Hi, Quoting Helmut Grohne (2026-06-09 13:59:27) > If you mmdebstrap --keyring=/path/to/somekeyring ... and that keyring > happens to not be readable by your subuid range (e.g. when it is not > world readable) the error message is not very helpful. The permission > problem is not displayed at all. Instead, a missing key is reported:
I can reproduce the problem. There is some code which attempted to warn but
uses the wrong logic:
if (-e $options->{apttrusted} && !-r $options->{apttrusted}) {
warning "cannot read $options->{apttrusted}";
}
The above assumes that the unshared user is able to see whether the file exists
but that can fail if there are insufficient permissions along the path. The new
code now also considers whether the unprivileged _apt user is able to read the
keyring:
foreach my $path ($options->{apttrusted}, $options->{apttrustedparts}) {
if (!-e $path) {
warning("keyring does not exist (or insufficient permissions): "
. $path);
next;
}
if (!-r $path) {
warning("keyring cannot be read: " . $path);
next;
}
my @testcmd = (
'/usr/lib/apt/apt-helper', 'drop-privs', '--', 'test', '-r', $path
);
my $pid = fork() // error "fork() failed: $!";
if ($pid == 0) {
open(STDOUT, '>', '/dev/null')
or error "cannot open /dev/null for writing: $!";
open(STDERR, '>', '/dev/null')
or error "cannot open /dev/null for writing: $!";
exec { $testcmd[0] } @testcmd
or error("cannot exec " . (join " ", @testcmd) . ": $!");
}
waitpid $pid, 0;
if ($? != 0) {
warning "apt is unable to read $path after dropping privileges";
}
}
But, please be careful when using the --keyring argument. apt developers
deprecated the Dir::Etc::Trusted option:
W: http://archive.ubuntu.com/ubuntu/dists/resolute/InRelease: Loading
/home/josch/mmdebstrap/target/usr/share/keyrings/ubuntu-archive-keyring.gpg
from deprecated option Dir::Etc::Trusted
Instead, you should be using the keyring option in your sources.list.
Thanks!
cheers, josch
signature.asc
Description: signature
