THRIFT-4579: Move up to Ubuntu Bionic for CI builds

make dlang library compatible with openssl-1.1 for Ubuntu Bionic
Requires an upstream deimos update to be compatible.

15 files changed, 386 insertions, 84 deletions

diff --git a/.travis.yml b/.travis.yml
index b3a6a2672..daee7b322 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -43,7 +43,7 @@ env:
     - SCRIPT="cmake.sh"
     - BUILD_ARG=""
     - BUILD_ENV="-e CC=gcc -e CXX=g++ -e THRIFT_CROSSTEST_CONCURRENCY=4"
-    - DISTRO=ubuntu-artful
+    - DISTRO=ubuntu-bionic
     - BUILD_LIBS="CPP C_GLIB HASKELL JAVA PYTHON TESTING TUTORIALS"  # only meaningful for CMake builds
     - TRAVIS_BUILD_STAGE=test
     # DOCKER_REPO (this works for all builds as a source for docker images - you can override for fork builds in your Travis settings)
@@ -57,13 +57,13 @@ jobs:
     - stage: docker
       script: true
       env:
-        - JOB="Docker Build ubuntu-xenial 16.04"
+        - JOB="Docker Build ubuntu-xenial 16.04 LTS"
         - DISTRO=ubuntu-xenial
         - TRAVIS_BUILD_STAGE=docker
     - script: true
       env:
-        - JOB="Docker Build ubuntu-artful 17.10"
-        - DISTRO=ubuntu-artful
+        - JOB="Docker Build ubuntu-bionic 18.04 LTS"
+        - DISTRO=ubuntu-bionic
         - TRAVIS_BUILD_STAGE=docker
 
     # ========================= stage: thrift =======================
@@ -144,8 +144,7 @@ jobs:
     # TODO: Remove them once migrated to CMake
     - script: build/docker/run.sh
       env:
-        - JOB="Autotools (Ubuntu Artful)"
-        - DISTRO=ubuntu-artful
+        - JOB="Autotools (Ubuntu Bionic)"
         - SCRIPT="autotools.sh"
 
     - script: build/docker/run.sh
@@ -158,13 +157,11 @@ jobs:
     - script: build/docker/run.sh
       env:
         - JOB="make dist"
-        - DISTRO=ubuntu-artful
         - SCRIPT="make-dist.sh"
 
     - script: build/docker/run.sh
       env:
         - JOB="Debian Packages"
-        - DISTRO=ubuntu-artful
         - SCRIPT="dpkg.sh"
 
   ### ------------------------- phase: osx -------------------------
diff --git a/build/docker/README.md b/build/docker/README.md
index 3d65a82ce..545fc0f26 100644
--- a/build/docker/README.md
+++ b/build/docker/README.md
@@ -1,42 +1,65 @@
 # Docker Integration #
 
-Due to the large number of language requirements to build Apache Thrift, docker containers are used to build and test the project on a variety of platforms to provide maximum test coverage.
+Due to the large number of languages supported by Apache Thrift,
+docker containers are used to build and test the project on a
+variety of platforms to provide maximum test coverage.
+
+## Appveyor Integration ##
+
+At this time the Appveyor scripts do not use docker containers.
+Once Microsoft supports Visual Studio Build Tools running inside
+nano containers (instead of Core, which is huge) then we will
+consider using containers for the Windows builds as well.
 
 ## Travis CI Integration ##
 
-The Travis CI scripts use the following environment variables and logic to determine their behavior.
+The Travis CI scripts use the following environment variables and
+logic to determine their behavior:
 
 ### Environment Variables ###
 
 | Variable | Default | Usage |
 | -------- | ----- | ------- |
-| `DISTRO` | `ubuntu-xenial` | Set by various build jobs in `.travis.yml` to run builds in different containers.  Not intended to be set externally.|
+| `DISTRO` | `ubuntu-bionic` | Set by various build jobs in `.travis.yml` to run builds in different containers.  Not intended to be set externally.|
 | `DOCKER_REPO` | `thrift/thrift-build` | The name of the Docker Hub repository to obtain and store docker images. |
 | `DOCKER_USER` | `<none>` | The Docker Hub account name containing the repository. |
 | `DOCKER_PASS` | `<none>` | The Docker Hub account password to use when pushing new tags. |
 
-For example, the default docker image that is used in builds if no overrides are specified would be: `thrift/thrift-build:ubuntu-xenial`
+For example, the default docker image that is used in builds if no overrides are specified would be: `thrift/thrift-build:ubuntu-bionic`
 
 ### Forks ###
 
-If you have forked the Apache Thrift repository and you would like to use your own Docker Hub account to store thrift build images, you can use the Travis CI web interface to set the `DOCKER_USER`, `DOCKER_PASS`, and `DOCKER_REPO` variables in a secure manner.  Your fork builds will then pull, push, and tag the docker images in your account.
+If you have forked the Apache Thrift repository and you would like
+to use your own Docker Hub account to store thrift build images,
+you can use the Travis CI web interface to set the `DOCKER_USER`,
+`DOCKER_PASS`, and `DOCKER_REPO` variables in a secure manner.
+Your fork builds will then pull, push, and tag the docker images
+in your account.
 
 ### Logic ###
 
-The Travis CI build runs in two phases - first the docker images are rebuilt for each of the three supported containers if they do not match the Dockerfile that was used to build the most recent tag.  If a `DOCKER_PASS` environment variable is specified, the docker stage builds will attempt to log into Docker Hub and push the resulting tags.
+The Travis CI build runs in two phases - first the docker images are rebuilt
+for each of the supported containers if they do not match the Dockerfile that
+was used to build the most recent tag.  If a `DOCKER_PASS` environment
+variable is specified, the docker stage builds will attempt to log into
+Docker Hub and push the resulting tags.
 
 ## Supported Containers ##
 
-The Travis CI (continuous integration) builds use the Ubuntu Trusty, Xenial, and Artful images to maximize language level coverage.
+The Travis CI (continuous integration) builds use the Ubuntu Bionic
+(18.04 LTS) and Xenial (16.04 LTS) images to maximize language level
+coverage.
 
 ### Ubuntu ###
 
-* xenial (stable)
-* artful (current)
+* bionic (stable, current)
+* artful (previous stable)
+* xenial (legacy)
 
 ## Unsupported Containers ##
 
 These containers may be in various states, and may not build everything.
+They can be found in the `old/` subdirectory.
 
 ### CentOS ###
 * 7.3
@@ -50,7 +73,9 @@ These containers may be in various states, and may not build everything.
 
 ## Building like Travis CI does, locally ##
 
-We recommend you build locally the same way Travis CI does, so that when you submit your pull request you will run into fewer surprises.  To make it a little easier, put the following into your `~/.bash_aliases` file:
+We recommend you build locally the same way Travis CI does, so that when you
+submit your pull request you will run into fewer surprises.  To make it a
+little easier, put the following into your `~/.bash_aliases` file:
 
     # Kill all running containers.
     alias dockerkillall='docker kill $(docker ps -q)'
@@ -76,27 +101,34 @@ We recommend you build locally the same way Travis CI does, so that when you sub
       docker run -v $(pwd):/thrift/src -it $1 /bin/bash
     }
 
-To pull down the current image being used to build (the same way Travis CI does it) - if it is out of date in any way it will build a new one for you:
+Then, to pull down the current image being used to build (the same way
+Travis CI does it) - if it is out of date in any way it will build a
+new one for you:
 
-    thrift$ DOCKER_REPO=thrift/thrift-build DISTRO=ubuntu-xenial build/docker/refresh.sh
+    thrift$ DOCKER_REPO=thrift/thrift-build DISTRO=ubuntu-bionic build/docker/refresh.sh
 
-To run all unit tests (just like Travis CI):
+To run all unit tests (just like Travis CI does):
 
-    thrift$ dockerrun ubuntu-xenial
+    thrift$ dockerrun ubuntu-bionic
     root@8caf56b0ce7b:/thrift/src# build/docker/scripts/autotools.sh
 
-To run the cross tests (just like Travis CI):
+To run the cross tests (just like Travis CI does):
 
-    thrift$ dockerrun ubuntu-xenial
+    thrift$ dockerrun ubuntu-bionic
     root@8caf56b0ce7b:/thrift/src# build/docker/scripts/cross-test.sh
 
 When you are done, you want to clean up occasionally so that docker isn't using lots of extra disk space:
 
     thrift$ dockerclean
 
-You need to run the docker commands from the root of the git repository for them to work.
+You need to run the docker commands from the root of the local clone of the
+thrift git repository for them to work.
 
-When you are done in the root docker shell you can `exit` to go back to your user host shell.  Once the unit tests and cross test passes locally, then submit he changes, and squash the pull request to one commit to make it easier to merge.  Thanks.  I am going to update the docker README.md with this information so others can leverage it too.  Now you are building like Travis CI does!
+When you are done in the root docker shell you can `exit` to go back to
+your user host shell.  Once the unit tests and cross test passes locally,
+submit the changes, and if desired squash the pull request to one commit
+to make it easier to merge (the committers can squash at commit time now
+that GitHub is the master repository).  Now you are building like Travis CI does!
 
 ## Raw Commands for Building with Docker ##
 
@@ -104,7 +136,7 @@ If you do not want to use the same scripts Travis CI does, you can do it manuall
 
 Build the image:
 
-    thrift$ docker build -t thrift build/docker/ubuntu-xenial
+    thrift$ docker build -t thrift build/docker/ubuntu-bionic
 
 Open a command prompt in the image:
 
@@ -114,53 +146,53 @@ Open a command prompt in the image:
 
 Last updated: October 1, 2017
 
-| Tool      | ubuntu-xenial | ubuntu-artful | Notes |
+| Tool      | ubuntu-xenial | ubuntu-bionic | Notes |
 | :-------- | :------------ | :------------ | :---- |
-| ant       | 1.9.6         | 1.9.9         |       |
+| ant       | 1.9.6         | 1.10.3        |       |
 | autoconf  | 2.69          | 2.69          |       |
-| automake  | 1.15          | 1.15          |       |
+| automake  | 1.15          | 1.15.1        |       |
 | bison     | 3.0.4         | 3.0.4         |       |
-| boost     | 1.58.0        | 1.63.0        | artful: stock boost 1.62.0 has problems running unit tests |
-| cmake     | 3.5.1         | 3.9.1         |       |
-| cppcheck  | 1.72          | 1.80          |       |
-| flex      | 2.6.0         | 2.6.1         |       |
-| glibc     | 2.23          | 2.26          |       |
-| libevent  | 2.0.21        | 2.1           |       |
-| libstdc++ | 5.4.0         | 7.2.0         |       |
+| boost     | 1.58.0        | 1.65.1        |       |
+| cmake     | 3.5.1         | 3.10.2        |       |
+| cppcheck  | 1.72          | 1.82          |       |
+| flex      | 2.6.0         | 2.6.4         |       |
+| libc6     | 2.23          | 2.27          | glibc |
+| libevent  | 2.0.21        | 2.1.8         |       |
+| libstdc++ | 5.4.0         | 7.3.0         |       |
 | make      | 4.1           | 4.1           |       |
-| openssl   | 1.0.2g        | 1.0.2g        |       |
-| qt5       | 5.5.1         | 5.9.1         |       |
+| openssl   | 1.0.2g        | 1.1.0g        |       |
+| qt5       | 5.5.1         | 5.9.5         |       |
 
 ## Compiler/Language Versions per Dockerfile ##
 
-| Language  | ubuntu-xenial | ubuntu-artful | Notes |
+| Language  | ubuntu-xenial | ubuntu-bionic | Notes |
 | :-------- | :------------ | :------------ | :---- |
-| as of     | Mar 06, 2018  | Mar 19, 2018  |       |
+| as of     | Mar 06, 2018  | Jun 6, 2018   |       |
 | as3       |               |               | Not in CI |
-| C++ gcc   | 5.4.0         | 7.2.0         |       |
-| C++ clang | 3.8           | 4.0           |       |
+| C++ gcc   | 5.4.0         | 7.3.0         |       |
+| C++ clang | 3.8           | 6.0           |       |
 | C# (mono) | 4.2.1.0       | 4.6.2.7       |       |
-| c_glib    | 2.48.2        | 2.54.0        |       |
-| cl (sbcl) |               | 1.4.5         |       |
+| c_glib    | 2.48.2        | 2.56.0        |       |
+| cl (sbcl) |               | 1.4.8         |       |
 | cocoa     |               |               | Not in CI |
 | d         | 2.075.1       | 2.080.0       |       |
 | dart      | 1.22.1        | 1.24.3        |       |
 | delphi    |               |               | Not in CI |
-| dotnet    | 2.1.4         | 2.1.4         | v2.1.4 SDK uses v2.0.5 Runtime |
-| erlang    | 18.3          | 20.0.4        |       |
-| go        | 1.7.6         | 1.10          |       |
+| dotnet    | 2.1.4         | 2.1.300       |       |
+| erlang    | 18.3          | 20.2.2        |       |
+| go        | 1.7.6         | 1.10.2        |       |
 | haskell   | 7.10.3        | 8.0.2         |       |
 | haxe      | 3.2.1         | 3.4.4         | THRIFT-4352: avoid 3.4.2 |
-| java      | 1.8.0_151     | 1.8.0_151     |       |
+| java      | 1.8.0_151     | 1.8.0_171     |       |
 | js        |               |               | Unsure how to look for version info? |
 | lua       | 5.2.4         | 5.2.4         | Lua 5.3: see THRIFT-4386 |
-| nodejs    | 6.13.0        | 8.9.4         |       |
-| ocaml     |               | 4.04.0        | THRIFT-4517: ocaml 4.02.3 on xenial appears broken |
-| perl      | 5.22.1        | 5.26.0        |       |
-| php       | 7.0.22        | 7.1.11        |       |
-| python    | 2.7.12        | 2.7.14        |       |
-| python3   | 3.5.2         | 3.6.3         |       |
-| ruby      | 2.3.1p112     | 2.3.3p222     |       |
-| rust      | 1.17.0        | 1.21.0        |       |
+| nodejs    | 6.13.0        | 8.11.2        |       |
+| ocaml     |               | 4.05.0        | THRIFT-4517: ocaml 4.02.3 on xenial appears broken |
+| perl      | 5.22.1        | 5.26.1        |       |
+| php       | 7.0.22        | 7.2.5         |       |
+| python    | 2.7.12        | 2.7.15rc1     |       |
+| python3   | 3.5.2         | 3.6.5         |       |
+| ruby      | 2.3.1p112     | 2.5.1p57      |       |
+| rust      | 1.17.0        | 1.24.1        |       |
 | smalltalk |               |               | Not in CI |
 | swift     |               |               | Not in CI |
diff --git a/build/docker/Vagrantfile b/build/docker/old/Vagrantfile
index 5eac6e686..5eac6e686 100644
--- a/build/docker/Vagrantfile
+++ b/build/docker/old/Vagrantfile
diff --git a/build/docker/centos-7.3/Dockerfile b/build/docker/old/centos-7.3/Dockerfile
index 096bbaa45..096bbaa45 100644
--- a/build/docker/centos-7.3/Dockerfile
+++ b/build/docker/old/centos-7.3/Dockerfile
diff --git a/build/docker/debian-jessie/Dockerfile b/build/docker/old/debian-jessie/Dockerfile
index 7bc74fc24..7bc74fc24 100644
--- a/build/docker/debian-jessie/Dockerfile
+++ b/build/docker/old/debian-jessie/Dockerfile
diff --git a/build/docker/debian-stretch/Dockerfile b/build/docker/old/debian-stretch/Dockerfile
index 503eecd42..503eecd42 100644
--- a/build/docker/debian-stretch/Dockerfile
+++ b/build/docker/old/debian-stretch/Dockerfile
diff --git a/build/docker/ubuntu-trusty/Dockerfile b/build/docker/old/ubuntu-trusty/Dockerfile
index a8e4d3baa..a8e4d3baa 100644
--- a/build/docker/ubuntu-trusty/Dockerfile
+++ b/build/docker/old/ubuntu-trusty/Dockerfile
diff --git a/build/docker/ubuntu-bionic/Dockerfile b/build/docker/ubuntu-bionic/Dockerfile
new file mode 100644
index 000000000..ac3b259fd
--- /dev/null
+++ b/build/docker/ubuntu-bionic/Dockerfile
@@ -0,0 +1,267 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# Apache Thrift Docker build environment for Ubuntu Bionic
+# Using all stock Ubuntu Bionic packaging except for:
+# - d: dmd does not come with Ubuntu
+# - dart: does not come with Ubuntu
+# - dotnet: does not come with Ubuntu
+# - go: want latest
+# - nodejs: want v8, bionic comes with v6
+# - openssl: to support dlang and the deimos for openssl, need to use 1.0 not 1.1
+#
+
+FROM buildpack-deps:bionic-scm
+MAINTAINER Apache Thrift <dev@thrift.apache.org>
+ENV DEBIAN_FRONTEND noninteractive
+
+### Add apt repos
+
+RUN apt-get update && \
+    apt-get dist-upgrade -y && \
+    apt-get install -y --no-install-recommends \
+      apt \
+      apt-transport-https \
+      apt-utils \
+      curl \
+      dirmngr \
+      software-properties-common \
+      wget
+
+# csharp (mono) - if we ever want a later version
+# RUN echo "deb http://download.mono-project.com/repo/debian xenial main" | tee /etc/apt/sources.list.d/mono.list && \
+#     apt-key adv --keyserver keyserver.ubuntu.com --recv-keys A6A19B38D3D831EF
+
+# Dart
+RUN curl https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - && \
+    curl https://storage.googleapis.com/download.dartlang.org/linux/debian/dart_stable.list > \
+      /etc/apt/sources.list.d/dart_stable.list
+
+# dotnet (netcore)
+RUN curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > /etc/apt/trusted.gpg.d/microsoft.gpg && \
+    wget -q -O /etc/apt/sources.list.d/microsoft-prod.list https://packages.microsoft.com/config/ubuntu/18.04/prod.list && \
+    chown root:root /etc/apt/trusted.gpg.d/microsoft.gpg && \
+    chown root:root /etc/apt/sources.list.d/microsoft-prod.list
+
+# node.js
+RUN curl -sL https://deb.nodesource.com/gpgkey/nodesource.gpg.key | apt-key add - && \
+    echo "deb https://deb.nodesource.com/node_8.x bionic main" | tee /etc/apt/sources.list.d/nodesource.list
+
+### install general dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+`# General dependencies` \
+      bash-completion \
+      bison \
+      build-essential \
+      clang \
+      cmake \
+      debhelper \
+      flex \
+      gdb \
+      llvm \
+      ninja-build \
+      pkg-config \
+      valgrind \
+      vim
+ENV PATH /usr/lib/llvm-6.0/bin:$PATH
+
+# boost-1.62 has a terrible bug in boost::test, see https://svn.boost.org/trac10/ticket/12507
+RUN apt-get install -y --no-install-recommends \
+`# C++ dependencies` \
+      libboost-all-dev \
+      libevent-dev \
+      libssl-dev \
+      qt5-default \
+      qtbase5-dev \
+      qtbase5-dev-tools
+
+RUN apt-get install -y --no-install-recommends \
+`# csharp (mono) dependencies` \
+      mono-devel
+
+ENV SBCL_VERSION 1.4.8
+RUN \
+`# Common Lisp (sbcl) dependencies` \
+    curl --version && \
+    curl -O -J -L https://kent.dl.sourceforge.net/project/sbcl/sbcl/${SBCL_VERSION}/sbcl-${SBCL_VERSION}-x86-64-linux-binary.tar.bz2 && \
+    tar xjf sbcl-${SBCL_VERSION}-x86-64-linux-binary.tar.bz2 && \
+    cd sbcl-${SBCL_VERSION}-x86-64-linux && \
+    ./install.sh && \
+    sbcl --version && \
+    cd .. && \
+    rm -rf sbcl*
+
+ENV D_VERSION     2.080.0
+ENV DMD_DEB       dmd_2.080.0-0_amd64.deb
+RUN \
+`# D dependencies` \
+    wget -q http://downloads.dlang.org/releases/2.x/${D_VERSION}/${DMD_DEB} && \
+    dpkg --install ${DMD_DEB} && \
+    rm -f ${DMD_DEB} && \
+    mkdir -p /usr/include/dmd/druntime/import/deimos /usr/include/dmd/druntime/import/C && \
+    curl -sSL https://github.com/D-Programming-Deimos/libevent/archive/master.tar.gz| tar xz && \
+    mv libevent-master/deimos/* /usr/include/dmd/druntime/import/deimos/ && \
+    mv libevent-master/C/* /usr/include/dmd/druntime/import/C/ && \
+    rm -rf libevent-master && \
+    curl -sSL https://github.com/jeking3/openssl/archive/tls_method.tar.gz| tar xz && \
+    mv openssl-tls_method/deimos/* /usr/include/dmd/druntime/import/deimos/ && \
+    mv openssl-tls_method/C/* /usr/include/dmd/druntime/import/C/ && \
+    rm -rf openssl-tls_method
+
+RUN apt-get install -y --no-install-recommends \
+      `# Dart dependencies` \
+      dart/stable
+ENV PATH /usr/lib/dart/bin:$PATH
+
+RUN apt-get install -y --no-install-recommends \
+`# dotnet core dependencies` \
+      dotnet-sdk-2.1
+
+RUN apt-get install -y --no-install-recommends \
+`# Erlang dependencies` \
+      erlang-base \
+      erlang-eunit \
+      erlang-dev \
+      erlang-tools \
+      rebar
+
+RUN apt-get install -y --no-install-recommends \
+`# GlibC dependencies` \
+      libglib2.0-dev
+
+# golang
+ENV GOLANG_VERSION 1.10.2
+ENV GOLANG_DOWNLOAD_URL https://golang.org/dl/go$GOLANG_VERSION.linux-amd64.tar.gz
+ENV GOLANG_DOWNLOAD_SHA256 4b677d698c65370afa33757b6954ade60347aaca310ea92a63ed717d7cb0c2ff
+RUN curl -fsSL "$GOLANG_DOWNLOAD_URL" -o golang.tar.gz && \
+      echo "$GOLANG_DOWNLOAD_SHA256  golang.tar.gz" | sha256sum -c - && \
+            tar -C /usr/local -xzf golang.tar.gz && \
+                  ln -s /usr/local/go/bin/go /usr/local/bin && \
+                        rm golang.tar.gz
+
+RUN apt-get install -y --no-install-recommends \
+`# Haskell dependencies` \
+      ghc \
+      cabal-install
+
+RUN apt-get install -y --no-install-recommends \
+`# Haxe dependencies` \
+      haxe \
+      neko \
+      neko-dev && \
+    haxelib setup --always /usr/share/haxe/lib && \
+    haxelib install --always hxcpp 2>&1 > /dev/null
+
+RUN apt-get install -y --no-install-recommends \
+`# Java dependencies` \
+      ant \
+      ant-optional \
+      openjdk-8-jdk \
+      maven && \
+    update-alternatives --set java /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java
+
+RUN apt-get install -y --no-install-recommends \
+`# Lua dependencies` \
+      lua5.2 \
+      lua5.2-dev
+# https://bugs.launchpad.net/ubuntu/+source/lua5.3/+bug/1707212
+# lua5.3 does not install alternatives!
+# need to update our luasocket code, lua doesn't have luaL_openlib any more
+
+RUN apt-get install -y --no-install-recommends \
+`# Node.js dependencies` \
+      nodejs
+
+RUN apt-get install -y --no-install-recommends \
+`# OCaml dependencies` \
+      ocaml \
+      opam && \
+    opam init --yes && \
+    opam install --yes oasis
+
+RUN apt-get install -y --no-install-recommends \
+`# Perl dependencies` \
+      libbit-vector-perl \
+      libclass-accessor-class-perl \
+      libcrypt-ssleay-perl \
+      libio-socket-ssl-perl \
+      libnet-ssleay-perl
+
+RUN apt-get install -y --no-install-recommends \
+`# Php dependencies` \
+      php \
+      php-cli \
+      php-dev \
+      php-pear \
+      re2c \
+      composer
+
+RUN apt-get install -y --no-install-recommends \
+`# Python dependencies` \
+      python-all \
+      python-all-dbg \
+      python-all-dev \
+      python-ipaddress \
+      python-pip \
+      python-setuptools \
+      python-six \
+      python-tornado \
+      python-twisted \
+      python-wheel \
+      python-zope.interface && \
+   pip install --upgrade backports.ssl_match_hostname
+
+RUN apt-get install -y --no-install-recommends \
+`# Python3 dependencies` \
+      python3-all \
+      python3-all-dbg \
+      python3-all-dev \
+      python3-pip \
+      python3-setuptools \
+      python3-six \
+      python3-tornado \
+      python3-twisted \
+      python3-wheel \
+      python3-zope.interface
+
+RUN apt-get install -y --no-install-recommends \
+`# Ruby dependencies` \
+      ruby \
+      ruby-dev \
+      ruby-bundler
+
+RUN apt-get install -y --no-install-recommends \
+`# Rust dependencies` \
+      cargo \
+      rustc
+
+# cppcheck-1.82 has a nasty cpp parser bug, so we're using something newer
+RUN apt-get install -y --no-install-recommends \
+`# Static Code Analysis dependencies` \
+      cppcheck \
+      sloccount && \
+    pip install flake8 && \
+    wget -q "https://launchpad.net/ubuntu/+source/cppcheck/1.83-2/+build/14874703/+files/cppcheck_1.83-2_amd64.deb" && \
+    dpkg -i cppcheck_1.83-2_amd64.deb && \
+    rm cppcheck_1.83-2_amd64.deb
+
+# Clean up
+RUN rm -rf /var/cache/apt/* && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm -rf /tmp/* && \
+    rm -rf /var/tmp/*
+
+ENV THRIFT_ROOT /thrift
+RUN mkdir -p $THRIFT_ROOT/src
+COPY Dockerfile $THRIFT_ROOT/
+WORKDIR $THRIFT_ROOT/src
diff --git a/lib/cpp/src/thrift/stdcxx.h b/lib/cpp/src/thrift/stdcxx.h
index 5113940a5..c8cabf520 100644
--- a/lib/cpp/src/thrift/stdcxx.h
+++ b/lib/cpp/src/thrift/stdcxx.h
@@ -21,6 +21,7 @@
 #define _THRIFT_STDCXX_H_ 1
 
 #include <boost/config.hpp>
+#include <boost/version.hpp>
 
 ///////////////////////////////////////////////////////////////////
 //
@@ -29,7 +30,11 @@
 ///////////////////////////////////////////////////////////////////
 
 #if defined(BOOST_NO_CXX11_HDR_FUNCTIONAL) || (defined(_MSC_VER) && _MSC_VER < 1800) || defined(FORCE_BOOST_FUNCTIONAL)
+#if (BOOST_VERSION <= 106500)
 #include <boost/tr1/functional.hpp>
+#else
+#include <tr1/functional>
+#endif
 #define _THRIFT_FUNCTIONAL_TR1_ 1
 #endif
 
diff --git a/lib/cpp/test/TFileTransportTest.cpp b/lib/cpp/test/TFileTransportTest.cpp
index 700a1ac3c..d0c26b3a0 100644
--- a/lib/cpp/test/TFileTransportTest.cpp
+++ b/lib/cpp/test/TFileTransportTest.cpp
@@ -53,20 +53,6 @@ FsyncLog* fsync_log;
  * Helper code
  **************************************************************************/
 
-// Provide BOOST_WARN_LT() and BOOST_WARN_GT(), in case we're compiled
-// with an older version of boost
-#ifndef BOOST_WARN_LT
-#define BOOST_WARN_CMP(a, b, op, check_fn)                                                         \
-  check_fn((a)op(b),                                                                               \
-           "check " BOOST_STRINGIZE(a) " " BOOST_STRINGIZE(op) " " BOOST_STRINGIZE(                \
-               b) " failed: " BOOST_STRINGIZE(a) "="                                               \
-           << (a) << " " BOOST_STRINGIZE(b) "=" << (b))
-
-#define BOOST_WARN_LT(a, b) BOOST_WARN_CMP(a, b, <, BOOST_WARN_MESSAGE)
-#define BOOST_WARN_GT(a, b) BOOST_WARN_CMP(a, b, >, BOOST_WARN_MESSAGE)
-#define BOOST_WARN_LT(a, b) BOOST_WARN_CMP(a, b, <, BOOST_WARN_MESSAGE)
-#endif // BOOST_WARN_LT
-
 /**
  * Class to record calls to fsync
  */
@@ -218,7 +204,7 @@ BOOST_AUTO_TEST_CASE(test_destructor) {
     // If any attempt takes more than 500ms, treat that as a failure.
     // Treat this as a fatal failure, so we'll return now instead of
     // looping over a very slow operation.
-    BOOST_WARN_LT(delta, 500000);
+    BOOST_WARN( delta < 500000 );
 
     // Normally, it takes less than 100ms on my dev box.
     // However, if the box is heavily loaded, some of the test runs
@@ -296,7 +282,7 @@ void test_flush_max_us_impl(uint32_t flush_us, uint32_t write_us, uint32_t test_
   for (FsyncLog::CallList::const_iterator it = calls->begin(); it != calls->end(); ++it) {
     if (prev_time) {
       int delta = time_diff(prev_time, &it->time);
-      BOOST_WARN_LT(delta, max_allowed_delta);
+      BOOST_WARN( delta < max_allowed_delta );
     }
     prev_time = &it->time;
   }
@@ -346,7 +332,7 @@ BOOST_AUTO_TEST_CASE(test_noop_flush) {
     // Use a fatal fail so we break out early, rather than continuing to make
     // many more slow flush() calls.
     int delta = time_diff(&start, &now);
-    BOOST_WARN_LT(delta, 2000000);
+    BOOST_WARN( delta < 2000000 );
   }
 }
 
diff --git a/lib/d/src/thrift/server/base.d b/lib/d/src/thrift/server/base.d
index f97adbe25..b19768e62 100644
--- a/lib/d/src/thrift/server/base.d
+++ b/lib/d/src/thrift/server/base.d
@@ -112,12 +112,12 @@ protected:
     outputProtocolFactory_ = outputProtocolFactory;
   }
 
-  TProcessorFactory processorFactory_;
-  TServerTransport serverTransport_;
-  TTransportFactory inputTransportFactory_;
-  TTransportFactory outputTransportFactory_;
-  TProtocolFactory inputProtocolFactory_;
-  TProtocolFactory outputProtocolFactory_;
+  public TProcessorFactory processorFactory_;
+  public TServerTransport serverTransport_;
+  public TTransportFactory inputTransportFactory_;
+  public TTransportFactory outputTransportFactory_;
+  public TProtocolFactory inputProtocolFactory_;
+  public TProtocolFactory outputProtocolFactory_;
 }
 
 /**
diff --git a/lib/d/src/thrift/transport/ssl.d b/lib/d/src/thrift/transport/ssl.d
index fbcb6eea6..f8ce40eb7 100644
--- a/lib/d/src/thrift/transport/ssl.d
+++ b/lib/d/src/thrift/transport/ssl.d
@@ -249,8 +249,12 @@ class TSSLContext {
     }
     count_++;
 
-    ctx_ = SSL_CTX_new(SSLv23_method());
-    SSL_CTX_set_options(ctx_, SSL_OP_NO_SSLv2);
+    static if (OPENSSL_VERSION_NUMBER >= 0x1010000f) { // OPENSSL_VERSION_AT_LEAST(1, 1)) {
+        ctx_ = SSL_CTX_new(TLS_method());
+    } else {
+        ctx_ = SSL_CTX_new(SSLv23_method());
+        SSL_CTX_set_options(ctx_, SSL_OP_NO_SSLv2);
+    }
     SSL_CTX_set_options(ctx_, SSL_OP_NO_SSLv3);   // THRIFT-3164
     enforce(ctx_, getSSLException("SSL_CTX_new"));
     SSL_CTX_set_mode(ctx_, SSL_MODE_AUTO_RETRY);
@@ -448,6 +452,7 @@ private:
     }
     initialized_ = true;
 
+   static if (OPENSSL_VERSION_NUMBER < 0x1010000f) { // OPENSSL_VERSION_BEFORE(1, 1)) {
     SSL_library_init();
     SSL_load_error_strings();
 
@@ -465,12 +470,14 @@ private:
     CRYPTO_set_dynlock_create_callback(assumeNothrow(&dynlockCreateCallback));
     CRYPTO_set_dynlock_lock_callback(assumeNothrow(&dynlockLockCallback));
     CRYPTO_set_dynlock_destroy_callback(assumeNothrow(&dynlockDestroyCallback));
+   }
   }
 
   static void cleanupOpenSSL() {
     if (!initialized_) return;
 
     initialized_ = false;
+   static if (OPENSSL_VERSION_NUMBER < 0x1010000f) { // OPENSSL_VERSION_BEFORE(1, 1)) {
     CRYPTO_set_locking_callback(null);
     CRYPTO_set_dynlock_create_callback(null);
     CRYPTO_set_dynlock_lock_callback(null);
@@ -478,6 +485,7 @@ private:
     CRYPTO_cleanup_all_ex_data();
     ERR_free_strings();
     ERR_remove_state(0);
+   }
   }
 
   static extern(C) {
diff --git a/lib/py/src/transport/TSSLSocket.py b/lib/py/src/transport/TSSLSocket.py
index f85778a45..b54ca5dd9 100644
--- a/lib/py/src/transport/TSSLSocket.py
+++ b/lib/py/src/transport/TSSLSocket.py
@@ -368,7 +368,7 @@ class TSSLServerSocket(TSocket.TServerSocket, TSSLBase):
         plain_client, addr = self.handle.accept()
         try:
             client = self._wrap_socket(plain_client)
-        except (ssl.SSLError, OSError):
+        except (ssl.SSLError, socket.error, OSError):
             logger.exception('Error while accepting from %s', addr)
             # failed handshake/ssl wrap, close socket to client
             plain_client.close()
diff --git a/test/cpp/src/TestClient.cpp b/test/cpp/src/TestClient.cpp
index 9544a4a69..87bb0283a 100644
--- a/test/cpp/src/TestClient.cpp
+++ b/test/cpp/src/TestClient.cpp
@@ -946,7 +946,7 @@ int main(int argc, char** argv) {
         failed = true;
       } else {
         map<Numberz::type, Insanity>::const_iterator it26 = it2->second.find(Numberz::SIX);
-        if (it26 == it1->second.end() || it26->second != Insanity()) {
+        if (it26 == it2->second.end() || it26->second != Insanity()) {
           failed = true;
         }
       }
diff --git a/test/features/nosslv3.sh b/test/features/nosslv3.sh
index e550d511c..38cca0786 100755
--- a/test/features/nosslv3.sh
+++ b/test/features/nosslv3.sh
@@ -32,6 +32,13 @@ function nosslv3
 {
   local nego
   local negodenied
+  local opensslv
+
+  opensslv=$(openssl version | cut -d' ' -f2)
+  if [[ $opensslv > "1.0" ]]; then
+    echo "[pass] OpenSSL 1.1 or later - no need to check ssl3"
+    return 0
+  fi
 
   # echo "openssl s_client -connect $THRIFTHOST:$THRIFTPORT -CAfile ../keys/CA.pem -ssl3 2>&1 < /dev/null"
   nego=$(openssl s_client -connect $THRIFTHOST:$THRIFTPORT -CAfile ../keys/CA.pem -ssl3 2>&1 < /dev/null)