Merge ~rafaeldtinoco/ubuntu/+source/pcs:lp1855943 into ubuntu/+source/pcs:ubuntu/focal-devel

[Rafael David Tinoco]

PPA: https://launchpad.net/~rafaeldtinoco/+archive/ubuntu/lp1855943 (pcs)
BUG: https://bugs.launchpad.net/ubuntu/+source/pyagentx/+bug/1855943 (pcs)

[Andreas Hasenack (ahasenack)]

This test will fail in an unprivileged lxd container, because corosync won't start:
Jan 06 13:46:54 focal-pcs corosync[18089]: [TOTEM ] Initializing transport (Kronosnet).
Jan 06 13:46:55 focal-pcs corosync[18089]: [TOTEM ] knet_handle_new failed: File name too long (36)
Jan 06 13:46:55 focal-pcs corosync[18089]: [KNET ] transport: Failed to set socket buffer via force option 33: Operation not permitted
Jan 06 13:46:55 focal-pcs corosync[18089]: [KNET ] transport: Unable to set local socketpair receive buffer: File name too long
Jan 06 13:46:55 focal-pcs corosync[18089]: [KNET ] handle: Unable to initialize internal hostsockpair: File name too long
Jan 06 13:46:55 focal-pcs corosync[18089]: [MAIN ] Can't initialize TOTEM layer
Jan 06 13:46:55 focal-pcs corosync[18089]: [MAIN ] Corosync Cluster Engine exiting with status 15 at main.c:1531.

review: Needs Fixing

[Rafael David Tinoco (rafaeldtinoco)]

Thank you Andreas, yes, since this also depends on corosync.. it should have the workaround from https://bugs.launchpad.net/bugs/1828228

ulimit -H -l unlimited 2>/dev/null || {
    # https://bugs.launchpad.net/bugs/1828228
    echo "test disabled for unprivileged namespaces"
    exit 77
}

just like:

- corosync
- crmsh
- pacemaker

9687084... by Rafael David Tinoco on 2020-01-06

  * Skip autopkgtest for unprivileged containers: (LP: #1828228)
    - d/t/control: mark tests as skippable
    - d/t/{setup,snmp,status,testsuite-python}:
      skip if memlock can't be set to unlimited by root

[Rafael David Tinoco (rafaeldtinoco)]

Alright. Thanks for checking this @ahasenack, could you, please, review this with and without privileges ? I believe the issue has been addressed and, in your case, tests shall be skipped now (so we won't fail in armhf as an example).

[Andreas Hasenack (ahasenack)]

Checking

[Andreas Hasenack (ahasenack)]

I think the testsuite-python test doesn't need this guard. I was able to run it on an unprivileged lxd container:
...
(Reading database ... 35508 files and directories currently installed.)
Removing autopkgtest-satdep (0) ...
autopkgtest [14:34:01]: test snmp: [-----------------------
test disabled for unprivileged namespaces
autopkgtest [14:34:02]: test snmp: -----------------------]
autopkgtest [14:34:02]: test snmp: - - - - - - - - - - results - - - - - - - - - -
snmp SKIP exit status 77 and marked as skippable
autopkgtest [14:34:03]: @@@@@@@@@@@@@@@@@@@@ summary
status SKIP exit status 77 and marked as skippable
setup SKIP exit status 77 and marked as skippable
testsuite-ruby PASS
testsuite-python PASS
snmp SKIP exit status 77 and marked as skippable

andreas@nsnx:~/git/packages/pcs$ cat pcs/debian/tests/testsuite-python
#!/bin/sh

set -e

#ulimit -H -l unlimited 2>/dev/null || {
# # https://bugs.launchpad.net/bugs/1828228
# echo "test disabled for unprivileged namespaces"
# exit 77
#}

# Ubuntu uses http proxy breaking some tests
unset http_proxy
unset https_proxy

cat >>/etc/hosts <<EOF

192.168.1.1 rh7-1 rh7-1.localhost
192.168.1.2 rh7-2 rh7-2.localhost
192.168.1.3 rh7-3 rh7-3.localhost
EOF

python3 ./pcs_test/suite.py --fast-info 2>&1
andreas@nsnx:~/git/packages/pcs$

I ran it like this:

autopkgtest -o dep8-lxd-with-python-testsuite -U -s -B --apt-pocket=proposed ./pcs/ -- lxd ubuntu-daily:focal

It skipped 97 tests, just when run in a vm (and the guard in place, which let it run in that case).

[Rafael David Tinoco (rafaeldtinoco)]

I see.. but based on its control file:

Depends: pcs, pacemaker (>= 2.0), pacemaker-cli-utils (>= 2.0), fence-agents, booth-pacemaker
Restrictions: needs-root, rw-build-tree, skippable
Tests: testsuite-python

it would install pacemaker and that would make it to fail as pacemaker wouldn't start as a service (because of missing corosync).

Should we keep this "as-is", thus the workaround ? Or add a delta to Debian, skipping the tests ?

[Andreas Hasenack (ahasenack)]

Indeed, pacemaker pulls in corosync, which fails to start during the apt transaction:
...
Setting up libstonithd26:amd64 (2.0.1-5ubuntu1) ...
Setting up corosync (3.0.2-1ubuntu1) ...
Created symlink /etc/systemd/system/multi-user.target.wants/corosync.service → /lib/systemd/system/corosync.service.
Job for corosync.service failed because the control process exited with error code.
See "systemctl status corosync.service" and "journalctl -xe" for details.
Setting up libpengine27:amd64 (2.0.1-5ubuntu1) ...
Setting up libplumb2 (1.0.12-14) ...
...
Setting up pacemaker (2.0.1-5ubuntu1) ...
Created symlink /etc/systemd/system/multi-user.target.wants/pacemaker.service → /lib/systemd/system/pacemaker.service.
A dependency job for pacemaker.service failed. See 'journalctl -xe' for details.
Setting up pacemaker-cli-utils (2.0.1-5ubuntu1) ...
Processing triggers for systemd (244-3ubuntu1) ...
Processing triggers for man-db (2.9.0-2) ...
Processing triggers for libc-bin (2.30-0ubuntu3) ...
root@f1:~# echo $?
0

But that didn't fail the whole thing. In the end, neither pacemaker or corosync are running, but the tests pass. Looks like the python pcs tests don't need pacemaker/corosync running, or start their own controlled copies perhaps? Or use mocks, like in unit tests? In which case the test dependencies would be incorrect.

[Andreas Hasenack (ahasenack)]

So by not adding the check to the python testsuite, we reduce the delta, right? And it seems to work without it in an unprivileged container. Should we give this a try in bileto, or have we spent too much time on this already? :)

[Rafael David Tinoco (rafaeldtinoco)]

Sorry, was preempted. Let me re-check that and we can decide..

[Rafael David Tinoco (rafaeldtinoco)]

Alright,

So like we spoke about... after applying the patches with quilt I got no errors:

OK (skipped=97)
autopkgtest [20:50:27]: test testsuite-python: -----------------------]
autopkgtest [20:50:27]: test testsuite-python: - - - - - - - - - - results - - - - - - - - - -
testsuite-python PASS
autopkgtest [20:50:27]: @@@@@@@@@@@@@@@@@@@@ summary
testsuite-python PASS

But the "dependent" services were running:

$ ps -ef | grep -i pacemake
root 15933 1 0 20:37 ? 00:00:00 /usr/sbin/pacemakerd -f
haclust+ 15940 15933 0 20:37 ? 00:00:00 /usr/lib/pacemaker/pacemaker-based
root 15941 15933 0 20:37 ? 00:00:00 /usr/lib/pacemaker/pacemaker-fenced
root 15942 15933 0 20:37 ? 00:00:00 /usr/lib/pacemaker/pacemaker-execd
haclust+ 15943 15933 0 20:37 ? 00:00:00 /usr/lib/pacemaker/pacemaker-attrd
haclust+ 15944 15933 0 20:37 ? 00:00:00 /usr/lib/pacemaker/pacemaker-schedulerd
haclust+ 15945 15933 0 20:37 ? 00:00:00 /usr/lib/pacemaker/pacemaker-controld

And corosync service start will fail for armhf (unprivileged container).

I'm testing now without pacemaker/corosync activated.. to see if more tests are skipped because of that...

[Rafael David Tinoco (rafaeldtinoco)]

Ran 5454 tests in 789.465s

OK (skipped=97)
autopkgtest [21:28:46]: test testsuite-python: -----------------------]
autopkgtest [21:28:46]: test testsuite-python: - - - - - - - - - - results - - - - - - - - - -
testsuite-python PASS
autopkgtest [21:28:46]: @@@@@@@@@@@@@@@@@@@@ summary
testsuite-python PASS

Now I'll remove the dependencies and check...

[Rafael David Tinoco (rafaeldtinoco)]

Errr...

FileNotFoundError: [Errno 2] No such file or directory: '/usr/sbin/crm_mon': '/usr/sbin/crm_mon'

pcs.lib.errors.LibraryError: ERROR RUN_EXTERNAL_PROCESS_ERROR: {'command': '/usr/sbin/crm_mon --version', 'reason': "No such file or directory: '/usr/sbin/crm_mon'"} forceable: None

Almost everything, including CIB emulation, seem to be mocked, but... I dont think its worth messing much more with this as there are some command dependencies, at least to check corosync version, that would fail without corosync.

With that said.. my vote is to keep the workaround and skip autopkgtests in unprivileged containers entirely for now, specially considering that, in our infrastructure case, clusters aren't gonna be very useful in armhf environments.

Thoughts ? Feel free to call another opinion on this!

Cheers o/
What do you think ?

[Andreas Hasenack (ahasenack)]

Thanks for investigating the test dependencies. My only concern is that we are adding a delta to disable a test suite that seems to be working, albeit maybe by accident since the services failing to start during the apt transaction isn't triggering a fatal error. And maybe a test gets added in the future that will fail for real because of this. I'll leave it up to you, as you are maintaining this stack :)

I'm now checking why adding "rocommunity public localhost" to snmpd.conf before the other "rocommunity" lines, which is what the previous snmp test file was doing, isn't enough anymore.

[Andreas Hasenack (ahasenack)]

So the snmp dep8 test passes with net-snmp from proposed (5.8+dfsg-2ubuntu1), and with the change to d/t/snmp reverted, i.e., the sed is:

# enable localhost access to full snmp data
sed -i '/^rocommunity\s\+public/ i\
rocommunity public localhost' /etc/snmp/snmpd.conf

The resulting /etc/snmp/snmpd.conf file has:
# Read-only access to everyone to the systemonly view
rocommunity public localhost <--- added by the sed above (your change reverted)
rocommunity public default -V systemonly
rocommunity6 public default -V systemonly

This is how I ran it:
autopkgtest -o dep8-revert-localhost-test-change -U -s -B --apt-pocket=proposed ./pcs/ -- ssh -r --capability isolation-machine -H 10.9.185.247

The VM was created with multipass (cloud-init bits just for .br mirrors, ssh key, and my local proxy):
multipass launch -n focal-pcs-dep8 -m 2G -c 2 --cloud-init ~/cloud-init-proxy daily:focal

Let me run again without -B, i.e., let autopkgtest build the source package, see if that makes a difference. And I'll also enable set -x on that test.

review: Needs Information

[Andreas Hasenack (ahasenack)]

hah, set -x wasn't such a great idea, as that prints to stderr and aborts the test :)

[Andreas Hasenack (ahasenack)]

Ok, added allow-stderr, here is the last run, showing it passing without the change to the sed command in d/t/snmp:
"""
...
Get:4 http://br.archive.ubuntu.com/ubuntu focal-proposed/main amd64 snmpd amd64 5.8+dfsg-2ubuntu1 [56.4 kB]
...
autopkgtest [18:17:39]: test snmp: [-----------------------
+ ulimit -H -l unlimited
+ OUTPUT=/tmp/autopkgtest.zKhF4s/autopkgtest_tmp/walk.out
+ trap cleanup 0 2 3 15
+ service corosync start
+ service pacemaker start
+ sed -i /^rocommunity\s\+public/ i\
rocommunity public localhost /etc/snmp/snmpd.conf
+ service snmpd restart
+ service pcs_snmp_agent restart
+ sleep 60
+ pcs property set stonith-enabled=false
+ pcs property set no-quorum-policy=ignore
+ pcs resource create dummy1 ocf:heartbeat:Dummy
+ pcs resource create dummy2 ocf:heartbeat:Dummy
+ sleep 60
+ tee /tmp/autopkgtest.zKhF4s/autopkgtest_tmp/walk.out
+ snmpwalk -m PACEMAKER-PCS-V1-MIB -v 2c -c public localhost 1.3.6.1.4.1.32723.100.1
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterName.0 = STRING: "debian"
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterQuorate.0 = INTEGER: 1
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterNodesNum.0 = INTEGER: 1
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterNodesNames.0 = STRING: "node1"
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterCorosyncNodesOnlineNum.0 = INTEGER: 1
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterCorosyncNodesOnlineNames.0 = STRING: "node1"
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterCorosyncNodesOfflineNum.0 = INTEGER: 0
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterPcmkNodesOnlineNum.0 = INTEGER: 1
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterPcmkNodesOnlineNames.0 = STRING: "node1"
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterPcmkNodesStandbyNum.0 = INTEGER: 0
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterPcmkNodesOfflineNum.0 = INTEGER: 0
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterAllResourcesNum.0 = INTEGER: 2
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterAllResourcesIds.0 = STRING: "dummy1"
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterAllResourcesIds.1 = STRING: "dummy2"
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterRunningResourcesNum.0 = INTEGER: 2
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterRunningResourcesIds.0 = STRING: "dummy1"
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterRunningResourcesIds.1 = STRING: "dummy2"
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterStoppedResroucesNum.0 = INTEGER: 0
PACEMAKER-PCS-V1-MIB::pcmkPcsV1ClusterFailedResourcesNum.0 = INTEGER: 0
+ grep -q RunningResourcesNum.0 = INTEGER: 2$ /tmp/autopkgtest.zKhF4s/autopkgtest_tmp/walk.out
+ cleanup
+ service pacemaker stop
+ service corosync stop
+ rm -f /tmp/autopkgtest.zKhF4s/autopkgtest_tmp/walk.out
autopkgtest [18:19:47]: test snmp: -----------------------]
autopkgtest [18:19:47]: test snmp: - - - - - - - - - - results - - - - - - - - - -
snmp PASS
autopkgtest [18:19:47]: @@@@@@@@@@@@@@@@@@@@ summary
status PASS
setup PASS
testsuite-ruby PASS
testsuite-python PASS
snmp PASS
autopkgtest [18:19:47]: Binaries: resetting testbed apt configuration
Hit:1 http://br.archive.ubuntu.com/ubuntu focal InRelease
Hit:2 http://br.archive.ubuntu.com/ubuntu focal-updates InRelease
Hit:3 http://br.archive.ubuntu.com/ubuntu focal-backports InRelease
Hit:4 http://br.archive.ubuntu.com/ubuntu focal-...

[Rafael David Tinoco (rafaeldtinoco)]

WHAT if I tell you I *think* the line being added to /etc/snmp/snmpd.conf is intermittent ?

I ran version from regular archive and in one I had:

# Read-only access to everyone to the systemonly view
rocommunity public localhost
rocommunity public default -V systemonly
rocommunity6 public default -V systemonly

but in 2 others I had:

# Read-only access to everyone to the systemonly view
rocommunity public default -V systemonly
rocommunity6 public default -V systemonly

only :\

And the autopkgtest errors LIKELY didnt have the correct line added by sed because I could reproduce the exact same errors from autopkgtest environment :\.

I'll check this tomorrow to see what could be causing this.

Thanks a lot for checking.

[Andreas Hasenack (ahasenack)]

uh, ok, that's interesting

I uploaded my experiment to https://bileto.ubuntu.com/#/ticket/3886 let's see what happens to the dep8 tests there. Might need to trigger a new run after with net-snmp from proposed, because the one in the release pocket has that extra blank space in column 1 of the "rocommunity" line, which the sed won't match.

[Andreas Hasenack (ahasenack)]

Ok, bileto finished (https://bileto.ubuntu.com/#/ticket/3886 and https://bileto.ubuntu.com/excuses/3886/focal.html), and it passed (just not i386, but that's hinted already).

My branch is https://code.launchpad.net/~ahasenack/ubuntu/+source/pcs/+git/pcs/+ref/lp1855943 it has the changes I mentioned earlier on top of yours, and it's also rebased on top of the latest debian upload (0.10.4-2).

I think we should set -x the snmp test (which means allowing stderr in the d/t/control file) and revert the sed change, since the original one seems to be fine. If this fails randomly, with set -x we should have more debugging available. Optionally we can also cat snmpd.conf in the failure case to see why the snmpwalk didn't work, but maybe leave this more aggressive measure for later if it fails.

The unprivileged check can be there for the pythontests if you want. It's passing now without it, but might fail in the future if something is no longer mocked out. I'll leave this to you.

I'll upload pyagentx to the same bileto ppa, with the sed reverted, to see if it passes too.

[Andreas Hasenack (ahasenack)]

I uploaded https://code.launchpad.net/~ahasenack/ubuntu/+source/pyagentx/+git/pyagentx/+ref/lp1855943 to the same bileto ppa, let's see how it goes

[Andreas Hasenack (ahasenack)]

pyagentx also passed, with just the known i386 failures.

[Andreas Hasenack (ahasenack)]

I retriggered the tests in excuses (the real thing), and looks like all we need now in pcs is the unprivileged lxd guard which otherwise fails armhf:

pcs/0.10.4-2: arm64: Pass, armhf: Regression ♻ , i386: Ignored failure, ppc64el: Pass, s390x: Pass
autopkgtest [14:20:04]: test snmp: - - - - - - - - - - stderr - - - - - - - - - -
Job for corosync.service failed because the control process exited with error code.
See "systemctl status corosync.service" and "journalctl -xe" for details.
autopkgtest [14:20:06]: @@@@@@@@@@@@@@@@@@@@ summary
status FAIL non-zero exit status 1
setup FAIL non-zero exit status 1
testsuite-ruby PASS
testsuite-python PASS
snmp FAIL non-zero exit status 1

pyagentx/0.4.1-5 is already full green:
autopkgtest for pyagentx/0.4.1-5: amd64: Pass, arm64: Pass, armhf: Pass, ppc64el: Pass, s390x: Pass

[Rafael David Tinoco (rafaeldtinoco)]

Great. I'll re-push a version containing only the unprivileged lxd code.

Thanks for checking this Andreas.

[Rafael David Tinoco (rafaeldtinoco)]

I re-pushed and created a PPA for that change only:

https://launchpad.net/~rafaeldtinoco/+archive/ubuntu/lp1828228

Funny, bellow, the diff is saying I have more unmerged commits than I actually have.

The last merge:

https://code.launchpad.net/~rafaeldtinoco/ubuntu/+source/pcs/+git/pcs/+merge/376492

says "merged" but is showed here as not merged.

Should I have done a merge over pkg/ubuntu/proposed ?

[Andreas Hasenack (ahasenack)]

ubuntu/devel now has 0.10.4-2, which is correct. hash is c1c10949f1707d513fc7e091ec8d74b50be62df0

You should apply your changes on top of that.

[Andreas Hasenack (ahasenack)]

Your previous merge won't appear under the linear ubuntu/devel history because the package was synced from debian again, over the ubuntu changes. See https://launchpad.net/ubuntu/+source/pcs/+publishinghistory

b96fbd8... by Rafael David Tinoco on 2020-01-12

changelog

b319afa... by Rafael David Tinoco on 2020-01-12

update-metadata

[Rafael David Tinoco (rafaeldtinoco)]

Thanks Andreas. Publishing History helped a lot to understand what happened. I wasn't aware that sync would ignore a changed package when already in -proposed. I just pushed it again containing both merges and 1 version change only.

I have uploaded this source to PPA:

https://launchpad.net/~rafaeldtinoco/+archive/ubuntu/lp1828228

so you can better review.

The python3-tornado merge was reviewed here:

https://code.launchpad.net/~rafaeldtinoco/ubuntu/+source/pcs/+git/pcs/+merge/376492

so you can give another look before merging it also.

I hope thats enough lets see.

Please let me know if I missed something.

Best,
Rafael

[Rafael David Tinoco (rafaeldtinoco)]

Closing this as both patches were accepted upstream:

https://salsa.debian.org/ha-team/pcs/merge_requests/2
https://salsa.debian.org/ha-team/pcs/merge_requests/1

review: Disapprove

Unmerged commits

b319afa... by Rafael David Tinoco on 2020-01-12

update-metadata

b96fbd8... by Rafael David Tinoco on 2020-01-12

changelog

9687084... by Rafael David Tinoco on 2020-01-06

  * Skip autopkgtest for unprivileged containers: (LP: #1828228)
    - d/t/control: mark tests as skippable
    - d/t/{setup,snmp,status,testsuite-python}:
      skip if memlock can't be set to unlimited by root

e6950bd... by Rafael David Tinoco on 2019-12-08

  * Changed dependency back to python3-tornado 5.1.1 (LP: #1855568)
    - debian/control: drop (>= 6) from python3-tornado requirement.
    - d/p/Fix-python-tornado-5.patch: workaround that fixes python-tornado
      until v6 becomes available.

diff --git a/debian/changelog b/debian/changelog
index 85c5885..c924a48 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,16 @@
+pcs (0.10.4-2ubuntu1) focal; urgency=medium
+
+   * Changed dependency back to python3-tornado 5.1.1 (LP: #1855568)
+     - debian/control: drop (>= 6) from python3-tornado requirement.
+     - d/p/Fix-python-tornado-5.patch: workaround that fixes python-tornado
+       until v6 becomes available.
+   * Skip autopkgtest for unprivileged containers: (LP: #1828228)
+     - d/t/control: mark tests as skippable
+     - d/t/{setup,snmp,status,testsuite-python}:
+       skip if memlock can't be set to unlimited by root
+
+ -- Rafael David Tinoco <[e-mail]>  Sun, 12 Jan 2020 06:13:16 +0000
+
 pcs (0.10.4-2) unstable; urgency=medium
 
   * d/salsa-ci.yml: enable CI
diff --git a/debian/control b/debian/control
index 4ac8a27..02508e1 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: pcs
 Section: admin
 Priority: optional
-Maintainer: Debian HA Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian HA Maintainers <[e-mail]>
 Uploaders:
  Valentin Vidic <[e-mail]>
 Build-Depends:
@@ -30,7 +31,8 @@ Depends:
  python3-openssl,
  python3-pkg-resources,
  python3-pycurl,
- python3-tornado (>= 6),
+# LP: #1855568 - python3-tornado (>= 6)
+ python3-tornado,
  ruby,
  ruby-backports,
  ruby-ethon,
diff --git a/debian/patches/Fix-python-tornado-5.patch b/debian/patches/Fix-python-tornado-5.patch
new file mode 100644
index 0000000..586bf67
--- /dev/null
+++ b/debian/patches/Fix-python-tornado-5.patch
@@ -0,0 +1,75 @@
+Description: Fix tornado 5 tests
+ Make tests work with tornado 5 until tornado 6 becomes
+ available in Debian.
+
+  [Backport Notes]
+
+  Patch was applied upstream and dropped when python3-tornado 6 became
+  available. After being dropped, python3-tornado was moved back to version 5,
+  because of python2 to python3 migration, and it exists as a fake 6 version:
+  '6.0.3+really5.1.1-2' up to today. In Ubuntu there is not a fake python3-
+  tornado package for version 6, so keeping a working version 5 is needed.
+
+Author: Valentin Vidic <[e-mail]>
+Applied-Upstream: https://salsa.debian.org/ha-team/pcs/commit/86ac09e4e09236d89af55c9a637a4f57afc1f9db
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=939271
+Bug-Ubuntu: http://bugs.launchpad.net/bugs/1855568
+Reviewed-by: Rafael David Tinoco <[e-mail]>
+Last-Update: 2019-12-10
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/pcs_test/tier0/daemon/app/test_app_remote.py
++++ b/pcs_test/tier0/daemon/app/test_app_remote.py
+@@ -1,4 +1,5 @@
+ import logging
++import re
+ from urllib.parse import urlencode
+ from unittest import mock
+ 
+@@ -90,15 +91,17 @@
+             else dict(method=method)
+         )
+ 
++        self.http_client.fetch(
++            self.get_url("/remote/set_sync_options"),
++            self.stop,
++            **kwargs
++        )
++
+         # Without lock the timeout should be enough to finish task. With the
+         # lock it should raise because of timeout. The same timeout is used for
+         # noticing differences between test with and test without lock.  The
+         # timeout is so short to prevent unnecessary slowdown.
+-        fetch_sync_options = lambda: self.http_client.fetch(
+-            self.get_url("/remote/set_sync_options"),
+-            **kwargs
+-        )
+-        return self.io_loop.run_sync(fetch_sync_options, timeout=0.05)
++        return self.wait(timeout=0.05)
+ 
+     def check_call_wrapper_without_lock(self, method):
+         self.assert_wrappers_response(self.fetch_set_sync_options(method))
+@@ -107,21 +110,13 @@
+         self.lock.acquire()
+         try:
+             self.fetch_set_sync_options(method)
+-        except TornadoTimeoutError:
++        except AssertionError as e:
++            self.assertTrue(re.match(".*time.*out.*", str(e)) is not None)
+             # The http_client timeouted because of lock and this is how we test
+             # the locking function. However event loop on the server side should
+             # finish. So we release the lock and the request successfully
+             # finish.
+             self.lock.release()
+-            # Now, there is an unfinished request. It was started by calling
+-            # fetch("/remote/set_sync_options") (in self.fetch_set_sync_options)
+-            # and it was waiting for the lock to be released.
+-            # The lock was released and the request is able to be finished now.
+-            # So, io_loop needs an opportunity to execute the rest of request.
+-            # Next line runs io_loop to finish hanging request. Without this an
+-            # error appears during calling
+-            # `self.http_server.close_all_connections` in tearDown...
+-            self.io_loop.run_sync(lambda: None)
+         else:
+             raise AssertionError("Timeout not raised")
+ 
diff --git a/debian/patches/series b/debian/patches/series
index f0be2e0..0ebd1b3 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -4,3 +4,4 @@ Replace-chkconfig.patch
 Update-snmp-service-file.patch
 Fix-python-testsuite.patch
 Update-pam-config.patch
+Fix-python-tornado-5.patch
diff --git a/debian/tests/control b/debian/tests/control
index 0ca8e23..b75632f 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -1,5 +1,5 @@
 Depends: pcs, pacemaker (>= 2.0), pacemaker-cli-utils (>= 2.0)
-Restrictions: needs-root
+Restrictions: needs-root, skippable
 Tests: status, setup
 
 Depends: pcs, make, ruby-rack-test
@@ -7,9 +7,9 @@ Restrictions: rw-build-tree
 Tests: testsuite-ruby
 
 Depends: pcs, pacemaker (>= 2.0), pacemaker-cli-utils (>= 2.0), fence-agents, booth-pacemaker
-Restrictions: needs-root, rw-build-tree
+Restrictions: needs-root, rw-build-tree, skippable
 Tests: testsuite-python
 
 Depends: pcs-snmp, pacemaker (>= 2.0), pacemaker-cli-utils (>= 2.0), snmp (>= 5.8), snmpd (>= 5.8), snmp-mibs-downloader
-Restrictions: needs-root
+Restrictions: needs-root, skippable
 Tests: snmp
diff --git a/debian/tests/setup b/debian/tests/setup
index 59c1b76..c248722 100755
--- a/debian/tests/setup
+++ b/debian/tests/setup
@@ -2,6 +2,12 @@
 
 set -e
 
+ulimit -H -l unlimited 2>/dev/null || {
+    # https://bugs.launchpad.net/bugs/1828228
+    echo "test disabled for unprivileged namespaces"
+    exit 77
+}
+
 cleanup () {
   service pcsd stop
   service pacemaker stop
diff --git a/debian/tests/snmp b/debian/tests/snmp
index 937731f..2c620bd 100755
--- a/debian/tests/snmp
+++ b/debian/tests/snmp
@@ -2,6 +2,12 @@
 
 set -e
 
+ulimit -H -l unlimited 2>/dev/null || {
+    # https://bugs.launchpad.net/bugs/1828228
+    echo "test disabled for unprivileged namespaces"
+    exit 77
+}
+
 OUTPUT=$AUTOPKGTEST_TMP/walk.out
 
 cleanup () {
diff --git a/debian/tests/status b/debian/tests/status
index 0eb6002..a7e4511 100755
--- a/debian/tests/status
+++ b/debian/tests/status
@@ -2,6 +2,12 @@
 
 set -e
 
+ulimit -H -l unlimited 2>/dev/null || {
+    # https://bugs.launchpad.net/bugs/1828228
+    echo "test disabled for unprivileged namespaces"
+    exit 77
+}
+
 cleanup () {
   service pacemaker stop
   service corosync stop
diff --git a/debian/tests/testsuite-python b/debian/tests/testsuite-python
index 24394a5..582730f 100755
--- a/debian/tests/testsuite-python
+++ b/debian/tests/testsuite-python
@@ -2,6 +2,12 @@
 
 set -e
 
+ulimit -H -l unlimited 2>/dev/null || {
+    # https://bugs.launchpad.net/bugs/1828228
+    echo "test disabled for unprivileged namespaces"
+    exit 77
+}
+
 # Ubuntu uses http proxy breaking some tests
 unset http_proxy
 unset https_proxy