[wip] [ci] Run tests in a full-fledged ubuntu 19.10 VM (python-trio#1292

)

* Add CI job to run tests in Ubuntu on Qemu/KVM

* Drop docker version of ubuntu-latest test, since the vm test covers it

* sudo it harder

* Don't switch all runs to bionic - in particular, no pypy3 there!

* Someday I will remember an Ubuntu release name correctly.

Today is not that day.

* Add missing envvar

* Fix remaining instances of CODECOV_NAME

* moar quotes

.travis.yml

@@ -11,9 +11,23 @@ matrix:
     - python: pypy3
     - language: generic
       env: PYPY_NIGHTLY_BRANCH=py3.6
+    # Qemu tests are also slow
+    # The unique thing this provides is testing on the given distro's
+    # kernel, which is important when we use new kernel features. This
+    # is also good for testing the latest openssl etc., and getting
+    # early warning of any issues that might happen in the next Ubuntu
+    # LTS.
+    - language: generic
+      # We use bionic for the host, b/c rumor says that Travis's
+      # 'bionic' systems have nested KVM enabled.
+      dist: bionic
+      env:
+        - "JOB_NAME='Ubuntu 19.10, full VM'"
+        - "VM_IMAGE=https://cloud-images.ubuntu.com/eoan/current/eoan-server-cloudimg-amd64.img"
     # 3.5.0 and 3.5.1 have different __aiter__ semantics than all
     # other versions, so we need to test them specially. Travis's
-    # xenial dist only provides 3.5.2+.
+    # newer images only provide 3.5.2+, so we have to request the old
+    # 'trusty' images.
     - python: 3.5.0
       dist: trusty
     - python: 3.5

azure-pipelines.yml

@@ -6,36 +6,6 @@ trigger:
 
 jobs:
 
-# Special job that uses a container to check we work on the latest
-# tippy-tip ubuntu. The main thing this adds is openssl 1.1.1/TLS 1.3.
-#
-# Azure has fancy stuff to let you run directly inside a container:
-#
-#   https://docs.microsoft.com/en-us/azure/devops/pipelines/process/container-phases
-#
-# Unfortunately it's useless for us. Azure carefully sets everything
-# up so that you run as a non-root user, but can sudo to get root. But
-# the standard images that docker maintains like 'ubuntu' or 'debian'
-# don't have sudo installed, which means that if you use 'container:
-# ubuntu:rolling' then you simply cannot get root. And it's definitely
-# not worth maintaining our own container image just so we can
-# preinstall sudo:
-#
-#   https://github.com/MicrosoftDocs/vsts-docs/issues/2939
-- job: "py37_latest_ubuntu"
-  pool:
-    vmImage: "ubuntu-16.04"
-  timeoutInMinutes: 10
-  steps:
-    # This actually reveals the CODECOV_TOKEN in the logs, but
-    # AFAICT the only thing the token lets you do is upload coverage
-    # reports, which doesn't seem like a very tempting target for
-    # malicious hackers.
-    - bash: |
-        set -ex
-        env | sort
-        sudo docker run -e SYSTEM_JOBIDENTIFIER="$SYSTEM_JOBIDENTIFIER" -e CODECOV_TOKEN="$CODECOV_TOKEN" -v "$PWD:/t" ubuntu:rolling /bin/bash -c "set -ex; cd /t; apt update; apt install -y python3.7-dev python3-virtualenv git build-essential curl; python3.7 -m virtualenv -p python3.7 venv; source venv/bin/activate; source ci.sh"
-
 - job: 'Windows'
   pool:
     vmImage: 'vs2017-win2016'

ci.sh

@@ -5,11 +5,13 @@ set -ex -o pipefail
 # Log some general info about the environment
 env | sort
 
-if [ "$SYSTEM_JOBIDENTIFIER" != "" ]; then
-    # azure pipelines
-    CODECOV_NAME="$SYSTEM_JOBDISPLAYNAME"
-else
-    CODECOV_NAME="${TRAVIS_OS_NAME}-${TRAVIS_PYTHON_VERSION:-unknown}"
+if [ "$JOB_NAME" = "" ]; then
+    if [ "$SYSTEM_JOBIDENTIFIER" != "" ]; then
+        # azure pipelines
+        JOB_NAME="$SYSTEM_JOBDISPLAYNAME"
+    else
+        JOB_NAME="${TRAVIS_OS_NAME}-${TRAVIS_PYTHON_VERSION:-unknown}"
+    fi
 fi
 
 # We always want to retry on failure, and we have to set --connect-timeout to
@@ -51,7 +53,7 @@ fi
 ### Travis + macOS ###
 
 if [ "$TRAVIS_OS_NAME" = "osx" ]; then
-    CODECOV_NAME="osx_${MACPYTHON}"
+    JOB_NAME="osx_${MACPYTHON}"
     $CURL -Lo macpython.pkg https://www.python.org/ftp/python/${MACPYTHON}/python-${MACPYTHON}-macosx10.6.pkg
     sudo installer -pkg macpython.pkg -target /
     ls /Library/Frameworks/Python.framework/Versions/*/bin/
@@ -66,7 +68,7 @@ fi
 ### PyPy nightly (currently on Travis) ###
 
 if [ "$PYPY_NIGHTLY_BRANCH" != "" ]; then
-    CODECOV_NAME="pypy_nightly_${PYPY_NIGHTLY_BRANCH}"
+    JOB_NAME="pypy_nightly_${PYPY_NIGHTLY_BRANCH}"
     $CURL -fLo pypy.tar.bz2 http://buildbot.pypy.org/nightly/${PYPY_NIGHTLY_BRANCH}/pypy-c-jit-latest-linux64.tar.bz2
     if [ ! -s pypy.tar.bz2 ]; then
         # We know:
@@ -94,6 +96,105 @@ if [ "$PYPY_NIGHTLY_BRANCH" != "" ]; then
     source testenv/bin/activate
 fi
 
+### Qemu virtual-machine inception, on Travis
+
+if [ "$VM_IMAGE" != "" ]; then
+    VM_CPU=${VM_CPU:-x86_64}
+
+    sudo apt update
+    sudo apt install cloud-image-utils qemu-system-x86
+
+    # If the base image is already present, we don't try downloading it again;
+    # and we use a scratch image for the actual run, in order to keep the base
+    # image file pristine. None of this matters when running in CI, but it
+    # makes local testing much easier.
+    BASEIMG=$(basename $VM_IMAGE)
+    if [ ! -e $BASEIMG ]; then
+        $CURL "$VM_IMAGE" -o $BASEIMG
+    fi
+    rm -f os-working.img
+    qemu-img create -f qcow2 -b $BASEIMG os-working.img
+
+    # This is the test script, that runs inside the VM, using cloud-init.
+    #
+    # This script goes through shell expansion, so use \ to quote any
+    # $variables you want to expand inside the guest.
+    cloud-localds -H test-host seed.img /dev/stdin << EOF
+#!/bin/bash
+
+set -xeuo pipefail
+
+# When this script exits, we shut down the machine, which causes the qemu on
+# the host to exit
+trap "poweroff" exit
+
+uname -a
+echo \$PWD
+id
+cat /etc/lsb-release
+cat /proc/cpuinfo
+
+# Pass-through JOB_NAME + the env vars that codecov-bash looks at
+export JOB_NAME="$JOB_NAME"
+export CI="$CI"
+export TRAVIS="$TRAVIS"
+export TRAVIS_COMMIT="$TRAVIS_COMMIT"
+export TRAVIS_PULL_REQUEST_SHA="$TRAVIS_PULL_REQUEST_SHA"
+export TRAVIS_JOB_NUMBER="$TRAVIS_JOB_NUMBER"
+export TRAVIS_PULL_REQUEST="$TRAVIS_PULL_REQUEST"
+export TRAVIS_JOB_ID="$TRAVIS_JOB_ID"
+export TRAVIS_REPO_SLUG="$TRAVIS_REPO_SLUG"
+export TRAVIS_TAG="$TRAVIS_TAG"
+export TRAVIS_BRANCH="$TRAVIS_BRANCH"
+
+env
+
+mkdir /host-files
+mount -t 9p -o trans=virtio,version=9p2000.L host-files /host-files
+
+# Install and set up the system Python (assumes Debian/Ubuntu)
+apt update
+apt install -y python3-dev python3-virtualenv git build-essential curl
+python3 -m virtualenv -p python3 /venv
+# Uses unbound shell variable PS1, so have to allow that temporarily
+set +u
+source /venv/bin/activate
+set -u
+
+# And then we re-invoke ourselves!
+cd /host-files
+./ci.sh
+
+# We can't pass our exit status out. So if we got this far without error, make
+# a marker file where the host can see it.
+touch /host-files/SUCCESS
+EOF
+
+    rm -f SUCCESS
+    # Apparently Travis's bionic images have nested virtualization enabled, so
+    # we can use KVM... but the default user isn't in the appropriate groups
+    # to use KVM, so we have to use 'sudo' to add that. And then a second
+    # 'sudo', because by default we have rights to run arbitrary commands as
+    # root, but we don't have rights to run a command as ourselves but with a
+    # tweaked group setting.
+    #
+    # Travis Linux VMs have 7.5 GiB RAM, so we give our nested VM 6 GiB RAM
+    # (-m 6144).
+    sudo sudo -u $USER -g kvm qemu-system-$VM_CPU \
+      -enable-kvm \
+      -M pc \
+      -m 6144 \
+      -nographic \
+      -drive "file=./os-working.img,if=virtio" \
+      -drive "file=./seed.img,if=virtio,format=raw" \
+      -net nic \
+      -net "user,hostfwd=tcp:127.0.0.1:50022-:22" \
+      -virtfs local,path=$PWD,security_model=mapped-file,mount_tag=host-files
+
+    test -e SUCCESS
+    exit
+fi
+
 ################################################################
 # We have a Python environment!
 ################################################################
@@ -177,7 +278,7 @@ else
         # but azure is broken:
         #   https://developercommunity.visualstudio.com/content/problem/743824/bash-task-on-windows-suddenly-fails-with-bash-devf.html
         $CURL -o codecov.sh https://codecov.io/bash
-        bash codecov.sh -n "${CODECOV_NAME}" -F "$FLAG"
+        bash codecov.sh -n "${JOB_NAME}" -F "$FLAG"
     fi
 
     $PASSED