From 40581081b315eaaff4e1755b9bc45e2cf8b70dd6 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 19 Feb 2020 12:06:41 -0600
Subject: [PATCH 1/6] Update gitpython requirement

gitpython requires gitdb2, but that has removed some things in newer
versions, and 2.11.1 had an open ended dep. So, update gitpython to a
newer version that has more specific version requirements for gitdb2.

This should fix these errors:
https://github.com/gitpython-developers/GitPython/issues/983
https://travis-ci.org/StackStorm/st2/jobs/652088774#L9416
https://circleci.com/gh/StackStorm-Exchange/stackstorm-sumologic/155

Thanks to blag for tracking down the bug.
---
 fixed-requirements.txt      | 2 +-
 requirements.txt            | 2 +-
 st2actions/requirements.txt | 2 +-
 st2common/requirements.txt  | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/fixed-requirements.txt b/fixed-requirements.txt
index 8e4a3a5c49..0109822fb6 100644
--- a/fixed-requirements.txt
+++ b/fixed-requirements.txt
@@ -16,7 +16,7 @@ six==1.13.0
 pyyaml==5.1.2
 requests[security]==2.22.0
 apscheduler==3.6.3
-gitpython==2.1.11
+gitpython==2.1.15
 jsonschema==2.6.0
 pymongo==3.10.0
 mongoengine==0.18.2
diff --git a/requirements.txt b/requirements.txt
index a317861a68..cafd847452 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -17,7 +17,7 @@ git+https://github.com/StackStorm/logshipper.git@stackstorm_patched#egg=logshipp
 git+https://github.com/StackStorm/orquesta.git@6e2fa8052cd62b07e96e540f68e7290b324d0f01#egg=orquesta
 git+https://github.com/StackStorm/python-mistralclient.git#egg=python-mistralclient
 git+https://github.com/StackStorm/st2-auth-backend-flat-file.git@master#egg=st2-auth-backend-flat-file
-gitpython==2.1.11
+gitpython==2.1.15
 greenlet==0.4.15
 gunicorn==19.9.0
 ipaddr
diff --git a/st2actions/requirements.txt b/st2actions/requirements.txt
index 56b65d820a..8bb3a171ef 100755
--- a/st2actions/requirements.txt
+++ b/st2actions/requirements.txt
@@ -9,7 +9,7 @@ apscheduler==3.6.3
 eventlet==0.25.1
 git+https://github.com/StackStorm/logshipper.git@stackstorm_patched#egg=logshipper
 git+https://github.com/StackStorm/python-mistralclient.git#egg=python-mistralclient
-gitpython==2.1.11
+gitpython==2.1.15
 jinja2==2.10.3
 kombu==4.6.6
 lockfile==0.12.2
diff --git a/st2common/requirements.txt b/st2common/requirements.txt
index af469c017b..6414c75d05 100644
--- a/st2common/requirements.txt
+++ b/st2common/requirements.txt
@@ -11,7 +11,7 @@ cryptography==2.8
 eventlet==0.25.1
 flex==6.14.0
 git+https://github.com/StackStorm/orquesta.git@6e2fa8052cd62b07e96e540f68e7290b324d0f01#egg=orquesta
-gitpython==2.1.11
+gitpython==2.1.15
 greenlet==0.4.15
 ipaddr
 jinja2==2.10.3

From 2d7831e43772ae0a8b5399cfa7df6daa3afc14a7 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Mon, 17 Feb 2020 21:51:10 -0600
Subject: [PATCH 2/6] drop --no-site-packages from virtualenv calls

---
 Makefile                        | 8 ++++----
 scripts/travis/setup-mistral.sh | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Makefile b/Makefile
index 2a4fde79ee..b922bcde15 100644
--- a/Makefile
+++ b/Makefile
@@ -176,7 +176,7 @@ check-python-packages:
 	@echo "================== CHECK PYTHON PACKAGES ===================="
 	@echo ""
 
-	test -f $(VIRTUALENV_COMPONENTS_DIR)/bin/activate || virtualenv --python=$(PYTHON_VERSION) --no-site-packages $(VIRTUALENV_COMPONENTS_DIR) --no-download
+	test -f $(VIRTUALENV_COMPONENTS_DIR)/bin/activate || virtualenv --python=$(PYTHON_VERSION) $(VIRTUALENV_COMPONENTS_DIR) --no-download
 	@for component in $(COMPONENTS_WITHOUT_ST2TESTS); do \
 		echo "==========================================================="; \
 		echo "Checking component:" $$component; \
@@ -192,7 +192,7 @@ check-python-packages-nightly:
 	@echo "================== CHECK PYTHON PACKAGES ===================="
 	@echo ""
 
-	test -f $(VIRTUALENV_COMPONENTS_DIR)/bin/activate || virtualenv --python=$(PYTHON_VERSION) --no-site-packages $(VIRTUALENV_COMPONENTS_DIR) --no-download
+	test -f $(VIRTUALENV_COMPONENTS_DIR)/bin/activate || virtualenv --python=$(PYTHON_VERSION) $(VIRTUALENV_COMPONENTS_DIR) --no-download
 	@for component in $(COMPONENTS_WITHOUT_ST2TESTS); do \
 		echo "==========================================================="; \
 		echo "Checking component:" $$component; \
@@ -314,7 +314,7 @@ flake8: requirements .flake8
 	@echo
 	@echo "==================== st2client install check ===================="
 	@echo
-	test -f $(VIRTUALENV_ST2CLIENT_DIR)/bin/activate || virtualenv --python=$(PYTHON_VERSION) --no-site-packages $(VIRTUALENV_ST2CLIENT_DIR) --no-download
+	test -f $(VIRTUALENV_ST2CLIENT_DIR)/bin/activate || virtualenv --python=$(PYTHON_VERSION) $(VIRTUALENV_ST2CLIENT_DIR) --no-download
 
 	# Setup PYTHONPATH in bash activate script...
 	# Delete existing entries (if any)
@@ -506,7 +506,7 @@ virtualenv:
 	@echo
 	# Note: We pass --no-download flag to make sure version of pip which we install (9.0.1) is used
 	# instead of latest version being downloaded from PyPi
-	test -f $(VIRTUALENV_DIR)/bin/activate || virtualenv --python=$(PYTHON_VERSION) --no-site-packages $(VIRTUALENV_DIR) --no-download
+	test -f $(VIRTUALENV_DIR)/bin/activate || virtualenv --python=$(PYTHON_VERSION) $(VIRTUALENV_DIR) --no-download
 
 	# Setup PYTHONPATH in bash activate script...
 	# Delete existing entries (if any)
diff --git a/scripts/travis/setup-mistral.sh b/scripts/travis/setup-mistral.sh
index 66fe35c1ae..70686553e8 100755
--- a/scripts/travis/setup-mistral.sh
+++ b/scripts/travis/setup-mistral.sh
@@ -144,7 +144,7 @@ setup_mistral() {
 
   # Setup virtualenv for running mistral.
   cd /opt/openstack/mistral
-  virtualenv --no-site-packages .venv
+  virtualenv .venv
   . /opt/openstack/mistral/.venv/bin/activate
   pip install -q -r requirements.txt
   pip install -q psycopg2

From 9ddfbc59649b27b226b62ecdb232509fcb022a8d Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 19 Feb 2020 13:10:16 -0600
Subject: [PATCH 3/6] Use travis user instead of stanley on travis

---
 .gitignore                           |  3 +++
 .travis.yml                          |  5 +++++
 scripts/travis/add-itest-user-key.sh | 18 ++++++++++++++++++
 3 files changed, 26 insertions(+)
 create mode 100755 scripts/travis/add-itest-user-key.sh

diff --git a/.gitignore b/.gitignore
index bdb2fdc685..c05a3806ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,6 +30,9 @@ virtualenv-components
 virtualenv-components-osx
 .venv-st2devbox
 
+# generated travis conf
+conf/st2.travis.conf
+
 # Installer logs
 pip-log.txt
 
diff --git a/.travis.yml b/.travis.yml
index 756de6d3c2..c425b5cb91 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -23,6 +23,8 @@ env:
     # We only run tests with "--with-timer" flag on master and not for PRs since it adds 1-2
     # # minutes of overhead to each build.
     - NOSE_TIME=$([ "${TRAVIS_PULL_REQUEST}" = "false" ] && [ "${IS_NIGHTLY_BUILD}" = "no" ] && echo "yes" || echo "no")
+    # Travis-specific st2.conf (with travis user instead of stanley)
+    - ST2_CONF=conf/st2.travis.conf
 matrix:
   include:
     # NOTE: We combine builds because Travis offers a maximum of 5 concurrent
@@ -100,6 +102,9 @@ before_install:
 
 install:
   - ./scripts/travis/install-requirements.sh
+  # prep a travis-specific dev conf file that uses travis instead of stanley
+  - cp conf/st2.dev.conf "${ST2_CONF}" ; sed -i -e "s/stanley/travis/" "${ST2_CONF}"
+  - sudo scripts/travis/add-itest-user-key.sh
   - if [ "${TASK}" = 'ci-unit' ] || [ "${TASK}" = 'ci-integration' ] || [ "${TASK}" = 'ci-checks ci-packs-tests' ] || [ "${TASK}" = 'compilepy3 ci-py3-unit' ] || [ "${TASK}" = 'ci-py3-integration' ]; then sudo .circle/add-itest-user.sh; fi
 
 # Let's enable rabbitmqadmin
diff --git a/scripts/travis/add-itest-user-key.sh b/scripts/travis/add-itest-user-key.sh
new file mode 100755
index 0000000000..1d72849803
--- /dev/null
+++ b/scripts/travis/add-itest-user-key.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [ "$(whoami)" != 'root' ]; then
+    echo 'Please run with sudo'
+    exit 2
+fi
+
+mkdir -p /home/travis/.ssh
+
+# Generate ssh keys on StackStorm box and copy over public key into remote box.
+ssh-keygen -f /home/travis/.ssh/travis_rsa -P ""
+
+# Authorize key-base acces
+sh -c 'cat /home/travis/.ssh/travis_rsa.pub >> /home/travis/.ssh/authorized_keys'
+chmod 0600 /home/travis/.ssh/authorized_keys
+chmod 0700 /home/travis/.ssh

From 50cca1e5d934ad677ef36afce0a15c7117d5d148 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 19 Feb 2020 13:13:48 -0600
Subject: [PATCH 4/6] drop xenial permissions workaround

---
 scripts/travis/prepare-integration.sh | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/scripts/travis/prepare-integration.sh b/scripts/travis/prepare-integration.sh
index 3557ce398e..07fa42a7b8 100755
--- a/scripts/travis/prepare-integration.sh
+++ b/scripts/travis/prepare-integration.sh
@@ -6,8 +6,6 @@ if [ "$(whoami)" != 'root' ]; then
     exit 2
 fi
 
-UBUNTU_VERSION=`lsb_release -a 2>&1 | grep Codename | grep -v "LSB" | awk '{print $2}'`
-
 # Activate the virtualenv created during make requirements phase
 source ./virtualenv/bin/activate
 
@@ -34,12 +32,3 @@ echo " === END: Catting screen process log files. ==="
 # as root can't write to logs/ directory and tests fail
 chmod 777 logs/
 chmod 777 logs/*
-
-# Workaround for Travis on Ubuntu Xenial so local runner integration tests work
-# when executing them under user "stanley" (by default Travis checks out the
-# code and runs tests under a different system user).
-# NOTE: We need to pass "--exe" flag to nosetests when using this workaround.
-if [ "${UBUNTU_VERSION}" == "xenial" ]; then
-  echo "Applying workaround for stanley user permissions issue to /home/travis on Xenial"
-  chmod 777 -R /home/travis
-fi

From 2862c706c25345d98506995f61e2e148d749d3c7 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 19 Feb 2020 14:19:04 -0600
Subject: [PATCH 5/6] add permissions workaround for root

---
 scripts/travis/prepare-integration.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/travis/prepare-integration.sh b/scripts/travis/prepare-integration.sh
index 07fa42a7b8..4b6f078481 100755
--- a/scripts/travis/prepare-integration.sh
+++ b/scripts/travis/prepare-integration.sh
@@ -32,3 +32,7 @@ echo " === END: Catting screen process log files. ==="
 # as root can't write to logs/ directory and tests fail
 chmod 777 logs/
 chmod 777 logs/*
+
+# root needs to access write some lock files when creating virtualenvs
+# o=other; X=only set execute bit if user execute bit is set (eg on dirs)
+chmod -R o+rwX ${HOME}/.local/share/virtualenv

From 00c8d592b86525f036ce135b8f5d1b64206dcaa7 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 19 Feb 2020 15:13:50 -0600
Subject: [PATCH 6/6] update requests to 2.23.0

requests 2.22.0 had conflicting requirements on idna.
The primary requirement said idna>=2.5,<2.9 but the security extra
(which we use) required any idna>=2.0.0.

idna 2.9 was released 2 days ago
requests 2.23.0 was released today
---
 fixed-requirements.txt      | 2 +-
 requirements.txt            | 2 +-
 st2actions/requirements.txt | 2 +-
 st2client/requirements.txt  | 2 +-
 st2common/requirements.txt  | 2 +-
 st2debug/requirements.txt   | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/fixed-requirements.txt b/fixed-requirements.txt
index 0109822fb6..af2c1baf05 100644
--- a/fixed-requirements.txt
+++ b/fixed-requirements.txt
@@ -14,7 +14,7 @@ oslo.config>=1.12.1,<1.13
 oslo.utils>=3.36.2,<=3.37.0
 six==1.13.0
 pyyaml==5.1.2
-requests[security]==2.22.0
+requests[security]==2.23.0
 apscheduler==3.6.3
 gitpython==2.1.15
 jsonschema==2.6.0
diff --git a/requirements.txt b/requirements.txt
index cafd847452..3898401f16 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -52,7 +52,7 @@ pytz==2019.1
 pywinrm==0.3.0
 pyyaml==5.1.2
 rednose
-requests[security]==2.22.0
+requests[security]==2.23.0
 retrying==1.3.3
 routes==2.4.1
 semver==2.9.0
diff --git a/st2actions/requirements.txt b/st2actions/requirements.txt
index 8bb3a171ef..f102a5c49f 100755
--- a/st2actions/requirements.txt
+++ b/st2actions/requirements.txt
@@ -19,5 +19,5 @@ pyinotify==0.9.6
 python-dateutil==2.8.0
 python-json-logger
 pyyaml==5.1.2
-requests[security]==2.22.0
+requests[security]==2.23.0
 six==1.13.0
diff --git a/st2client/requirements.txt b/st2client/requirements.txt
index b712f1718a..1050fc7bb1 100644
--- a/st2client/requirements.txt
+++ b/st2client/requirements.txt
@@ -16,7 +16,7 @@ python-dateutil==2.8.0
 python-editor==1.0.4
 pytz==2019.1
 pyyaml==5.1.2
-requests[security]==2.22.0
+requests[security]==2.23.0
 six==1.13.0
 sseclient-py==1.7
 zipp<=1.0.0,>=0.5
diff --git a/st2common/requirements.txt b/st2common/requirements.txt
index 6414c75d05..73ee717aeb 100644
--- a/st2common/requirements.txt
+++ b/st2common/requirements.txt
@@ -27,7 +27,7 @@ pymongo==3.10.0
 python-dateutil==2.8.0
 python-statsd==2.1.0
 pyyaml==5.1.2
-requests[security]==2.22.0
+requests[security]==2.23.0
 retrying==1.3.3
 routes==2.4.1
 semver==2.9.0
diff --git a/st2debug/requirements.txt b/st2debug/requirements.txt
index e7ef78ae89..0f1ea2340d 100644
--- a/st2debug/requirements.txt
+++ b/st2debug/requirements.txt
@@ -8,5 +8,5 @@
 eventlet==0.25.1
 python-gnupg==0.4.5
 pyyaml==5.1.2
-requests[security]==2.22.0
+requests[security]==2.23.0
 six==1.13.0