Switch to modern 'coverage' environment and run doctests on all versions

Based on #29.

Drop Python 3.3.

Enable coveralls on Travis CI, and also fix using interpreters that
aren't there in the new default 'trusty' image.

Coverage is not at 100% and in fact appears to have dropped (I show
92% in one run, vs the previous reported 97%), but that's because
`coverage` and coveralls report files that aren't even imported (we
have a lot of those in the 'tests' package)...nosetests didn't.

10 files changed, 84 insertions, 64 deletions

diff --git a/.coveragerc b/.coveragerc
new file mode 100644
index 0000000..bb46267
--- /dev/null
+++ b/.coveragerc
@@ -0,0 +1,12 @@
+[run]
+source = zope.security
+
+[report]
+precision = 2
+exclude_lines =
+    pragma: no cover
+    pragma NO COVER
+    if __name__ == '__main__':
+    raise NotImplementedError
+    self.fail
+    raise AssertionError
diff --git a/.gitignore b/.gitignore
index 25c3255..095537c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@ parts
 nosetests.xml
 coverage.xml
 .eggs
+htmlcov/
diff --git a/.travis.yml b/.travis.yml
index c5b8cc2..c38e00c 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,25 +2,25 @@ language: python
 sudo: false
 matrix:
   include:
+    - python: 2.7
+    - python: 3.4
     - python: 3.5
-      env: TOXENV=py35
     - python: 3.6
-      env: TOXENV=py36
-env:
-    - TOXENV=py27
-    - TOXENV=py27-pure
-    - TOXENV=py33
-    - TOXENV=py33-pure
-    - TOXENV=py34
-    - TOXENV=pypy
-    - TOXENV=coverage
-    - TOXENV=docs
+    - python: pypy
+    - python: pypy3
+    - python: 2.7
+      env: PURE_PYTHON=1
+    - python: 3.4
+      env: PURE_PYTHON=1
 install:
-    - pip install -U pip
-    - pip install -U setuptools
-    - pip install -U tox
+    - pip install -U pip setuptools
+    - pip install -U coveralls coverage
+    - pip install -U -e .[test,docs]
 script:
-    - tox
+    - coverage run -m zope.testrunner --test-path=src
+    - coverage run -a -m sphinx -b doctest -d docs/_build/doctrees docs docs/_build/doctest
+after_success:
+    - coveralls
 notifications:
     email: false
 cache: pip
diff --git a/CHANGES.rst b/CHANGES.rst
index 1533b06..c264be8 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -13,6 +13,11 @@ Changes
 - Fix ``__length_hint__`` of proxied iterator objects. Previously it
   was ignored.
 
+- Drop support for Python 3.3.
+
+- Enable coveralls.io for coverage measurement and run doctests on all
+  supported Python versions.
+
 4.1.1 (2017-05-17)
 ------------------
 
diff --git a/README.rst b/README.rst
index b03d0b7..8c04f93 100644
--- a/README.rst
+++ b/README.rst
@@ -12,5 +12,9 @@
         :target: http://zopesecurity.readthedocs.org/en/latest/
         :alt: Documentation Status
 
+.. image:: https://coveralls.io/repos/github/zopefoundation/zope.security/badge.svg?branch=master
+        :target: https://coveralls.io/github/zopefoundation/zope.security?branch=master
+
+
 The Security framework provides a generic mechanism to implement security
 policies on Python objects.
diff --git a/appveyor.yml b/appveyor.yml
index 567e1a5..bfa97eb 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -3,8 +3,6 @@ environment:
   matrix:
     - python : 27
     - python : 27-x64
-    - python : 33
-    - python : 33-x64
     - python : 34
     - python : 34-x64
     - python : 35
diff --git a/docs/api/checker.rst b/docs/api/checker.rst
index 58d3595..f1612d5 100644
--- a/docs/api/checker.rst
+++ b/docs/api/checker.rst
@@ -45,7 +45,7 @@ name and permission:
    >>> cdict = checker.get_permissions
    >>> pprint(cdict)
    {'foo': 'zope.security.metaconfigure.test'}
-   
+
    If we define additional names, they will be added to the dict:
 
    >>> protectModule(test_zcml_functest, 'bar', TEST_PERM)
@@ -54,7 +54,7 @@ name and permission:
    {'bar': 'zope.security.metaconfigure.test',
     'baz': 'zope.security.metaconfigure.test',
     'foo': 'zope.security.metaconfigure.test'}
-        
+
 The allow directive creates actions for each named defined
 directly, or via interface:
 
@@ -543,7 +543,7 @@ we can do everything we expect to be able to do with proxied sets.
 
    >>> str(s) == str(us)
    True
-   
+
    >>> repr(s) == repr(us)
    True
 
@@ -565,7 +565,7 @@ we can do everything we expect to be able to do with proxied sets.
 Note that you can't compare proxied sets with other proxied sets
 due a limitaion in the set comparison functions which won't work
 with any kind of proxy.
-   
+
 .. doctest::
 
    >>> bool(s)
@@ -723,7 +723,7 @@ we can do everything we expect to be able to do with proxied frozensets.
 
    >>> str(s) == str(us)
    True
-   
+
    >>> repr(s) == repr(us)
    True
 
@@ -745,7 +745,7 @@ we can do everything we expect to be able to do with proxied frozensets.
 Note that you can't compare proxied sets with other proxied sets
 due a limitaion in the frozenset comparison functions which won't work
 with any kind of proxy.
-   
+
 .. doctest::
 
    >>> bool(s)
@@ -906,7 +906,11 @@ Classic Classes
    >>> s = repr(C)
    >>> int(C.__module__ == __name__)
    1
-   >>> len(C.__bases__)
+
+Note that these are really only classic on Python 2:
+
+   >>> import sys
+   >>> len(C.__bases__) + (1 if sys.version_info[0] == 2 else 0)
    1
 
 Always available:
@@ -992,8 +996,7 @@ We work with the ABCMeta meta class:
 .. doctest::
 
    >>> import abc
-   >>> class MyABC:
-   ...     __metaclass__ = abc.ABCMeta
+   >>> MyABC = abc.ABCMeta('MyABC', (object,), {})
    >>> class Foo(MyABC): pass
    >>> class Bar(Foo): pass
    >>> PBar = ProxyFactory(Bar)
@@ -1021,4 +1024,4 @@ Always available:
    >>> int(bool(PBar))
    1
    >>> int(PBar.__class__ == type)
-   1
+   0
diff --git a/docs/api/permission.rst b/docs/api/permission.rst
index 819cc90..20ecb3d 100644
--- a/docs/api/permission.rst
+++ b/docs/api/permission.rst
@@ -27,11 +27,11 @@
    Traceback (most recent call last):
    ...
    ValueError: ('Undefined permission id', 'y')
-   
+
 The :data:`zope.security.checker.CheckerPublic` permission always exists:
 
 .. doctest::
-   
+
    >>> from zope.security.checker import CheckerPublic
    >>> checkPermission(None, CheckerPublic)
 
@@ -47,8 +47,9 @@ The :data:`zope.security.checker.CheckerPublic` permission always exists:
 
    >>> ids = list(allPermissions(None))
    >>> ids.sort()
-   >>> ids
-   ['x', 'y']
+   >>> for i in ids: print(i)
+   x
+   y
 
 
 .. autofunction:: zope.security.permission.PermissionsVocabulary
@@ -99,10 +100,10 @@ The non-public permissions 'x' and 'y' are string values:
 
 .. doctest::
 
-   >>> vocab.getTermByToken('x').value
-   'x'
-   >>> vocab.getTermByToken('y').value
-   'y'
+   >>> print(vocab.getTermByToken('x').value)
+   x
+   >>> print(vocab.getTermByToken('y').value)
+   y
 
 However, the public permission value is CheckerPublic:
 
@@ -115,16 +116,18 @@ and its title is shortened:
 
 .. doctest::
 
-   >>> vocab.getTermByToken('zope.Public').title
-   'Public'
+   >>> print(vocab.getTermByToken('zope.Public').title)
+   Public
 
 The terms are sorted by title except for the public permission, which is
 listed first:
 
 .. doctest::
 
-   >>> [term.title for term in vocab]
-   ['Public', 'x', 'y']
+   >>> for t in [term.title for term in vocab]: print(t)
+   Public
+   x
+   y
 
 
 .. testcleanup::
diff --git a/setup.py b/setup.py
index 8bf984c..8368c92 100644
--- a/setup.py
+++ b/setup.py
@@ -102,7 +102,7 @@ else:
                  ),
         Extension("zope.security._zope_security_checker",
                   [os.path.join('src', 'zope', 'security',
-                                        "_zope_security_checker.c")]
+                                "_zope_security_checker.c")]
                  ),
     ]
 
@@ -126,7 +126,6 @@ setup(name='zope.security',
           'Programming Language :: Python :: 2',
           'Programming Language :: Python :: 2.7',
           'Programming Language :: Python :: 3',
-          'Programming Language :: Python :: 3.3',
           'Programming Language :: Python :: 3.4',
           'Programming Language :: Python :: 3.5',
           'Programming Language :: Python :: 3.6',
@@ -140,7 +139,7 @@ setup(name='zope.security',
       url='http://pypi.python.org/pypi/zope.security',
       license='ZPL 2.1',
       packages=find_packages('src'),
-      package_dir = {'': 'src'},
+      package_dir={'': 'src'},
       namespace_packages=['zope'],
       setup_requires=setup_requires,
       ext_modules=ext_modules,
@@ -153,9 +152,9 @@ setup(name='zope.security',
           'zope.proxy >= 4.1.0',
           'zope.schema',
       ],
-      test_suite = '__main__.alltests',
+      test_suite='__main__.alltests',
       tests_require=TESTS_REQUIRE,
-      extras_require = dict(
+      extras_require=dict(
           pytz=["pytz"],
           untrustedpython=['zope.untrustedpython'] if not py3 else [],
           zcml=['zope.configuration'],
@@ -163,6 +162,6 @@ setup(name='zope.security',
           testing=TESTS_REQUIRE + ['nose', 'coverage'],
           docs=['Sphinx', 'repoze.sphinx.autointerface'],
       ),
-      include_package_data = True,
-      zip_safe = False,
-      )
+      include_package_data=True,
+      zip_safe=False,
+)
diff --git a/tox.ini b/tox.ini
index d9c069a..c0e57fb 100644
--- a/tox.ini
+++ b/tox.ini
@@ -3,13 +3,14 @@ envlist =
 # Jython support pending 2.7 support, due 2012-07-15 or so.  See:
 # http://fwierzbicki.blogspot.com/2012/03/adconion-to-fund-jython-27.html
 #   py27,pypy,jython,py33,coverage,docs
-    py27,py27-pure,pypy,py33,py33-pure,py34,py35,py36,coverage,docs
+    py27,py27-pure,pypy,py34-pure,py34,py35,py36,coverage,docs
 
 [testenv]
-deps =
-    .[test]
 commands =
-    zope-testrunner --test-path=src --auto-progress --auto-color []
+    zope-testrunner --test-path=src []
+    sphinx-build -b doctest -d {envdir}/.cache/doctrees docs {envdir}/.cache/doctest
+deps =
+    .[test,docs]
 
 [testenv:py27-pure]
 basepython =
@@ -18,28 +19,24 @@ setenv =
     PURE_PYTHON = 1
     PIP_CACHE_DIR = {envdir}/.cache
 
-[testenv:py33-pure]
+[testenv:py34-pure]
 basepython =
-    python3.3
+    python3.4
 setenv =
     PURE_PYTHON = 1
     PIP_CACHE_DIR = {envdir}/.cache
 
 [testenv:coverage]
+usedevelop = true
 basepython =
     python2.7
 commands =
-#   The installed version messes up nose's test discovery / coverage reporting
-#   So, we uninstall that from the environment, and then install the editable
-#   version, before running nosetests.
-    pip uninstall -y zope.security
-    python -c "import shutil; shutil.copyfile('src/zope/__init__.py', '{envdir}/lib/python2.7/site-packages/zope/__init__.py')"
-    pip install -e .
-    nosetests --with-xunit --with-xcoverage
+    coverage run -m zope.testrunner --test-path=src []
+    coverage run -a -m sphinx -b doctest -d {envdir}/.cache/doctrees docs {envdir}/.cache/doctest
+    coverage report --fail-under=92
 deps =
-    .[testing]
+    {[testenv]deps}
     coverage
-    nosexcover
 
 [testenv:docs]
 basepython =
@@ -47,5 +44,3 @@ basepython =
 commands =
     sphinx-build -b html -d docs/_build/doctrees docs docs/_build/html
     sphinx-build -b doctest -d docs/_build/doctrees docs docs/_build/doctest
-deps =
-    .[docs,test]