -sv contrib/runners/orquesta_runner/tests/integration/
+    nosetests --rednose --immediate -sv st2tests/integration/orquesta/
+    nosetests --rednose --immediate -sv contrib/runners/python_runner/tests/integration/

From a309bd7debe67199f4631b18ba4725ce3ccf2ce1 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 19 Feb 2020 20:19:44 -0600
Subject: [PATCH 02/10] remove unneeded/deprecated .travis.yml bits

---
 .travis.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index c425b5cb91..60ed463664 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,6 +1,4 @@
-# Used old infrastructure, needed for integration tests:
-# http://docs.travis-ci.com/user/workers/standard-infrastructure/
-sudo: required
+os: linux
 # NOTE: We use precise because tests finish faster than on Xenial
 dist: precise
 language: python
@@ -25,7 +23,7 @@ env:
     - NOSE_TIME=$([ "${TRAVIS_PULL_REQUEST}" = "false" ] && [ "${IS_NIGHTLY_BUILD}" = "no" ] && echo "yes" || echo "no")
     # Travis-specific st2.conf (with travis user instead of stanley)
     - ST2_CONF=conf/st2.travis.conf
-matrix:
+jobs:
   include:
     # NOTE: We combine builds because Travis offers a maximum of 5 concurrent
     # builds and having 6 tasks / builds means 1 tasks will need to wait for one

From 722be15608bf3312992256eb0615757fd6d33080 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 19 Feb 2020 21:50:31 -0600
Subject: [PATCH 03/10] drop commented travis job

---
 .travis.yml | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 60ed463664..602dda87dc 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -35,20 +35,6 @@ jobs:
     - env: TASK=ci-unit CACHE_NAME=py2 COMMAND_THRESHOLD=700
       python: 2.7
       name: "Unit Tests (Python 2.7 MongoDB 3.4)"
-    #- env: TASK=ci-unit CACHE_NAME=py2 COMMAND_THRESHOLD=700
-      #python: 2.7
-      #name: "Unit Tests (Python 2.7 MongoDB 3.6)"
-      #addons:
-      #  apt:
-      #    sources:
-      #      - mongodb-upstart
-      #      - sourceline: 'deb [arch=amd64] http://repo.mongodb.org/apt/ubuntu precise/mongodb-org/3.6 multiverse'
-      #        key_url: 'https://www.mongodb.org/static/pgp/server-3.6.asc'
-      #      - sourceline: 'ppa:git-core/ppa'
-      #    packages:
-      #      - mongodb-org-server
-      #      - mongodb-org-shell
-      #      - git
     - env: TASK=ci-integration CACHE_NAME=py2 COMMAND_THRESHOLD=700
       python: 2.7
       name: "Integration Tests (Python 2.7)"

From 32d5a80416d2a69a29b5a2e1d62824423103d2d7 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Thu, 20 Feb 2020 18:41:53 -0600
Subject: [PATCH 04/10] switch travis to xenial

xenial has a new enough git (v2.21.0) so don't upgrade.
---
 .travis.yml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 602dda87dc..31eba65c8b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,6 +1,5 @@
 os: linux
-# NOTE: We use precise because tests finish faster than on Xenial
-dist: precise
+dist: xenial
 language: python
 
 branches:
@@ -51,21 +50,18 @@ jobs:
 addons:
   apt:
     sources:
-      - mongodb-upstart
-      - sourceline: 'deb [arch=amd64] http://repo.mongodb.org/apt/ubuntu precise/mongodb-org/3.4 multiverse'
+      - sourceline: 'deb [arch=amd64] http://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/3.4 multiverse'
         key_url: 'https://www.mongodb.org/static/pgp/server-3.4.asc'
       # NOTE: Precise repo doesn't contain Erlang 20.x, latest version is 19.x so we need to use RabbitMQ 3.7.6
       #- sourceline: 'deb [arch=amd64] http://packages.erlang-solutions.com/ubuntu precise contrib'
       #  key_url: 'https://packages.erlang-solutions.com/ubuntu/erlang_solutions.asc'
       #- sourceline: 'deb [arch=amd64] https://dl.bintray.com/rabbitmq/debian precise rabbitmq-server-v3.6.x'
       #  key_url: 'https://github.com/rabbitmq/signing-keys/releases/download/2.0/rabbitmq-release-signing-key.asc'
-      - sourceline: 'ppa:git-core/ppa'
     packages:
       - mongodb-org-server
       - mongodb-org-shell
       - erlang
       - rabbitmq-server
-      - git
       - libffi-dev
 
 cache:

From 22abc492b8a4ce7a851dd1725eb5991ede58bb74 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Thu, 20 Feb 2020 19:09:55 -0600
Subject: [PATCH 05/10] Travis: Install mongodb 3.4 instead of 4.0

xenial comes with 4.0, so we have to downgrade to 3.4
---
 .travis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 31eba65c8b..9d278a0aa0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -58,8 +58,8 @@ addons:
       #- sourceline: 'deb [arch=amd64] https://dl.bintray.com/rabbitmq/debian precise rabbitmq-server-v3.6.x'
       #  key_url: 'https://github.com/rabbitmq/signing-keys/releases/download/2.0/rabbitmq-release-signing-key.asc'
     packages:
-      - mongodb-org-server
-      - mongodb-org-shell
+      - mongodb-org-server=3.4.*
+      - mongodb-org-shell=3.4.*
       - erlang
       - rabbitmq-server
       - libffi-dev

From deedfc3d87785d5e1e87b1025aff17c74c2e1e72 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 12 Feb 2020 02:36:25 -0600
Subject: [PATCH 06/10] Enable RabbitMQ SSL tests that need xenial

These tests were added in #4541.
Now that we're on xenial, we can reenable them.

This skips upgrading rabbitmq.

reverts 44e513e8603f0f9362c3f5eb92aa48f750879448
originally added in 5387ece79d4c7c81981491bb9739533cb6a0bb36

reverts 922cb23c2d3480849819ea6eb94d7191793c12ff
---
 .travis.yml                                         |  6 ------
 scripts/travis/rabbitmq.config                      |  1 -
 .../tests/integration/test_rabbitmq_ssl_listener.py | 13 ++++++-------
 3 files changed, 6 insertions(+), 14 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 9d278a0aa0..dd4c7399db 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -52,15 +52,9 @@ addons:
     sources:
       - sourceline: 'deb [arch=amd64] http://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/3.4 multiverse'
         key_url: 'https://www.mongodb.org/static/pgp/server-3.4.asc'
-      # NOTE: Precise repo doesn't contain Erlang 20.x, latest version is 19.x so we need to use RabbitMQ 3.7.6
-      #- sourceline: 'deb [arch=amd64] http://packages.erlang-solutions.com/ubuntu precise contrib'
-      #  key_url: 'https://packages.erlang-solutions.com/ubuntu/erlang_solutions.asc'
-      #- sourceline: 'deb [arch=amd64] https://dl.bintray.com/rabbitmq/debian precise rabbitmq-server-v3.6.x'
-      #  key_url: 'https://github.com/rabbitmq/signing-keys/releases/download/2.0/rabbitmq-release-signing-key.asc'
     packages:
       - mongodb-org-server=3.4.*
       - mongodb-org-shell=3.4.*
-      - erlang
       - rabbitmq-server
       - libffi-dev
 
diff --git a/scripts/travis/rabbitmq.config b/scripts/travis/rabbitmq.config
index 0cf25a732a..d23be26ec5 100644
--- a/scripts/travis/rabbitmq.config
+++ b/scripts/travis/rabbitmq.config
@@ -1,7 +1,6 @@
 [
   {rabbit, [
      {ssl_listeners, [5671]},
-     {ssl_allow_poodle_attack, true},
      {ssl_options, [{cacertfile, "/home/travis/build/StackStorm/st2/st2tests/st2tests/fixtures/ssl_certs/ca/ca_certificate_bundle.pem"},
                     {certfile,   "/home/travis/build/StackStorm/st2/st2tests/st2tests/fixtures/ssl_certs/server/server_certificate.pem"},
                     {keyfile,    "/home/travis/build/StackStorm/st2/st2tests/st2tests/fixtures/ssl_certs/server/private_key.pem"},
diff --git a/st2common/tests/integration/test_rabbitmq_ssl_listener.py b/st2common/tests/integration/test_rabbitmq_ssl_listener.py
index ee5de6b92f..49b1f3c2d7 100644
--- a/st2common/tests/integration/test_rabbitmq_ssl_listener.py
+++ b/st2common/tests/integration/test_rabbitmq_ssl_listener.py
@@ -39,10 +39,7 @@
 
 # NOTE: We only run those tests on Travis because at the moment, local vagrant dev VM doesn't
 # expose RabbitMQ SSL listener by default
-# TODO: Re-enable once we upgrade Travis from Precise to Xenial where latest version of RabbitMQ
-# and OpenSSL is available
-@unittest2.skip('Skipping until we upgrade to Xenial on Travis')
-# @unittest2.skipIf(not ON_TRAVIS, 'Skipping tests because not running on Travis')
+@unittest2.skipIf(not ON_TRAVIS, 'Skipping tests because not running on Travis')
 class RabbitMQTLSListenerTestCase(unittest2.TestCase):
 
     def setUp(self):
@@ -56,16 +53,18 @@ def setUp(self):
     def test_non_ssl_connection_on_ssl_listener_port_failure(self):
         connection = transport_utils.get_connection(urls='amqp://guest:guest@127.0.0.1:5671/')
 
-        expected_msg_1 = '[Errno 104] Connection reset by peer'
+        expected_msg_1 = '[Errno 104]'  # followed by: ' Connection reset by peer' or ' ECONNRESET'
         expected_msg_2 = 'Socket closed'
+        expected_msg_3 = 'Server unexpectedly closed connection'
 
         try:
             connection.connect()
         except Exception as e:
             self.assertFalse(connection.connected)
             self.assertIsInstance(e, (IOError, socket.error))
-            self.assertTrue(expected_msg_1 in six.text_type(e) or expected_msg_2 in
-                            six.text_type(e))
+            self.assertTrue(expected_msg_1 in six.text_type(e) or
+                            expected_msg_2 in six.text_type(e) or
+                            expected_msg_3 in six.text_type(e))
         else:
             self.fail('Exception was not thrown')
 

From 7597647350055baba5e6e495ddbd46af6b530757 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 12 Feb 2020 03:53:21 -0600
Subject: [PATCH 07/10] Fix rabbitmq logs glob

---
 .travis.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index dd4c7399db..bdc335541e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -99,7 +99,8 @@ before_script:
   - sudo wget http://guest:guest@localhost:15672/cli/rabbitmqadmin -O /usr/local/bin/rabbitmqadmin
   - sudo chmod +x /usr/local/bin/rabbitmqadmin
   - sudo service rabbitmq-server restart
-  - sudo tail -n 30 /var/log/rabbitmq/*
+  # chmod to make glob work (*.log to avoid log dir)
+  - sudo chmod a+rx /var/log/rabbitmq ; sudo tail -n 30 /var/log/rabbitmq/*.log
   # Print various binary versions
   - mongod --version
   - git --version

From 8df709df848e539a90c461b95ab2a67fa5ba8abf Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Thu, 13 Feb 2020 18:18:12 -0600
Subject: [PATCH 08/10] Ensure that py3 tests use python3.6 virtualenv

There were several issues with the python3.6 virtualenvs.
- The Makefile defaults PYTHON_VERSION to python2.7 causing some
  virtualenvs to be built with 2.7 instead of 3.6.
- Once a virtualenv was built with 2.7 it was cached for later builds.
- The ci-py3-unit task was running tox for both unit and packs tests.
  Hiding discrete steps in the same task obscured the lack of
  pre-building one of the tox virtualenvs. It also made it hard to
  understand how the job name matched with the TASK/make target.

So, this updates the travis jobs to add PYTHON_VERSION and update the
job TASK to separate ci-py3-unit and ci-py3-packs-tests make targets.
Several other places that use TASK var were adjusted to clarify WHY they
were selecting different CI TASKs, thus allowing TASK to be adjusted or
reorganized without editing so many different files.

In one case, an if statement was selecting all of the TASK options, so
the condition was removed to leave just the command invocation.

TASK & Makefile to separate py3-unit and
py3-packs-tests. And updates several places that use the TASK var to
make it clear WHY they are selecting particular TASKs.
---
 .travis.yml                            | 11 +++++---
 Makefile                               |  6 +++++
 scripts/travis/install-requirements.sh | 36 +++++++++++++++++++++-----
 3 files changed, 44 insertions(+), 9 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index bdc335541e..87e0c392be 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -31,6 +31,11 @@ jobs:
     # job which also includes "make requirements" and other steps
     # "make requirements" can take substantially lower if the cache is purged
     # and this would cause too many intermediate failures / false positives
+    # NOTE: TASK is inspected in commands below and other travis scripts.
+    # For example, ci-py3* targets trigger an alternate virtualenv build method.
+    # If you rename or reorder make targets in TASK, you may need to adjust:
+    # scripts/travis/install-requirements.sh
+    # scripts/travis/run-nightly-make-task-if-exists.sh
     - env: TASK=ci-unit CACHE_NAME=py2 COMMAND_THRESHOLD=700
       python: 2.7
       name: "Unit Tests (Python 2.7 MongoDB 3.4)"
@@ -40,10 +45,10 @@ jobs:
     - env: TASK="ci-checks ci-packs-tests" CACHE_NAME=py2 COMMAND_THRESHOLD=280
       python: 2.7
       name: "Lint Checks, Packs Tests (Python 2.7)"
-    - env: TASK="compilepy3 ci-py3-unit" CACHE_NAME=py3 COMMAND_THRESHOLD=680
+    - env: TASK="compilepy3 ci-py3-unit ci-py3-packs-tests" CACHE_NAME=py3 PYTHON_VERSION=python3.6 COMMAND_THRESHOLD=680
       python: 3.6
       name: "Unit Tests, Pack Tests (Python 3.6)"
-    - env: TASK="ci-py3-integration" CACHE_NAME=py3 COMMAND_THRESHOLD=310
+    - env: TASK="ci-py3-integration" CACHE_NAME=py3 PYTHON_VERSION=python3.6 COMMAND_THRESHOLD=310
       python: 3.6
       name: "Integration Tests (Python 3.6)"
 
@@ -79,7 +84,7 @@ install:
   # prep a travis-specific dev conf file that uses travis instead of stanley
   - cp conf/st2.dev.conf "${ST2_CONF}" ; sed -i -e "s/stanley/travis/" "${ST2_CONF}"
   - sudo scripts/travis/add-itest-user-key.sh
-  - if [ "${TASK}" = 'ci-unit' ] || [ "${TASK}" = 'ci-integration' ] || [ "${TASK}" = 'ci-checks ci-packs-tests' ] || [ "${TASK}" = 'compilepy3 ci-py3-unit' ] || [ "${TASK}" = 'ci-py3-integration' ]; then sudo .circle/add-itest-user.sh; fi
+  - sudo .circle/add-itest-user.sh
 
 # Let's enable rabbitmqadmin
 # See https://github.com/messagebus/lapine/wiki/Testing-on-Travis.
diff --git a/Makefile b/Makefile
index cbde6b1f36..4d68fa4972 100644
--- a/Makefile
+++ b/Makefile
@@ -951,6 +951,12 @@ ci-py3-unit:
 	@echo "==================== ci-py3-unit ===================="
 	@echo
 	NOSE_WITH_TIMER=$(NOSE_WITH_TIMER) tox -e py36-unit -vv
+
+.PHONY: ci-py3-packs-tests
+ci-py3-packs-tests:
+	@echo
+	@echo "==================== ci-py3-packs-tests ===================="
+	@echo
 	NOSE_WITH_TIMER=$(NOSE_WITH_TIMER) tox -e py36-packs -vv
 
 .PHONY: ci-py3-unit-nightly
diff --git a/scripts/travis/install-requirements.sh b/scripts/travis/install-requirements.sh
index 8763e014a3..776a998a19 100755
--- a/scripts/travis/install-requirements.sh
+++ b/scripts/travis/install-requirements.sh
@@ -1,8 +1,24 @@
 #!/usr/bin/env bash
 
-if [ "${TASK}" = 'compilepy3 ci-py3-unit' ] || [ "${TASK}" = 'ci-py3-integration' ]; then
+# This file gets run for all travis jobs.
+
+# virtualenv prepartion is different for python3, so we want all py3 targets here.
+# We use a glob instead of listing TASKs so TASK reorganization doesn't require so many changes.
+if [[ " ${TASK}" = *' ci-py3-'* ]]; then
     pip install "tox==3.8.6"
 
+    # NOTE: The makefile only checks to see if the activate script is present.
+    # It does not check if the virtualenv was built with the correct python version.
+    # Since the makefile defaults to python2.7, a 2.7 virtualenv might get cached.
+    # Specifying PYTHON_VERSION in .travis.yml should alleviate that,
+    # but we'll check the version here just to be sure a cached virtualenv doesn't
+    # silently invalidate the tests.
+
+    # cleanup any invalid python2 cache
+    test -d virtualenv/lib/${PYTHON_VERSION} || rm -rf virtualenv/*
+    # rebuild virtualenv if necessary
+    test -f virtualenv/bin/activate || virtualenv --python=${PYTHON_VERSION} virtualenv --no-download
+
     # Install runners
     . virtualenv/bin/activate
 
@@ -17,15 +33,23 @@ if [ "${TASK}" = 'compilepy3 ci-py3-unit' ] || [ "${TASK}" = 'ci-py3-integration
     # NOTE: We create the environment and install the dependencies first. This
     # means that the subsequent tox build / test command has a stable run time
     # since it doesn't depend on dependencies being installed.
-    if [ "${TASK}" = 'compilepy3 ci-py3-unit' ]; then
-        TOX_TASK="py36-unit"
+    # NOTE: Travis jobs can have more than one TASK, so we search for all make
+    # targets that need a tox env. The spaces ensure we match entire make targets.
+    if [[ " ${TASK} " = *' ci-py3-unit '* ]]; then
+        tox -e py36-unit --notest
     fi
 
-    if [ "${TASK}" = 'ci-py3-integration' ]; then
-        TOX_TASK="py36-integration"
+    if [[ " ${TASK} " = *' ci-py3-unit-nightly '* ]]; then
+        tox -e py36-unit-nightly --notest
     fi
 
-    tox -e ${TOX_TASK} --notest
+    if [[ " ${TASK} " = *' ci-py3-packs-tests '* ]]; then
+        tox -e py36-packs --notest
+    fi
+
+    if [[ " ${TASK} " = *' ci-py3-integration '* ]]; then
+        tox -e py36-integration --notest
+    fi
 else
     make requirements
 fi

From 7c0bfc0076beaef6d4d4722aa353c77ec7e624b6 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 19 Feb 2020 19:21:57 -0600
Subject: [PATCH 09/10] add travis permissions workaround for packs/integration
 tests

Try to adjust as few permissions as possible under /home/travis.
This includes adding other perms for fixtures, packs, and parent dirs.
---
 .travis.yml                              |  1 +
 scripts/travis/permissions-workaround.sh | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+)
 create mode 100755 scripts/travis/permissions-workaround.sh

diff --git a/.travis.yml b/.travis.yml
index 87e0c392be..f934bf8eed 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -85,6 +85,7 @@ install:
   - cp conf/st2.dev.conf "${ST2_CONF}" ; sed -i -e "s/stanley/travis/" "${ST2_CONF}"
   - sudo scripts/travis/add-itest-user-key.sh
   - sudo .circle/add-itest-user.sh
+  - if [[ "${TASK}" = *'-packs-tests'* ]] || [[ "${TASK}" = *'-integration'* ]]; then sudo scripts/travis/permissions-workaround.sh; fi
 
 # Let's enable rabbitmqadmin
 # See https://github.com/messagebus/lapine/wiki/Testing-on-Travis.
diff --git a/scripts/travis/permissions-workaround.sh b/scripts/travis/permissions-workaround.sh
new file mode 100755
index 0000000000..f8f06b8432
--- /dev/null
+++ b/scripts/travis/permissions-workaround.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -e
+
+if [ "$(whoami)" != 'root' ]; then
+    echo 'Please run with sudo'
+    exit 2
+fi
+
+# rabbitmq user needs access to the ssl_certs fixtures during integration tests
+# stanley needs to work with packs fixtures during the packs tests
+# this can't be the travis user because 'stanley' is the hardcoded user in the tests
+# o=other; X=only set execute bit if user execute bit is set (eg on dirs)
+chmod -R o+rX ${TRAVIS_BUILD_DIR}/st2tests/st2tests/fixtures ${TRAVIS_BUILD_DIR}/contrib
+
+# make sure parent directories are traversable
+d=${TRAVIS_BUILD_DIR}/st2tests/st2tests
+while [[ "${d}" != "/" ]]; do
+    chmod o+rx "${d}"
+    d=$(dirname "${d}")
+done

From 1976cc570c8e393227ab564e0d2f0a8fa918f015 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 19 Feb 2020 22:17:41 -0600
Subject: [PATCH 10/10] Update make COMMAND_THRESHOLDS

The timing of some make targets is higher than the threshold. For
ci-py3-integration, it looks like that threshold is far too short for
what the tests regularly take. So, for the jobs that are signifcantly
different, this adjust the thresholds to be about 60s more than the last
successful build in travis.

make target: orig threshold=>new threshold (reference duration)

ci-checks ci-packs-tests:   280=>430 (369)
...-py3-unit ci-py3-pac...: 680=>750 (688)
ci-py3-integration:         310=>770 (716)
---
 .travis.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index f934bf8eed..79dec62b3f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -42,13 +42,13 @@ jobs:
     - env: TASK=ci-integration CACHE_NAME=py2 COMMAND_THRESHOLD=700
       python: 2.7
       name: "Integration Tests (Python 2.7)"
-    - env: TASK="ci-checks ci-packs-tests" CACHE_NAME=py2 COMMAND_THRESHOLD=280
+    - env: TASK="ci-checks ci-packs-tests" CACHE_NAME=py2 COMMAND_THRESHOLD=430
       python: 2.7
       name: "Lint Checks, Packs Tests (Python 2.7)"
-    - env: TASK="compilepy3 ci-py3-unit ci-py3-packs-tests" CACHE_NAME=py3 PYTHON_VERSION=python3.6 COMMAND_THRESHOLD=680
+    - env: TASK="compilepy3 ci-py3-unit ci-py3-packs-tests" CACHE_NAME=py3 PYTHON_VERSION=python3.6 COMMAND_THRESHOLD=750
       python: 3.6
       name: "Unit Tests, Pack Tests (Python 3.6)"
-    - env: TASK="ci-py3-integration" CACHE_NAME=py3 PYTHON_VERSION=python3.6 COMMAND_THRESHOLD=310
+    - env: TASK="ci-py3-integration" CACHE_NAME=py3 PYTHON_VERSION=python3.6 COMMAND_THRESHOLD=770
       python: 3.6
       name: "Integration Tests (Python 3.6)"