[stable-2.10] Temporary fix for cryptography issues. (#73530). (#73533)

(cherry picked from commit 1a2da990a403e1c836574c5883ec0c17a98d2a65)

Co-authored-by: Matt Clay <mclay@redhat.com>

10 files changed, 52 insertions, 5 deletions

diff --git a/changelogs/fragments/cryptography-fix.yml b/changelogs/fragments/cryptography-fix.yml
new file mode 100644
index 0000000000..4c3b8aa059
--- /dev/null
+++ b/changelogs/fragments/cryptography-fix.yml
@@ -0,0 +1,2 @@
+bugfixes:
+  - ansible-test - Temporarily limit ``cryptography`` to versions before 3.4 to enable tests to function.
diff --git a/test/integration/targets/setup_paramiko/aliases b/test/integration/targets/setup_paramiko/aliases
new file mode 100644
index 0000000000..c49be25410
--- /dev/null
+++ b/test/integration/targets/setup_paramiko/aliases
@@ -0,0 +1 @@
+needs/target/setup_remote_tmp_dir
diff --git a/test/integration/targets/setup_paramiko/constraints.txt b/test/integration/targets/setup_paramiko/constraints.txt
new file mode 100644
index 0000000000..c502ba0d9c
--- /dev/null
+++ b/test/integration/targets/setup_paramiko/constraints.txt
@@ -0,0 +1 @@
+cryptography >= 2.5, < 3.4
diff --git a/test/integration/targets/setup_paramiko/install-Darwin-python-3.yml b/test/integration/targets/setup_paramiko/install-Darwin-python-3.yml
index a156f8066a..8926fe333e 100644
--- a/test/integration/targets/setup_paramiko/install-Darwin-python-3.yml
+++ b/test/integration/targets/setup_paramiko/install-Darwin-python-3.yml
@@ -1,6 +1,9 @@
+- name: Setup remote constraints
+  include_tasks: setup-remote-constraints.yml
 - name: Install Paramiko for Python 3 on MacOS
   pip: # no homebrew package manager in core, just use pip
     name: paramiko
+    extra_args: "-c {{ remote_constraints }}"
   environment:
     # Not sure why this fixes the test, but it does.
     SETUPTOOLS_USE_DISTUTILS: stdlib
diff --git a/test/integration/targets/setup_paramiko/install-FreeBSD-11-python-3.yml b/test/integration/targets/setup_paramiko/install-FreeBSD-11-python-3.yml
index b8ca6c9e1d..eb01d00f1e 100644
--- a/test/integration/targets/setup_paramiko/install-FreeBSD-11-python-3.yml
+++ b/test/integration/targets/setup_paramiko/install-FreeBSD-11-python-3.yml
@@ -4,6 +4,9 @@
   # installation without a virtualenv succeeds
   pip:
     name: pip==18.1
+- name: Setup remote constraints
+  include_tasks: setup-remote-constraints.yml
 - name: Install Paramiko for Python 3 on FreeBSD 11
   pip: # no py36-paramiko package exists for FreeBSD 11
     name: paramiko
+    extra_args: "-c {{ remote_constraints }}"
diff --git a/test/integration/targets/setup_paramiko/install-RedHat-8-python-3.yml b/test/integration/targets/setup_paramiko/install-RedHat-8-python-3.yml
index dbc0f65c59..19fd3f63ab 100644
--- a/test/integration/targets/setup_paramiko/install-RedHat-8-python-3.yml
+++ b/test/integration/targets/setup_paramiko/install-RedHat-8-python-3.yml
@@ -1,3 +1,6 @@
+- name: Setup remote constraints
+  include_tasks: setup-remote-constraints.yml
 - name: Install Paramiko for Python 3 on RHEL 8
   pip: # no python3-paramiko package exists for RHEL 8
     name: paramiko
+    extra_args: "-c {{ remote_constraints }}"
diff --git a/test/integration/targets/setup_paramiko/setup-remote-constraints.yml b/test/integration/targets/setup_paramiko/setup-remote-constraints.yml
new file mode 100644
index 0000000000..a86d47777c
--- /dev/null
+++ b/test/integration/targets/setup_paramiko/setup-remote-constraints.yml
@@ -0,0 +1,12 @@
+- name: Setup remote temporary directory
+  include_role:
+    name: setup_remote_tmp_dir
+
+- name: Record constraints.txt path on remote host
+  set_fact:
+    remote_constraints: "{{ remote_tmp_dir }}/constraints.txt"
+
+- name: Copy constraints.txt to remote host
+  copy:
+    src: "constraints.txt"
+    dest: "{{ remote_constraints }}"
diff --git a/test/integration/targets/setup_paramiko/setup.sh b/test/integration/targets/setup_paramiko/setup.sh
index 8c4f6f1c77..316320c304 100644
--- a/test/integration/targets/setup_paramiko/setup.sh
+++ b/test/integration/targets/setup_paramiko/setup.sh
@@ -5,5 +5,5 @@ set -eux
 
 export ANSIBLE_TEST_PREFER_VENV=1
 source virtualenv.sh  # for pip installs, if needed, otherwise unused
-ansible-playbook ../setup_paramiko/install.yml -i ../setup_paramiko/inventory "$@"
+ANSIBLE_ROLES_PATH=../ ansible-playbook ../setup_paramiko/install.yml -i ../setup_paramiko/inventory "$@"
 trap 'ansible-playbook ../setup_paramiko/uninstall.yml -i ../setup_paramiko/inventory "$@"' EXIT
diff --git a/test/lib/ansible_test/_internal/executor.py b/test/lib/ansible_test/_internal/executor.py
index 881439ef94..b13d679054 100644
--- a/test/lib/ansible_test/_internal/executor.py
+++ b/test/lib/ansible_test/_internal/executor.py
@@ -252,7 +252,9 @@ def get_cryptography_requirement(args, python_version):  # type: (EnvironmentCon
             # see https://cryptography.io/en/latest/changelog.html#v3-2
             cryptography = 'cryptography < 3.2'
         else:
-            cryptography = 'cryptography'
+            # cryptography 3.4+ fails to install on many systems
+            # this is a temporary work-around until a more permanent solution is available
+            cryptography = 'cryptography < 3.4'
     else:
         # cryptography 2.1+ requires setuptools 18.5+
         # see https://github.com/pyca/cryptography/blob/62287ae18383447585606b9d0765c0f1b8a9777c/setup.py#L26
diff --git a/test/sanity/code-smell/docs-build.py b/test/sanity/code-smell/docs-build.py
index 9b6cbd3f86..688ce3541c 100755
--- a/test/sanity/code-smell/docs-build.py
+++ b/test/sanity/code-smell/docs-build.py
@@ -4,17 +4,37 @@ __metaclass__ = type
 
 import os
 import re
+import shutil
 import subprocess
 import sys
+import tempfile
 
 
 def main():
     base_dir = os.getcwd() + os.path.sep
     docs_dir = os.path.abspath('docs/docsite')
-    cmd = ['make', 'base_singlehtmldocs']
 
-    sphinx = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=docs_dir)
-    stdout, stderr = sphinx.communicate()
+    # TODO: Remove this temporary hack to constrain 'cryptography' when we have
+    # a better story for dealing with it.
+    tmpfd, tmp = tempfile.mkstemp()
+    requirements_txt = os.path.join(base_dir, 'requirements.txt')
+    shutil.copy2(requirements_txt, tmp)
+    lines = []
+    with open(requirements_txt, 'r') as f:
+        for line in f.readlines():
+            if line.strip() == 'cryptography':
+                line = 'cryptography < 3.4\n'
+            lines.append(line)
+
+    with open(requirements_txt, 'w') as f:
+        f.writelines(lines)
+
+    try:
+        cmd = ['make', 'base_singlehtmldocs']
+        sphinx = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=docs_dir)
+        stdout, stderr = sphinx.communicate()
+    finally:
+        shutil.move(tmp, requirements_txt)
 
     stdout = stdout.decode('utf-8')
     stderr = stderr.decode('utf-8')