Add local bindep.txt and limit bandit version

As it was announced [1] global bindep-fallback.txt was removed and now
projects need to have a local bindep.txt to be able to install binary
dependencies for testing.

In test jobs the script tools/test-setup.sh is called which requires
mysql and postgres servers and clients to be installed.

[1] http://lists.openstack.org/pipermail/openstack-discuss/2019-June/007272.html

(cherry picked from commit d116b21696)

Note(elod.illes): patch was modified so that the test-requires files
are kept. An upper constraint was also added for bandit. This actually
freezes requirements (required by bandit) on stable branch.

Conflicts:
      tox.ini

Change-Id: If9befe4115c64c2fda52321002ba5fe1124eaf7c
(cherry picked from commit 916fd05627)
(cherry picked from commit ec50bb8fa4)

bindep.txt

@@ -0,0 +1,41 @@
+# This is a cross-platform list tracking distribution packages needed for install and tests;
+# see https://docs.openstack.org/infra/bindep/ for additional information.
+
+mysql-server [platform:dpkg]
+mariadb-server [platform:redhat]
+postgresql
+
+build-essential [platform:dpkg]
+python-dev [platform:dpkg]
+python3-all-dev [platform:dpkg]
+libxml2-dev [platform:dpkg]
+libxslt1-dev [platform:dpkg]
+libyaml-dev [platform:dpkg]
+libssl-dev [platform:dpkg]
+libffi-dev [platform:dpkg]
+libmysqlclient-dev [platform:dpkg]
+libpq-dev [platform:dpkg]
+mysql-client [platform:dpkg]
+postgresql-client [platform:dpkg]
+
+gcc [platform:rpm]
+python-devel [platform:rpm]
+python3-devel [platform:fedora platform:suse]
+python3 [platform:suse]
+libxml2-devel [platform:rpm]
+libxslt-devel [platform:rpm]
+libyaml-devel [platform:rpm]
+openssl-devel [platform:rpm]
+libffi-devel [platform:redhat platform:suse !platform:opensuse423]
+libffi48-devel [platform:opensuse423]
+mariadb-devel [platform:redhat]
+libmysqlclient-devel [platform:suse]
+postgresql-devel [platform:rpm]
+
+dev-libs/libxml2 [platform:gentoo]
+dev-libs/libxslt [platform:gentoo]
+dev-libs/libyaml [platform:gentoo]
+dev-libs/openssl [platform:gentoo]
+virtual/libffi [platform:gentoo]
+dev-db/mariadb [platform:gentoo]
+

test-requirements.txt

@@ -4,7 +4,7 @@
 
 # Hacking already pins down pep8, pyflakes and flake8
 hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0
-bandit!=1.6.0,>=1.1.0 # Apache-2.0
+bandit<1.6.0,>=1.1.0 # Apache-2.0
 coverage!=4.4,>=4.0 # Apache-2.0
 fixtures>=3.0.0 # Apache-2.0/BSD
 kombu!=4.0.2,>=4.0.0 # BSD

tox.ini

@@ -115,3 +115,15 @@ commands = oslo_debug_helper {posargs}
 
 [testenv:releasenotes]
 commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
+
+[testenv:bindep]
+basepython = python3
+# Do not install any requirements. We want this to be fast and work even if
+# system dependencies are missing, since it's used to tell you what system
+# dependencies are missing! This also means that bindep must be installed
+# separately, outside of the requirements files, and develop mode disabled
+# explicitly to avoid unnecessarily installing the checked-out repo too (this
+# further relies on "tox.skipsdist = True" above).
+deps = bindep
+commands = bindep test
+usedevelop = False