[gsutil] run through "vpython" (2)

Run "gsutil" through "vpython". This ensures that the package set
accompanying it is completely controlled. This is notably important on
GCE instances, which "gsutil" expects to supply a
"google_compute_engine" package.

BUG=chromium:741001
TEST=local
  - Ran `gsutil cp` on 64-bit Linux machine, seems to work.
  - Ran `gsutil cp` on GCE instance, seems to work.

This is a reland of 23836a643f.

Change-Id: If87261abd505ef77f95b3c70b6bd23f3e798b41d
Reviewed-on: https://chromium-review.googlesource.com/656565
Reviewed-by: Nodir Turakulov <nodir@chromium.org>
Reviewed-by: Robbie Iannucci <iannucci@chromium.org>
Commit-Queue: Daniel Jacques <dnj@chromium.org>

gsutil.py

@@ -29,6 +29,9 @@ DEFAULT_BIN_DIR = os.path.join(THIS_DIR, 'external_bin', 'gsutil')
 DEFAULT_FALLBACK_GSUTIL = os.path.join(
     THIS_DIR, 'third_party', 'gsutil', 'gsutil')
 
+IS_WINDOWS = os.name == 'nt'
+
+
 class InvalidGsutilError(Exception):
   pass
 
@@ -126,8 +129,17 @@ def run_gsutil(force_version, fallback, target, args, clean=False):
   else:
     gsutil_bin = fallback
   disable_update = ['-o', 'GSUtil:software_update_check_period=0']
-  cmd = [sys.executable, gsutil_bin] + disable_update + args
-  return subprocess.call(cmd)
+
+  # Run "gsutil" through "vpython". We need to do this because on GCE instances,
+  # expectations are made about Python having access to "google-compute-engine"
+  # and "boto" packages that are not met with non-system Python (e.g., bundles).
+  cmd = [
+      'vpython',
+      '-vpython-spec', os.path.join(THIS_DIR, 'gsutil.vpython'),
+      '--',
+      gsutil_bin
+  ] + disable_update + args
+  return subprocess.call(cmd, shell=IS_WINDOWS)
 
 
 def parse_args():

gsutil.vpython

@@ -0,0 +1,102 @@
+# vpython VirtualEnv protobuf for "gsutil".
+#
+# See:
+# https://chromium.googlesource.com/infra/luci/luci-go/+/master/vpython/api/vpython/spec.proto
+#
+# This is a "vpython" VirtualEnv specification applied to invocations of "gsutil"
+# by the bootstrap wrapper, "gsutil.py". It ensures that any Python distribution
+# has the expected Python packages installed.
+#
+# This is specifically relevant on Google Compute Engine invocations of
+# "gsutil", where a stock system-deployed file in "/etc/" explicitly specifies
+# that the "google_compute_engine" and "boto" Python packages are available.
+
+wheel <
+  name: "infra/python/wheels/google_compute_engine-py2_py3"
+  version: "version:2.3.7"
+>
+wheel <
+  name: "infra/python/wheels/boto-py2_py3"
+  version: "version:2.47.0"
+>
+
+# "gsutil" on non-GCE can require PyOpenSSL, which, in turn, requires
+# "cryptography".
+
+wheel: <
+  name: "infra/python/wheels/pyopenssl-py2_py3"
+  version: "version:17.2.0"
+>
+
+##
+# BEGIN "cryptography" dependencies.
+##
+
+wheel: <
+  name: "infra/python/wheels/cryptography/${platform}_${py_python}_${py_abi}"
+  version: "version:2.0.3"
+>
+
+wheel: <
+  name: "infra/python/wheels/appdirs-py2_py3"
+  version: "version:1.4.3"
+>
+
+wheel: <
+  name: "infra/python/wheels/asn1crypto-py2_py3"
+  version: "version:0.22.0"
+>
+
+wheel: <
+  name: "infra/python/wheels/enum34-py2"
+  version: "version:1.1.6"
+>
+
+wheel: <
+  name: "infra/python/wheels/cffi/${platform}_${py_python}_${py_abi}"
+  version: "version:1.10.0"
+>
+
+wheel: <
+  name: "infra/python/wheels/idna-py2_py3"
+  version: "version:2.5"
+>
+
+wheel: <
+  name: "infra/python/wheels/ipaddress-py2"
+  version: "version:1.0.18"
+>
+
+wheel: <
+  name: "infra/python/wheels/packaging-py2_py3"
+  version: "version:16.8"
+>
+
+wheel: <
+  name: "infra/python/wheels/pyasn1-py2_py3"
+  version: "version:0.2.3"
+>
+
+wheel: <
+  name: "infra/python/wheels/pycparser-py2_py3"
+  version: "version:2.17"
+>
+
+wheel: <
+  name: "infra/python/wheels/pyparsing-py2_py3"
+  version: "version:2.2.0"
+>
+
+wheel: <
+  name: "infra/python/wheels/setuptools-py2_py3"
+  version: "version:34.3.2"
+>
+
+wheel: <
+  name: "infra/python/wheels/six-py2_py3"
+  version: "version:1.10.0"
+>
+
+##
+# END "cryptography" dependencies.
+##