Add back debian support

We cannot build python-qpid-proton pip package on debian due to it
having 1.1.0 openssl. This seems like a lesser used package, so for now
we will just skip building it and give the world some time to resolve
the issue.

Change-Id: I4af88cb57ce2fc614d373c83cf3745c4aaaa5c7b

dockerfiles/debian/Dockerfile

@@ -1,5 +1,24 @@
 ARG FROM=debian:stretch
 FROM ${FROM}
 
-COPY ceph.list /etc/apt/sources.list.d/
+ARG DEBIAN_URL=http://deb.debian.org/debian/
+ARG DEBIAN_SECURITY_URL=http://security.debian.org/
+ARG DEBIAN_SECURITY_DISTRIBUTION=stretch/updates
+ARG CEPH_URL=http://download.ceph.com/debian-luminous/
+ARG ALLOW_UNAUTHENTICATED=false
+ARG PIP_INDEX_URL=https://pypi.python.org/simple/
+ARG PIP_TRUSTED_HOST=pypi.python.org
+ENV PIP_INDEX_URL=${PIP_INDEX_URL}
+ENV PIP_TRUSTED_HOST=${PIP_TRUSTED_HOST}
+
+COPY sources.list /etc/apt/
 COPY ceph.gpg /etc/apt/trusted.gpg.d/
+RUN sed -i \
+        -e "s|%%DEBIAN_URL%%|${DEBIAN_URL}|g" \
+        -e "s|%%DEBIAN_SECURITY_URL%%|${DEBIAN_SECURITY_URL}|g" \
+        -e "s|%%DEBIAN_SECURITY_DISTRIBUTION%%|${DEBIAN_SECURITY_DISTRIBUTION}|g" \
+        -e "s|%%CEPH_URL%%|${CEPH_URL}|g" \
+        /etc/apt/sources.list
+
+# NOTE(SamYaple): Remove this when infra starts signing thier mirrors
+RUN echo "APT::Get::AllowUnauthenticated \"${ALLOW_UNAUTHENTICATED}\";" > /etc/apt/apt.conf.d/allow-unathenticated

dockerfiles/debian/ceph.list

@@ -1 +0,0 @@
-deb http://download.ceph.com/debian-luminous/ stretch main

dockerfiles/debian/sources.list

@@ -0,0 +1,5 @@
+deb %%DEBIAN_URL%% stretch main
+deb %%DEBIAN_URL%% stretch-updates main
+deb %%DEBIAN_URL%% stretch-backports main
+deb %%DEBIAN_SECURITY_URL%% %%DEBIAN_SECURITY_DISTRIBUTION%% main
+deb %%CEPH_URL%% stretch main

dockerfiles/ubuntu/ceph.list

@@ -1 +0,0 @@
-deb http://download.ceph.com/debian-jewel/ xenial main

dockerfiles/ubuntu/cloud-archive.list

@@ -1 +0,0 @@
-deb http://ubuntu-cloud.archive.canonical.com/ubuntu xenial-updates/pike main

playbooks/vars.yaml

@@ -41,3 +41,19 @@ distros:
         PROJECT_REPO: http://172.17.0.1/git/openstack/{{ project }}
         WHEELS: 172.17.0.1:5000/openstackloci/requirements:{{ branch }}-ubuntu
         FROM: base:ubuntu
+  - name: debian
+    image: debian:stretch
+    buildargs:
+      base:
+        DEBIAN_URL: http://{{ zuul_site_mirror_fqdn }}/debian/
+        DEBIAN_SECURITY_URL: http://{{ zuul_site_mirror_fqdn }}/debian/
+        DEBIAN_SECURITY_DISTRIBUTION: stretch-security
+        CEPH_URL: http://{{ zuul_site_mirror_fqdn }}/ceph-deb-luminous/
+        ALLOW_UNAUTHENTICATED: "true"
+        PIP_INDEX_URL: http://{{ zuul_site_mirror_fqdn }}/pypi/simple
+        PIP_TRUSTED_HOST: "{{ zuul_site_mirror_fqdn }}"
+      project:
+        PROJECT: "{{ project }}"
+        PROJECT_REPO: http://172.17.0.1/git/openstack/{{ project }}
+        WHEELS: 172.17.0.1:5000/openstackloci/requirements:master-debian
+        FROM: base:debian

scripts/requirements.sh

@@ -8,6 +8,12 @@ $(dirname $0)/install_packages.sh
 $(dirname $0)/clone_project.sh
 mv /tmp/requirements/{global-requirements.txt,upper-constraints.txt} /
 
+# NOTE(SamYaple): https://issues.apache.org/jira/browse/PROTON-1381
+# TODO(SamYaple): Make python-qpid-proton build here (possibly patch it)
+if (( $(openssl version | awk -F'[ .]' '{print $3}') >= 1 )); then
+    sed -i '/python-qpid-proton/d' /upper-constraints.txt
+fi
+
 # NOTE(SamYaple): Build all deps in parallel. This is safe because we are
 # constrained on the version and we are building with --no-deps
 pushd $(mktemp -d)