Require keystone-user/-group for pki_setup

If pki_setup is run as root, require the keystone-user
and keystone-group parameter to be set, to enforce
the proper permissions to be created on the files.

This follows a suggestion in the Bugreport.

Fixes LP Bug #1031372

Change-Id: I00d9e0499d16716af3267914b6b78841f1ad1e0f
fix error default policy for create_project

change `admin_or_owner` to `admin_required`

bug #1188457

Change-Id: I26b1617eadf12fcf1572bb382f4cdfbcbb275cc4
Ignore the .update-venv directory.

It appears to be made when you resume a broken venv creation.
It is listed in oslo's pep8 exclude list and .gitignore.

Change-Id: I3db570c778ca9c6e0df72f5512ed1a9c643ecb38
run_tests.sh should use flake8 (bug 1180609)

Existing flags (e.g. --pep8) are intentionally left alone.

Change-Id: I300aaee17294b88c7d1ba4daad462af407c67d4f
Base.get_engine honor allow_global_engine=False

This change makes it so that get_engine() in
keystone.common.sql.core.Base does not return the global engine
when allow_global_engine is False.

The behavior before could be described like:
If get_engine() has never been called with allow_global_engine=True,
then if you pass allow_global_engine=False returns a new engine.
Otherwise, you always get the global engine (even if
allow_global_engine=False)

The new behavior is:
If get_engine() is called with allow_global_engine=True then
it returns the global engine, otherwise it returns a new engine.

Change-Id: I756b54d9f3984733f56d09c11b2702c3451102f2
Raise key length defaults

Extend RSA keylength to 2048 bits by default,
as the previous default of 1024 bit is considered
weak since 12/31/2010.

Also unify the message_md to the openssl builtin default.

Fixes bug 1103002

Change-Id: I70e90b7696f8a56073c3d6bdc9ed5d30cfa3401f
Import eventlet patch from oslo.

This was abandoned once before: https://review.openstack.org/#/c/25781/

However this is not to do with packaging. This is required if we use
eventlet subprocess module (like we should be) in jenkins tests for
python2.6.

Also imports patch_tox_venv.py. This is a cutdown version of what would
happen in run_tests.sh but for tox environments which is how jenkins
runs tests now.

Change-Id: I369c3e464dfbe3a754f90db58785e97ac87b36c0
Check schema when dropping constraints.

MySQL constraints are not named like others.

Previous to this patch, we were looking up the names in MySQL's
INFORMATION_SCHEMA.REFERENTIAL_CONSTRAINTS table, but were
neglecting to also check the Schema. The same table
could be in multiple schemas; as an example a unit test
run on the same machine as devstack in two different schemas
but the same RDBMS.

This patch uses a better approach. Sqlalchemy knows about the
name of the constraint, it just doesn't use it in the
drop statement by default. The Constraint objects from
the main sqlalchemy package don't do drops, only those out
of the migrate package. This patch finds the name of the
constraint in the constraint bound to the table and passes it
to the migrate ForeignKeyConstraint to use in the drop statement

Bug 1186353

Change-Id: Ida2184021de9dd220a36507a8a625cf4210d17f7
Move coverage output dir for Jenkins.

* tox.ini: Set the coverage html output dir to {toxinidir}/cover so that
Jenkins can find it and upload the coverage to the log server.

Change-Id: I231485ce46b1ef91eb219e63552203b86d6d65c2
Merge "run_tests.sh should use flake8 (bug 1180609)"
Remove bufferedhttp

This module appears to be unused.

Change-Id: Ia4c7cd337e15dc58785282c5165ad2dab8e2fa60
Pass on arguments on Base.get_session

This change makes it so that the arguments for the session
creation function get_session() get passed on when it calls the
function to create the session.

Change-Id: I2f889ab36bd3aa3bf4441a13eb2b610b54349cbb
Merge "Require keystone-user/-group for pki_setup"
Merge "Import eventlet patch from oslo."
Missing contraction: Its -> It's (bug 1176213)

Change-Id: I9403289012eea3b78f9bf02154827554d9e07462
Fix internal doc links (bug 1176211)

Change-Id: Iab416c941c7db00d3fd725e1c0e12ed7fc193dd0
Merge "Check schema when dropping constraints."
Commit transaction in migration

Some databases (e.g., DB2) would deadlock on migration 16 because a
lock was held on the domain table for an uncommitted alter and then
SQLAlchemy queried the domain table info in a separate transaction.

The fix is to commit the ALTER statements to release the lock so
that the domain table schema query will not block.

I've run this with sqlite, mysql, and postgresql and they all worked.

Part of fix for bug 1188785

Change-Id: Ic540a6cb09a0c525df7aaea55b64af96f0dd87c7
Merge "Missing contraction: Its -> It's (bug 1176213)"
Merge "Raise key length defaults"