17296: Merge branch 'master'

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>

diff --combined lib/config/config.default.yml
index e24084ca07382bbab44fbdba0b19f4f1ef9e7208,655e973c2f29e612479a620daef016fab17106a9..e2ef9899e578d8f50d3ca720b334d046c53f5cf9
--- 1/lib/config/config.default.yml
--- 2/lib/config/config.default.yml
+++ b/lib/config/config.default.yml
@@@ -771,8 -771,15 +771,15 @@@ Clusters
        # Default value zero means tokens don't have expiration.
        TokenLifetime: 0s
  
+       # If true (default) tokens issued through login are allowed to create
+       # new tokens.
+       # If false, tokens issued through login are not allowed to
+       # viewing/creating other tokens.  New tokens can only be created
+       # by going through login again.
+       IssueTrustedTokens: true
+ 
        # When the token is returned to a client, the token itself may
-       # be restricted from manipulating other tokens based on whether
+       # be restricted from viewing/creating other tokens based on whether
        # the client is "trusted" or not.  The local Workbench1 and
        # Workbench2 are trusted by default, but if this is a
        # LoginCluster, you probably want to include the other Workbench
@@@ -879,9 -886,6 +886,9 @@@
        # Minimum time between two attempts to run the same container
        MinRetryPeriod: 0s
  
 +      # Container runtime: "docker" (default) or "singularity" (experimental)
 +      RuntimeEngine: docker
 +
        Logging:
          # When you run the db:delete_old_container_logs task, it will find
          # containers that have been finished for at least this many seconds,

diff --combined lib/config/export.go
index bd88c5d013af8df2546116e65a013d397ced4e6c,d1c71ed2dc935fa6ff55efa0e891525b0a0a42b9..23d0b6bffe5346426632e6ebccf0ee7b5db8a967
--- 1/lib/config/export.go
--- 2/lib/config/export.go
+++ b/lib/config/export.go
@@@ -122,7 -122,6 +122,7 @@@ var whitelist = map[string]bool
        "Containers.MaxRetryAttempts":                         true,
        "Containers.MinRetryPeriod":                           true,
        "Containers.ReserveExtraRAM":                          true,
 +      "Containers.RuntimeEngine":                            true,
        "Containers.ShellAccess":                              true,
        "Containers.ShellAccess.Admin":                        true,
        "Containers.ShellAccess.User":                         true,
@@@ -181,6 -180,7 +181,7 @@@
        "Login.Test.Enable":                                   true,
        "Login.Test.Users":                                    false,
        "Login.TokenLifetime":                                 false,
+       "Login.IssueTrustedTokens":                            false,
        "Login.TrustedClients":                                false,
        "Mail":                                                true,
        "Mail.EmailFrom":                                      false,

diff --combined lib/config/generated_config.go
index 9f4bf011b8dbf02cf19ec4c61cc919072baf1d08,0ae85461b089a206de7e62aa6237021edff3fc34..fbee937b39251ff41b72d89325fffee8ff44e7bb
--- 1/lib/config/generated_config.go
--- 2/lib/config/generated_config.go
+++ b/lib/config/generated_config.go
@@@ -777,8 -777,15 +777,15 @@@ Clusters
        # Default value zero means tokens don't have expiration.
        TokenLifetime: 0s
  
+       # If true (default) tokens issued through login are allowed to create
+       # new tokens.
+       # If false, tokens issued through login are not allowed to
+       # viewing/creating other tokens.  New tokens can only be created
+       # by going through login again.
+       IssueTrustedTokens: true
+ 
        # When the token is returned to a client, the token itself may
-       # be restricted from manipulating other tokens based on whether
+       # be restricted from viewing/creating other tokens based on whether
        # the client is "trusted" or not.  The local Workbench1 and
        # Workbench2 are trusted by default, but if this is a
        # LoginCluster, you probably want to include the other Workbench
@@@ -885,9 -892,6 +892,9 @@@
        # Minimum time between two attempts to run the same container
        MinRetryPeriod: 0s
  
 +      # Container runtime: "docker" (default) or "singularity" (experimental)
 +      RuntimeEngine: docker
 +
        Logging:
          # When you run the db:delete_old_container_logs task, it will find
          # containers that have been finished for at least this many seconds,

diff --combined lib/install/deps.go
index 255e56aaf527592db01a45d41c206469885e0eae,8277fd2f2890549ce91c5aa30d08268eda725992..68cf2c6967620a21e6d0b1be2ac16c1bbdf9674d
--- 1/lib/install/deps.go
--- 2/lib/install/deps.go
+++ b/lib/install/deps.go
@@@ -181,11 -181,6 +181,11 @@@ func (inst *installCommand) RunCommand(
                        "wget",
                        "xvfb",
                )
 +              if dev || test {
 +                      pkgs = append(pkgs,
 +                              "squashfs-tools", // for singularity
 +                      )
 +              }
                switch {
                case osv.Debian && osv.Major >= 10:
                        pkgs = append(pkgs, "libcurl4")
@@@ -250,6 -245,7 +250,7 @@@ make instal
                } else {
                        err = inst.runBash(`
  cd /tmp
+ rm -rf /var/lib/arvados/go/
  wget --progress=dot:giga -O- https://storage.googleapis.com/golang/go`+goversion+`.linux-amd64.tar.gz | tar -C /var/lib/arvados -xzf -
  ln -sf /var/lib/arvados/go/bin/* /usr/local/bin/
  `, stdout, stderr)
@@@ -320,28 -316,6 +321,28 @@@ rm ${zip
                        }
                }
  
 +              singularityversion := "3.5.2"
 +              if havesingularityversion, err := exec.Command("/var/lib/arvados/bin/singularity", "--version").CombinedOutput(); err == nil && strings.Contains(string(havesingularityversion), singularityversion) {
 +                      logger.Print("singularity " + singularityversion + " already installed")
 +              } else if dev || test {
 +                      err = inst.runBash(`
 +S=`+singularityversion+`
 +tmp=/var/lib/arvados/tmp/singularity
 +trap "rm -r ${tmp}" ERR EXIT
 +cd /var/lib/arvados/tmp
 +git clone https://github.com/sylabs/singularity
 +cd singularity
 +git checkout v${S}
 +./mconfig --prefix=/var/lib/arvados
 +make -C ./builddir
 +make -C ./builddir install
 +rm -r ${tmp}
 +`, stdout, stderr)
 +                      if err != nil {
 +                              return 1
 +                      }
 +              }
 +
                // The entry in /etc/locale.gen is "en_US.UTF-8"; once
                // it's installed, locale -a reports it as
                // "en_US.utf8".

diff --combined sdk/go/arvados/config.go
index b1ee6e9b992f4446ec1f0f826c22e9bdb244704b,8149b93965553304172353d0bf971ee3164cbf0e..403d501b4153af489e207fbfe4ba53e194655f78
--- 1/sdk/go/arvados/config.go
--- 2/sdk/go/arvados/config.go
+++ b/sdk/go/arvados/config.go
@@@ -189,6 -189,7 +189,7 @@@ type Cluster struct 
                RemoteTokenRefresh Duration
                TokenLifetime      Duration
                TrustedClients     map[string]struct{}
+               IssueTrustedTokens bool
        }
        Mail struct {
                MailchimpAPIKey                string
@@@ -416,7 -417,6 +417,7 @@@ type ContainersConfig struct 
        StaleLockTimeout            Duration
        SupportedDockerImageFormats StringSet
        UsePreemptibleInstances     bool
 +      RuntimeEngine               string
  
        JobsAPI struct {
                Enable         string