Move use of constraints out of install_cmd

If you have a -c in the install_cmd it gets used with all the deps
supplied this means that the lower-constraints job actually install from
upper-constraints :(

You can see what I mean in [1]
Note both lower-constraints.txt and upper-constraints.txt are used ; and
---
Collecting oslo.log===3.39.0 (from -c /home/zuul/src/git.openstack.org/openstack/requirements/upper-constraints.txt (line 247))
---

With this fixed we find a few minimums that needs to be bumped:

 * oslo.policy >= 1.33.0
   keystone uses the scope_types[2] kwarg to RuleDefault which was
   introduced in 52c82ff9ab04dd78ff7045cb30d2f5de535dd7da which is
   contained in 1.32.0  ; also we need the 'policy-in-code' feature
   which is in 1.33.0
 * oslo.log >= 0.38.0
   keystone used the ROCKY[3] constant for deprecations which was
   introduced in d68a895ee8e61b5c9d4ef368e7f04252e84649e9 which is
   contained in 3.38.0
 * msgpack >= 0.5.0
   the 0.4.x versions have been removed from pypi so we have to bump the
   minimum :(
 * SQLAlchemy >= 1.0.13
   identity_provider_id in token payload is byte in python3 which
   triggers a sqlalchemy bug[4]. The bug has been fixed in 1.0.13
 * keystonemiddleware >= 5.1.0
   unified limit feature uses system scope feature which is supported
   in keystonemiddleware after 5.1.0
   

We also add correct some errors in bindep.txt related to use on Fedora

[1] http://logs.openstack.org/47/599447/2/check/openstack-tox-lower-constraints/bbc912b/tox/lower-constraints-1.log
[2] http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/policies/access_token.py#n24
[3] http://git.openstack.org/cgit/openstack/keystone/tree/keystone/conf/default.py#n50
[4] http://docs.sqlalchemy.org/en/latest/changelog/changelog_10.html#change-a14dd2e73d889d065acc07a77b1ee7cb

Change-Id: Ic0de6799fddd86a70abae2c87c92d565072ebdb9

bindep.txt

@@ -21,6 +21,7 @@ python3-all-dev [platform:dpkg]
 
 cyrus-sasl-devel [platform:rpm]
 libxml2-devel [platform:rpm]
+libxslt-devel [platform:rpm]
 mariadb [platform:rpm]
 mariadb-devel [platform:rpm]
 mariadb-server [platform:rpm]
@@ -28,6 +29,6 @@ openldap-devel [platform:rpm]
 openssl-devel [platform:rpm]
 postgresql-devel [platform:rpm]
 postgresql-server [platform:rpm]
-python-devel [platform:rpm]
+python2-devel [platform:rpm]
 python3-devel [platform:fedora]
 python34-devel [platform:centos]

lower-constraints.txt

@@ -41,7 +41,7 @@ iso8601==0.1.12
 Jinja2==2.10
 jsonschema==2.6.0
 keystoneauth1==3.4.0
-keystonemiddleware==4.17.0
+keystonemiddleware==5.1.0
 kombu==4.1.0
 ldappool===2.0.0
 linecache2==1.0.0
@@ -52,7 +52,7 @@ mccabe==0.2.1
 mock==2.0.0
 monotonic==1.4
 mox3==0.25.0
-msgpack==0.4.0
+msgpack==0.5.0
 netaddr==0.7.19
 netifaces==0.10.6
 oauthlib==0.6.2
@@ -66,10 +66,10 @@ oslo.config==5.2.0
 oslo.context==2.21.0
 oslo.db==4.27.0
 oslo.i18n==3.15.3
-oslo.log==3.37.0
+oslo.log==3.38.0
 oslo.messaging==5.29.0
 oslo.middleware==3.31.0
-oslo.policy==1.30.0
+oslo.policy==1.33.0
 oslo.serialization==2.18.0
 oslo.service==1.30.0
 oslo.utils==3.33.0
@@ -120,7 +120,7 @@ snowballstemmer==1.2.1
 Sphinx==1.6.5
 sphinxcontrib-websupport==1.0.1
 sqlalchemy-migrate==0.11.0
-SQLAlchemy==1.0.10
+SQLAlchemy==1.0.13
 sqlparse==0.2.4
 statsd==3.2.2
 stestr==1.0.0

requirements.txt

@@ -13,12 +13,12 @@ Flask!=0.11,>=1.0.2  # BSD
 Flask-RESTful>=0.3.5  # BSD
 cryptography>=2.1 # BSD/Apache-2.0
 six>=1.10.0 # MIT
-SQLAlchemy!=1.1.5,!=1.1.6,!=1.1.7,!=1.1.8,>=1.0.10 # MIT
+SQLAlchemy>=1.0.13 # MIT
 sqlalchemy-migrate>=0.11.0 # Apache-2.0
 stevedore>=1.20.0 # Apache-2.0
 passlib>=1.7.0 # BSD
 python-keystoneclient>=3.8.0 # Apache-2.0
-keystonemiddleware>=4.17.0 # Apache-2.0
+keystonemiddleware>=5.1.0 # Apache-2.0
 bcrypt>=3.1.3 # Apache-2.0
 scrypt>=0.8.0 # BSD
 oslo.cache>=1.26.0 # Apache-2.0
@@ -28,9 +28,9 @@ oslo.context>=2.21.0 # Apache-2.0
 oslo.messaging>=5.29.0 # Apache-2.0
 oslo.db>=4.27.0 # Apache-2.0
 oslo.i18n>=3.15.3 # Apache-2.0
-oslo.log>=3.37.0 # Apache-2.0
+oslo.log>=3.38.0 # Apache-2.0
 oslo.middleware>=3.31.0 # Apache-2.0
-oslo.policy>=1.30.0 # Apache-2.0
+oslo.policy>=1.33.0 # Apache-2.0
 oslo.serialization!=2.19.1,>=2.18.0 # Apache-2.0
 oslo.utils>=3.33.0 # Apache-2.0
 oauthlib>=0.6.2 # BSD
@@ -38,6 +38,6 @@ pysaml2>=4.5.0
 dogpile.cache>=0.6.2 # BSD
 jsonschema<3.0.0,>=2.6.0 # MIT
 pycadf!=2.0.0,>=1.1.0 # Apache-2.0
-msgpack>=0.4.0 # Apache-2.0
+msgpack>=0.5.0 # Apache-2.0
 osprofiler>=1.4.0 # Apache-2.0
 pytz>=2013.6 # MIT

tox.ini

@@ -5,9 +5,11 @@ envlist = py35,py27,pep8,api-ref,docs,genconfig,genpolicy,releasenotes
 
 [testenv]
 usedevelop = True
-install_command = pip install -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt} {opts} {packages}
+install_command = pip install {opts} {packages}
 setenv = VIRTUAL_ENV={envdir}
-deps = -r{toxinidir}/test-requirements.txt
+deps = -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt}
+       -r{toxinidir}/requirements.txt
+       -r{toxinidir}/test-requirements.txt
        .[ldap,memcache,mongodb]
 commands =
   find keystone -type f -name "*.pyc" -delete
@@ -41,7 +43,9 @@ commands =
 basepython = python3
 # NOTE(browne): This is required for the integration test job of the bandit
 # project. Please do not remove.
-deps = .[bandit]
+deps = -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt}
+       -r{toxinidir}/requirements.txt
+       .[bandit]
 commands = bandit -r keystone -x tests
 
 [testenv:cover]