WIP

mitogen-hq · Dec 2, 2024 · 1f1d724 · 1f1d724
1 parent 2f301ef
commit 1f1d724
Show file tree

Hide file tree

Showing 14 changed files with 65 additions and 128 deletions.
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -24,57 +24,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - name: Ans_27_210
-            tox_env: py27-mode_ansible-ansible2.10
-          - name: Ans_27_4
-            tox_env: py27-mode_ansible-ansible4
-
-          - name: Ans_36_210
-            python_version: '3.6'
-            tox_env: py36-mode_ansible-ansible2.10
-          - name: Ans_36_4
-            python_version: '3.6'
-            tox_env: py36-mode_ansible-ansible4
-
-          - name: Ans_311_210
-            python_version: '3.11'
-            tox_env: py311-mode_ansible-ansible2.10
-          - name: Ans_311_3
-            python_version: '3.11'
-            tox_env: py311-mode_ansible-ansible3
-          - name: Ans_311_4
-            python_version: '3.11'
-            tox_env: py311-mode_ansible-ansible4
-          - name: Ans_311_5
-            python_version: '3.11'
-            tox_env: py311-mode_ansible-ansible5
-          - name: Ans_313_6
-            python_version: '3.13'
-            tox_env: py313-mode_ansible-ansible6
-          - name: Ans_313_7
-            python_version: '3.13'
-            tox_env: py313-mode_ansible-ansible7
-          - name: Ans_313_8
-            python_version: '3.13'
-            tox_env: py313-mode_ansible-ansible8
-          - name: Ans_313_9
-            python_version: '3.13'
-            tox_env: py313-mode_ansible-ansible9
-          - name: Ans_313_10
-            python_version: '3.13'
-            tox_env: py313-mode_ansible-ansible10
-          - name: Ans_313_11
-            python_version: '3.13'
-            tox_env: py313-mode_ansible-ansible11
-          - name: Van_313_11
-            python_version: '3.13'
-            tox_env: py313-mode_ansible-ansible11-strategy_linear
-
-          - name: Mito_27
-            tox_env: py27-mode_mitogen
-          - name: Mito_36
-            python_version: '3.6'
-            tox_env: py36-mode_mitogen
           - name: Mito_313
             python_version: '3.13'
             tox_env: py313-mode_mitogen
@@ -167,15 +116,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - name: Mito_313
-            tox_env: py313-mode_mitogen
-
           - name: Loc_313_11
             tox_env: py313-mode_localhost-ansible11
 
-          - name: Van_313_11
-            tox_env: py313-mode_localhost-ansible11-strategy_linear
-
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5

diff --git a/mitogen/core.py b/mitogen/core.py
@@ -55,7 +55,7 @@ def _path_importer_cache(cls, path):
                     return None
             return super()._path_importer_cache(path)
 
-    if sys.version_info[:2] <= (3, 12):
+    if sys.version_info[:2] <= (3, 13):  # I don't expect this workaround to work on 3.13, just ruling it out.
         for i, mpf in enumerate(sys.meta_path):
             if mpf is _frozen_importlib_external.PathFinder:
                 sys.meta_path[i] = MonkeyPatchedPathFinder

diff --git a/tests/ansible/hosts/group_vars/all.yml b/tests/ansible/hosts/group_vars/all.yml
@@ -1,3 +1,30 @@
 ---
+become_unpriv_available: >-
+  {#
+    Vanilla Ansible >= 4 (ansible-core >= 2.11) can use `setfacl` for
+    unpriv -> unpriv, but Mitogen test containers lack setfacl
+    https://github.com/mitogen-hq/mitogen/issues/1118
+
+    Mitogen + Ansible can do unpriv -> unpriv without temporary files,
+    but Ansible >= 11 (ansible-core >= 2.18) detection tries to use Python
+    3.13 which hits https://github.com/python/cpython/issues/115911 on macOS.
+  #}
+  {{-
+    (
+      not is_mitogen
+      and ansible_facts.distribution in ["MacOSX"]
+      and ansible_version.full is version("2.11", ">=", strict=True)
+    )
+    or (
+      is_mitogen
+      and not ansible_facts.distribution in ["MacOSX"]
+    )
+    or (
+      is_mitogen
+      and ansible_python_interpreter is not defined
+      and ansible_version.full is version("2.18", "<", strict=True)
+    )
+  -}}
+
 pkg_mgr_python_interpreter: python
 pkg_repos_overrides: []
diff --git a/tests/ansible/integration/action/make_tmp_path.yml b/tests/ansible/integration/action/make_tmp_path.yml
@@ -142,6 +142,13 @@
     # readonly homedir
     #
 
+    - name: Confirm readonly_homedir state
+      become: true
+      shell: stat ~mitogen__readonly_homedir
+      register: stat_home_mitogen__readonly_homedir
+    - debug:
+        var: stat_home_mitogen__readonly_homedir
+
     - name: Try writing to temp directory for the readonly_homedir user
       become: true
       become_user: mitogen__readonly_homedir
@@ -152,6 +159,11 @@
           result['path'] = path
           open(path, 'w').write("bar")
       register: tmp_path
+      # Possibly hitting https://github.com/python/cpython/issues/115911
+      # with Python 3.13 + macOS + Ansible 11
+      when:
+        - ansible_version.full is version('2.18', '<', strict=True)
+          or not is_mitogen
 
     #
     # modules get the same base dir

diff --git a/tests/ansible/integration/become/su_password.yml b/tests/ansible/integration/become/su_password.yml
@@ -55,23 +55,15 @@
       vars:
         ansible_become_pass: user1_password
       when:
-        # CI containers lack `setfacl` for unpriv -> unpriv
-        # https://github.com/mitogen-hq/mitogen/issues/1118
-        - is_mitogen
-          or (ansible_facts.distribution in ["MacOSX"]
-              and ansible_version.full is version("2.11", ">=", strict=True))
+        - become_unpriv_available
 
     - assert:
         that:
           - out.stdout == 'mitogen__user1'
         fail_msg: |
           out={{ out }}
       when:
-        # CI containers lack `setfacl` for unpriv -> unpriv
-        # https://github.com/mitogen-hq/mitogen/issues/1118
-        - is_mitogen
-          or (ansible_facts.distribution in ["MacOSX"]
-              and ansible_version.full is version("2.11", ">=", strict=True))
+        - become_unpriv_available
 
     - name: Ensure password su without chdir succeeds
       shell: whoami
@@ -81,23 +73,15 @@
       vars:
         ansible_become_pass: user1_password
       when:
-        # CI containers lack `setfacl` for unpriv -> unpriv
-        # https://github.com/mitogen-hq/mitogen/issues/1118
-        - is_mitogen
-          or (ansible_facts.distribution in ["MacOSX"]
-              and ansible_version.full is version("2.11", ">=", strict=True))
+        - become_unpriv_available
 
     - assert:
         that:
           - out.stdout == 'mitogen__user1'
         fail_msg: |
           out={{ out }}
       when:
-        # CI containers lack `setfacl` for unpriv -> unpriv
-        # https://github.com/mitogen-hq/mitogen/issues/1118
-        - is_mitogen
-          or (ansible_facts.distribution in ["MacOSX"]
-              and ansible_version.full is version("2.11", ">=", strict=True))
+        - become_unpriv_available
 
   tags:
     - su

diff --git a/tests/ansible/integration/become/sudo_nonexistent.yml b/tests/ansible/integration/become/sudo_nonexistent.yml
@@ -9,10 +9,7 @@
       ignore_errors: true
       register: out
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
 
     - name: Verify raw module output.
       assert:
@@ -26,10 +23,7 @@
         fail_msg: |
           out={{ out }}
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
   tags:
     - sudo
     - sudo_nonexistent
diff --git a/tests/ansible/integration/become/sudo_password.yml b/tests/ansible/integration/become/sudo_password.yml
@@ -13,10 +13,7 @@
       changed_when: false
       ignore_errors: true
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
 
     - assert:
         that: |
@@ -28,10 +25,7 @@
         fail_msg: |
           out={{ out }}
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
 
     - name: Ensure password sudo incorrect.
       become: true
@@ -44,10 +38,7 @@
         ansible_become_pass: nopes
       ignore_errors: true
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
 
     - assert:
         that: |
@@ -58,10 +49,7 @@
         fail_msg: |
           out={{ out }}
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
 
     - block:
         - name: Ensure password sudo succeeds
@@ -80,10 +68,7 @@
             fail_msg: |
               sudo_password_success_whoami={{ sudo_password_success_whoami }}
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
   tags:
     - sudo
     - sudo_password
diff --git a/tests/ansible/integration/become/sudo_requiretty.yml b/tests/ansible/integration/become/sudo_requiretty.yml
@@ -13,12 +13,16 @@
         cmd: whoami
       changed_when: false
       register: sudo_require_tty_whoami
+      when:
+        - become_unpriv_available
 
     - assert:
         that:
           - sudo_require_tty_whoami.stdout == 'mitogen__require_tty'
         fail_msg: |
           sudo_require_tty_whoami={{ sudo_require_tty_whoami }}
+      when:
+        - become_unpriv_available
 
     - name: Verify we can login to a passworded requiretty account
       become: true
@@ -29,12 +33,16 @@
         cmd: whoami
       changed_when: false
       register: sudo_require_tty_password_whoami
+      when:
+        - become_unpriv_available
 
     - assert:
         that:
           - sudo_require_tty_password_whoami.stdout == 'mitogen__require_tty_pw_required'
         fail_msg: |
           sudo_require_tty_password_whoami={{ sudo_require_tty_password_whoami }}
+      when:
+        - become_unpriv_available
   tags:
     - mitogen_only
     - sudo

diff --git a/tests/ansible/integration/become/templated_by_inv.yml b/tests/ansible/integration/become/templated_by_inv.yml
@@ -27,8 +27,4 @@
         - become_templated_by_inv_whoami is failed
           or become_templated_by_inv_whoami.stdout != expected_become_users[inventory_hostname]
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_become_user in ['root']
-          or ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
diff --git a/tests/ansible/integration/become/templated_by_play_keywords.yml b/tests/ansible/integration/become/templated_by_play_keywords.yml
@@ -47,7 +47,4 @@
         - become_templated_by_play_keywords_password_whoami is failed
           or become_templated_by_play_keywords_password_whoami.stdout != 'mitogen__pw_required'
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
diff --git a/tests/ansible/integration/become/templated_by_play_vars.yml b/tests/ansible/integration/become/templated_by_play_vars.yml
@@ -46,7 +46,4 @@
         - become_templated_by_play_vars_password_whoami is failed
           or become_templated_by_play_vars_password_whoami.stdout != 'mitogen__pw_required'
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
diff --git a/tests/ansible/integration/become/templated_by_task_keywords.yml b/tests/ansible/integration/become/templated_by_task_keywords.yml
@@ -77,7 +77,4 @@
         - become_templated_by_task_with_delegate_to_password_whoami is failed
           or become_templated_by_task_with_delegate_to_password_whoami.stdout != 'mitogen__pw_required'
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
diff --git a/tests/ansible/integration/playbook_semantics/with_items.yml b/tests/ansible/integration/playbook_semantics/with_items.yml
@@ -35,7 +35,4 @@
               - second_run.results[item | int].stdout == user_expected
           with_sequence: start=0 end=2
       when:
-        # https://github.com/ansible/ansible/pull/70785
-        - ansible_facts.distribution not in ["MacOSX"]
-          or ansible_version.full is version("2.11", ">=", strict=True)
-          or is_mitogen
+        - become_unpriv_available
diff --git a/tox.ini b/tox.ini
@@ -85,7 +85,7 @@ deps =
     ansible8: ansible~=8.0
     ansible9: ansible~=9.0
     ansible10: ansible~=10.0
-    ansible11: ansible>=11.0.0a2
+    ansible11: ansible>=11.0
 install_command =
     python -m pip --no-python-version-warning --disable-pip-version-check install {opts} {packages}
 commands_pre =