Bug#896071: debootstrap fails to retrive Release file over https

[Philipp Kern]

On 5/20/18 12:30 PM, Hideki Yamane wrote:
> On Sun, 20 May 2018 10:14:13 +0200
> Philipp Kern  wrote:
>> So the way it works with your patch is that local variables are
>> inherited by called functions (but not the caller). So from and dest
>> from just_get() are visible in wgetprogress() and hence the construction
>> of $@ works. I'd rather have $dest and $from be explicit parameters to
>> wgetprogress. Given that you reset $@ anyway I don't see how that'd hurt.
> 
>  Hmm, but if I don't put $dest and $from to $@ and other parameters are
>  empty, then it would be extracted as '' and wget will fail.

I'm saying:

wgetprogress () {
[...]
  local from="$1"
  local dest="$2"
[...]
  set -- -O "$dest" "$from"
[...]

And then calling it with 'wgetprogress "$from" "$dest"' rather than
implicitly reusing variables from the call stack.

Kind regards
Philipp Kern

Bug#896071: debootstrap fails to retrive Release file over https

[Hideki Yamane]

On Sun, 20 May 2018 10:14:13 +0200
Philipp Kern  wrote:
> So the way it works with your patch is that local variables are
> inherited by called functions (but not the caller). So from and dest
> from just_get() are visible in wgetprogress() and hence the construction
> of $@ works. I'd rather have $dest and $from be explicit parameters to
> wgetprogress. Given that you reset $@ anyway I don't see how that'd hurt.

 Hmm, but if I don't put $dest and $from to $@ and other parameters are
 empty, then it would be extracted as '' and wget will fail.


-- 
Regards,

 Hideki Yamane henrich @ debian.org/iijmio-mail.jp

Bug#896071: debootstrap fails to retrive Release file over https

[Philipp Kern]

On 5/20/18 1:24 AM, Hideki Yamane wrote:
> On Sat, 19 May 2018 20:18:17 +0200
> Philipp Kern  wrote:
>> You local'ed from and dest and now don't pass it anymore to
>> wgetprogress. How does this work?
>  It is passed to wget via $@

So the way it works with your patch is that local variables are
inherited by called functions (but not the caller). So from and dest
from just_get() are visible in wgetprogress() and hence the construction
of $@ works. I'd rather have $dest and $from be explicit parameters to
wgetprogress. Given that you reset $@ anyway I don't see how that'd hurt.

Kind regards
Philipp Kern

Bug#896071: debootstrap fails to retrive Release file over https

[Hideki Yamane]

On Sat, 19 May 2018 20:18:17 +0200
Philipp Kern  wrote:
> You local'ed from and dest and now don't pass it anymore to
> wgetprogress. How does this work?

 It is passed to wget via $@


-- 
Regards,

 Hideki Yamane henrich @ debian.org/iijmio-mail.jp

Bug#896071: debootstrap fails to retrive Release file over https

[Philipp Kern]

On 19.05.2018 07:14, Hideki Yamane wrote:
> On Mon, 14 May 2018 00:48:53 +0200
> Philipp Kern  wrote:
>> any new about incorporating Raphael's suggestion? There's still a grave
>> bug opened against debootstrap right now (on a version that is in testing).
> 
>  Sorry for late reply, revert previous fix and modified functions as
>  Raphael suggested, and it works on my box. Please check it.
> 
> 
> diff --git a/functions b/functions
> index dc55faf..350f463 100644
> --- a/functions
> +++ b/functions
> @@ -79,6 +79,18 @@ progress_next () {
>  wgetprogress () {
>   [ ! "$VERBOSE" ] && NVSWITCH="-nv"
>   local ret=0
> +
> + set -- -O "$dest" "$from" "$@"
> + if [ -n "$PRIVATEKEY" ]; then
> + set -- "$PRIVATEKEY" "$@"
> + fi
> + if [ -n "$CERTIFICATE" ]; then
> + set -- "$CERTIFICATE" "$@"
> + fi
> + if [ -n "$CHECKCERTIF" ]; then
> + set -- "$CHECKCERTIF" "$@"
> + fi
> +
>   if [ "$USE_DEBIANINSTALLER_INTERACTION" ] && [ "$PROGRESS_NEXT" ]; then
>   wget "$@" 2>&1 >/dev/null | "$PKGDETAILS" "WGET%" 
> "$PROGRESS_NOW" "$PROGRESS_NEXT" "$PROGRESS_END" >&3
>   ret=$?
> @@ -401,20 +413,14 @@ just_get () {
>   # args: from dest
>   local from="$1"
>   local dest="$2"
> +
>   mkdir -p "${dest%/*}"
> +
>   if [ "${from#null:}" != "$from" ]; then
>   error 1 NOTPREDL "%s was not pre-downloaded" "${from#null:}"
> - elif [ "${from#http://}; != "$from" ] || [ "${from#ftp://}; != "$from" 
> ]; then
> - # http/ftp mirror
> - if wgetprogress -O "$dest" "$from"; then
> - return 0
> - else
> - rm -f "$dest"
> - return 1
> - fi
> - elif [ "${from#https://}; != "$from" ] ; then
> - # http/ftp mirror
> - if wgetprogress "$CHECKCERTIF" "$CERTIFICATE" "$PRIVATEKEY" -O 
> "$dest" "$from"; then
> + elif [ "${from#http://}; != "$from" ] || [ "${from#ftp://}; != "$from" 
> ] || [ "${from#https://}; != "$from" ]; then
> + # HTTP(S) mirror (FTP mirror is deprecated but not removed)
> + if wgetprogress ; then
>   return 0
>   else
>   rm -f "$dest"
> 

You local'ed from and dest and now don't pass it anymore to
wgetprogress. How does this work?

Kind regards and thanks
Philipp Kern

Bug#896071: debootstrap fails to retrive Release file over https

[Hideki Yamane]

On Mon, 14 May 2018 00:48:53 +0200
Philipp Kern  wrote:
> any new about incorporating Raphael's suggestion? There's still a grave
> bug opened against debootstrap right now (on a version that is in testing).

 Sorry for late reply, revert previous fix and modified functions as
 Raphael suggested, and it works on my box. Please check it.


diff --git a/functions b/functions
index dc55faf..350f463 100644
--- a/functions
+++ b/functions
@@ -79,6 +79,18 @@ progress_next () {
 wgetprogress () {
[ ! "$VERBOSE" ] && NVSWITCH="-nv"
local ret=0
+
+   set -- -O "$dest" "$from" "$@"
+   if [ -n "$PRIVATEKEY" ]; then
+   set -- "$PRIVATEKEY" "$@"
+   fi
+   if [ -n "$CERTIFICATE" ]; then
+   set -- "$CERTIFICATE" "$@"
+   fi
+   if [ -n "$CHECKCERTIF" ]; then
+   set -- "$CHECKCERTIF" "$@"
+   fi
+
if [ "$USE_DEBIANINSTALLER_INTERACTION" ] && [ "$PROGRESS_NEXT" ]; then
wget "$@" 2>&1 >/dev/null | "$PKGDETAILS" "WGET%" 
"$PROGRESS_NOW" "$PROGRESS_NEXT" "$PROGRESS_END" >&3
ret=$?
@@ -401,20 +413,14 @@ just_get () {
# args: from dest
local from="$1"
local dest="$2"
+
mkdir -p "${dest%/*}"
+
if [ "${from#null:}" != "$from" ]; then
error 1 NOTPREDL "%s was not pre-downloaded" "${from#null:}"
-   elif [ "${from#http://}; != "$from" ] || [ "${from#ftp://}; != "$from" 
]; then
-   # http/ftp mirror
-   if wgetprogress -O "$dest" "$from"; then
-   return 0
-   else
-   rm -f "$dest"
-   return 1
-   fi
-   elif [ "${from#https://}; != "$from" ] ; then
-   # http/ftp mirror
-   if wgetprogress "$CHECKCERTIF" "$CERTIFICATE" "$PRIVATEKEY" -O 
"$dest" "$from"; then
+   elif [ "${from#http://}; != "$from" ] || [ "${from#ftp://}; != "$from" 
] || [ "${from#https://}; != "$from" ]; then
+   # HTTP(S) mirror (FTP mirror is deprecated but not removed)
+   if wgetprogress ; then
return 0
else
rm -f "$dest"

Bug#896071: debootstrap fails to retrive Release file over https

[Philipp Kern]

Hideki,

On 4/24/18 3:29 PM, Raphael Hertzog wrote:
> On Mon, 23 Apr 2018, Hideki Yamane wrote:
>> On Sun, 22 Apr 2018 09:40:54 +1000
>> David Margerison  wrote:
  "$@" is extracted as '' and wget tries to fetch it and fails,
  then returns 1.
>>>
>>> Regarding the proposed fix, in general using $@ without quotes is fragile.
>>
>>  Most of the case, quotes is better. But in this case, "$@" is extracted like
 wget '' '' '' https://deb.debian.org/debian/dist/unstable/InRelease
>>  Then, it outputs
http://: Invalid host name.
http://: Invalid host name.
http://: Invalid host name.
>>  and returns 1.
> 
> I agree with David that using $@ without quotes is not a good idea.
> What you want is to not pass empty arguments to wgetprogress. So you should
> likely drop the quotes around the first 3 parameters on this line:
> if wgetprogress "$CHECKCERTIF" "$CERTIFICATE" "$PRIVATEKEY" 
> -O "$dest" "$from"; then
> 
> I'm suggesting only the first 3 since those are the variables that can be
> empty. And we want to keep the quote on "$dest" to be able to use path
> containing spaces (which you likely lost with your fix).
> 
> But even here it's not perfect since we loose the possibility to handle
> arguments containing spaces in the first 3 parameters. A complete fix would
> involve setting up the argument list manually:
> 
> set -- -O "$dest" "$from"
> if [ -n "$PRIVATEKEY" ]; then
> set -- "$PRIVATEKEY" "$@"
> fi
> if [ -n "$CERTIFICATE" ]; then
> set -- "$CERTIFICATE" "$@"
> fi
> if [ -n "$CHECKCERTIF" ]; then
> set -- "$CHECKCERTIF" "$@"
> fi
> if wgetprogress "$@"; then
> [...]
> 
> Here we should be safe even if those 3 variables do contain spaces.

any new about incorporating Raphael's suggestion? There's still a grave
bug opened against debootstrap right now (on a version that is in testing).

Kind regards and thanks
Philipp Kern

Bug#896071: debootstrap fails to retrive Release file over https

[Raphael Hertzog]

On Mon, 23 Apr 2018, Hideki Yamane wrote:
> Hi,
> 
> On Sun, 22 Apr 2018 09:40:54 +1000
> David Margerison  wrote:
> > >  "$@" is extracted as '' and wget tries to fetch it and fails,
> > >  then returns 1.
> > 
> > Regarding the proposed fix, in general using $@ without quotes is fragile.
> 
>  Most of the case, quotes is better. But in this case, "$@" is extracted like
> >> wget '' '' '' https://deb.debian.org/debian/dist/unstable/InRelease
>  Then, it outputs
> >>http://: Invalid host name.
> >>http://: Invalid host name.
> >>http://: Invalid host name.
>  and returns 1.

I agree with David that using $@ without quotes is not a good idea.
What you want is to not pass empty arguments to wgetprogress. So you should
likely drop the quotes around the first 3 parameters on this line:
if wgetprogress "$CHECKCERTIF" "$CERTIFICATE" "$PRIVATEKEY" -O 
"$dest" "$from"; then

I'm suggesting only the first 3 since those are the variables that can be
empty. And we want to keep the quote on "$dest" to be able to use path
containing spaces (which you likely lost with your fix).

But even here it's not perfect since we loose the possibility to handle
arguments containing spaces in the first 3 parameters. A complete fix would
involve setting up the argument list manually:

set -- -O "$dest" "$from"
if [ -n "$PRIVATEKEY" ]; then
set -- "$PRIVATEKEY" "$@"
fi
if [ -n "$CERTIFICATE" ]; then
set -- "$CERTIFICATE" "$@"
fi
if [ -n "$CHECKCERTIF" ]; then
set -- "$CHECKCERTIF" "$@"
fi
if wgetprogress "$@"; then
[...]

Here we should be safe even if those 3 variables do contain spaces.

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: https://www.freexian.com/services/debian-lts.html
Learn to master Debian: https://debian-handbook.info/get/

Bug#896071: debootstrap fails to retrive Release file over https

[Hideki Yamane]

On Tue, 24 Apr 2018 14:07:30 +0200
Raphael Hertzog  wrote:
> Honestly, I'd prefer not to diverge from Debian and use plain http as well
> so that we limit the risk of regression related to https support.
> 
> In particular since our main http.kali.org host redirects to many other
> mirrors whose certificates are not under our control. We are not monitoring
> that all the certificates are valid.

 I understand it, then remain unchanged.

-- 
Regards,

 Hideki Yamane henrich @ debian.org/iijmio-mail.jp

Bug#896071: debootstrap fails to retrive Release file over https

[Raphael Hertzog]

Hi,

On Tue, 24 Apr 2018, Hideki Yamane wrote:
>  I'll revert below your commit since this regression fix also solve it.
> 
> > commit c1c20ed48e83fe9d4f3512c524f7734d4e1469ac
> > Author: Raphaël Hertzog 
> > Date:   Thu Apr 12 12:18:29 2018 +0200
> > 
> > Do not use HTTPS for Kali bootstrap script
> 
>  Please let me know if you don't want it.

Honestly, I'd prefer not to diverge from Debian and use plain http as well
so that we limit the risk of regression related to https support.

In particular since our main http.kali.org host redirects to many other
mirrors whose certificates are not under our control. We are not monitoring
that all the certificates are valid.

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: https://www.freexian.com/services/debian-lts.html
Learn to master Debian: https://debian-handbook.info/get/

Bug#896071: debootstrap fails to retrive Release file over https

[Hideki Yamane]

Hi,

 I'll revert below your commit since this regression fix also solve it.

> commit c1c20ed48e83fe9d4f3512c524f7734d4e1469ac
> Author: Raphaël Hertzog 
> Date:   Thu Apr 12 12:18:29 2018 +0200
> 
> Do not use HTTPS for Kali bootstrap script


 Please let me know if you don't want it.


On Sat, 21 Apr 2018 20:32:59 +0900
Hideki Yamane  wrote:
> > there was a change in behaviour with the latest upload:
> 
>  Thanks for the report, and here's a proposal fix.
>  "$@" is extracted as '' and wget tries to fetch it and fails, 
>  then returns 1.
> 
> 
> diff --git a/functions b/functions
> index 1e41862..bad37dc 100644
> --- a/functions
> +++ b/functions
> @@ -80,10 +80,10 @@ wgetprogress () {
> [ ! "$VERBOSE" ] && NVSWITCH="-nv"
> local ret=0
> if [ "$USE_DEBIANINSTALLER_INTERACTION" ] && [ "$PROGRESS_NEXT" ]; 
> then
> -   wget "$@" 2>&1 >/dev/null | "$PKGDETAILS" "WGET%" 
> "$PROGRESS_NOW" "$PROGRESS_NEXT" "$PROGRESS_END" >&3
> +   wget $@ 2>&1 >/dev/null | "$PKGDETAILS" "WGET%" 
> "$PROGRESS_NOW" "$PROGRESS_NEXT" "$PROGRESS_END" >&3
> ret=$?
> else
> -   wget $NVSWITCH "$@"
> +   wget $NVSWITCH $@
> ret=$?
> fi
> return $ret


-- 
Regards,

 Hideki Yamane henrich @ debian.org/iijmio-mail.jp

Bug#896071: debootstrap fails to retrive Release file over https

[Hideki Yamane]

On Tue, 24 Apr 2018 00:52:10 +1000
David Margerison  wrote:
> needs to be changed to something like this
>wgetprogress $a $b $c "$url"

 Unfortunately, changed to it like above but caused same error.

diff --git a/functions b/functions
index 1e41862..d54b07f 100644
--- a/functions
+++ b/functions
@@ -398,7 +398,7 @@ just_get () {
fi
elif [ "${from#https://}; != "$from" ] ; then
# http/ftp mirror
-   if wgetprogress "$CHECKCERTIF" "$CERTIFICATE" "$PRIVATEKEY" -O 
"$dest" "$from"; then
+   if wgetprogress $CHECKCERTIF $CERTIFICATE $PRIVATEKEY -O 
"$dest" "$from"; then
return 0
else
rm -f "$dest"


-- 
Regards,

 Hideki Yamane henrich @ debian.org/iijmio-mail.jp

Bug#896071: debootstrap fails to retrive Release file over https

[Hideki Yamane]

Hi,

On Sun, 22 Apr 2018 09:40:54 +1000
David Margerison  wrote:
> >  "$@" is extracted as '' and wget tries to fetch it and fails,
> >  then returns 1.
> 
> Regarding the proposed fix, in general using $@ without quotes is fragile.

 Most of the case, quotes is better. But in this case, "$@" is extracted like
>> wget '' '' '' https://deb.debian.org/debian/dist/unstable/InRelease
 Then, it outputs
>>http://: Invalid host name.
>>http://: Invalid host name.
>>http://: Invalid host name.
 and returns 1.


-- 
Hideki Yamane 

Bug#896071: debootstrap fails to retrive Release file over https

[David Margerison]

On 21 April 2018 at 21:32, Hideki Yamane  wrote:
>
>  Thanks for the report, and here's a proposal fix.
>
> [ ! "$VERBOSE" ] && NVSWITCH="-nv"
> local ret=0
> if [ "$USE_DEBIANINSTALLER_INTERACTION" ] && [ "$PROGRESS_NEXT" ]; 
> then
> -   wget "$@" 2>&1 >/dev/null | "$PKGDETAILS" "WGET%" 
> "$PROGRESS_NOW" "$PROGRESS_NEXT" "$PROGRESS_END" >&3
> +   wget $@ 2>&1 >/dev/null | "$PKGDETAILS" "WGET%" 
> "$PROGRESS_NOW" "$PROGRESS_NEXT" "$PROGRESS_END" >&3
> ret=$?
> else
> -   wget $NVSWITCH "$@"
> +   wget $NVSWITCH $@
> ret=$?
> fi
> return $ret

Hi, I have not looked into the actual problem, and I have not run the code,
I have only looked at the patch above, but I offer some patch review comments
in the hope you will find them useful.

The "ret" variable in that function is entirely pointless. The
exitstatus of an if statment
is the exitstatus of the last command executed in the body of the if
statement. And
a bare return command will return the exitstatus of the previous
command executed.

So the below code will behave identically to the unpatched function:

wgetprogress () {
[ ! "$VERBOSE" ] && NVSWITCH="-nv"
if [ "$USE_DEBIANINSTALLER_INTERACTION" ] && [ "$PROGRESS_NEXT" ]; then
wget "$@" 2>&1 >/dev/null | "$PKGDETAILS" "WGET%" "$PROGRESS_NOW"
"$PROGRESS_NEXT" "$PROGRESS_END" >&3
else
wget $NVSWITCH "$@"
fi
}

>  "$@" is extracted as '' and wget tries to fetch it and fails,
>  then returns 1.

Regarding the proposed fix, in general using $@ without quotes is fragile.

And I don't understand how changing "$@" to $@ will change the behaviour
of wget. Testing here, both
wget
and
wget ''
return exitstatus 1.

To test if the function was given any positional parameters, instead use

if [ $# -eq 0 ] ; then
echo "There are no parameters"
fi

To test if $@ is empty, use

if [ -z "$*" ] ; then
   echo "All parameters are empty"
fi

But wouldn't it be better to fix the actual problem? If somewhere this
function is called without parameters, then that is where the problem
occurs and so is likely the best place to fix it.

Bug#896071: debootstrap fails to retrive Release file over https

[Hideki Yamane]

control: tags -1 +confirmed
control: tags -1 +patch

On Thu, 19 Apr 2018 09:56:30 +0200
Alf Gaida  wrote:
> there was a change in behaviour with the latest upload:

 Thanks for the report, and here's a proposal fix.
 "$@" is extracted as '' and wget tries to fetch it and fails, 
 then returns 1.


diff --git a/functions b/functions
index 1e41862..bad37dc 100644
--- a/functions
+++ b/functions
@@ -80,10 +80,10 @@ wgetprogress () {
[ ! "$VERBOSE" ] && NVSWITCH="-nv"
local ret=0
if [ "$USE_DEBIANINSTALLER_INTERACTION" ] && [ "$PROGRESS_NEXT" ]; then
-   wget "$@" 2>&1 >/dev/null | "$PKGDETAILS" "WGET%" 
"$PROGRESS_NOW" "$PROGRESS_NEXT" "$PROGRESS_END" >&3
+   wget $@ 2>&1 >/dev/null | "$PKGDETAILS" "WGET%" "$PROGRESS_NOW" 
"$PROGRESS_NEXT" "$PROGRESS_END" >&3
ret=$?
else
-   wget $NVSWITCH "$@"
+   wget $NVSWITCH $@
ret=$?
fi
return $ret

Processed: Re: Bug#896071: debootstrap fails to retrive Release file over https

[Debian Bug Tracking System]

Processing control commands:

> tags -1 +confirmed
Bug #896071 [debootstrap] debootstrap fails to retrive Release file over https
Added tag(s) confirmed.
> tags -1 +patch
Bug #896071 [debootstrap] debootstrap fails to retrive Release file over https
Added tag(s) patch.

-- 
896071: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=896071
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#896071: debootstrap fails to retrive Release file over https

[Cyril Brulebois]

Hi,

Ben Hutchings  (2018-04-19):
> On Thu, 2018-04-19 at 09:56 +0200, Alf Gaida wrote:
> > Package: debootstrap
> > Version: 1.0.97
> > Severity: grave
> > 
> > Dear Maintainer,
> > 
> > there was a change in behaviour with the latest upload:
> > 
> > 1 agaida@newdev ~ % sudo debootstrap --arch=amd64  --no-check-gpg 
> > --include=apt-utils,bzip2,gnupg2,dirmngr,xz-utils,perl --variant=minbase 
> > sid ./fuck https://debian.siduction.org:(
> > I: Target architecture can be executed
> > I: Retrieving InRelease
> > I: Retrieving Release
> > E: Failed getting release file 
> > https://debian.siduction.org/dists/sid/Release
> [...]
> 
> I had a similar failure, which was actually the fault of wget (bug
> #895872).  Check whether the kernel log shows a segfault in wget.

This is the end of an strace of debootstrap, focused on the wget part,
in a sid chroot on a stretch host:
| 28357 write(6, "# HSTS 1.0 Known Hosts database for GNU Wget.\n# Edit at your 
own risk.\n# \t\t\t\t\ndebian.siduction.org\t0\t1\t1524251390\t31072000\n",
 175) = 175
| 28357 close(6)  = 0
| 28357 close(3)  = 0
| 28357 exit_group(1) = ?
| 28357 +++ exited with 1 +++
| 28289 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 1}], 0, NULL) = 
28357

No segfaults in kernel logs though.


Cheers,
-- 
Cyril Brulebois (k...@debian.org)
D-I release manager -- Release team member -- Freelance Consultant


signature.asc
Description: PGP signature

Bug#896071: debootstrap fails to retrive Release file over https

[Alf Gaida]

No, sorry, no journal entries, no coredumps - nothing



signature.asc
Description: OpenPGP digital signature

Bug#896071: debootstrap fails to retrive Release file over https

[Ben Hutchings]

On Thu, 2018-04-19 at 09:56 +0200, Alf Gaida wrote:
> Package: debootstrap
> Version: 1.0.97
> Severity: grave
> 
> Dear Maintainer,
> 
> there was a change in behaviour with the latest upload:
> 
> 1 agaida@newdev ~ % sudo debootstrap --arch=amd64  --no-check-gpg 
> --include=apt-utils,bzip2,gnupg2,dirmngr,xz-utils,perl --variant=minbase sid 
> ./fuck https://debian.siduction.org:(
> I: Target architecture can be executed
> I: Retrieving InRelease
> I: Retrieving Release
> E: Failed getting release file https://debian.siduction.org/dists/sid/Release
[...]

I had a similar failure, which was actually the fault of wget (bug
#895872).  Check whether the kernel log shows a segfault in wget.

Ben.

-- 
Ben Hutchings
It's easier to fight for one's principles than to live up to them.


signature.asc
Description: This is a digitally signed message part

Bug#896071: debootstrap fails to retrive Release file over https

[Alf Gaida]

Package: debootstrap
Version: 1.0.97
Severity: grave

Dear Maintainer,

there was a change in behaviour with the latest upload:

1 agaida@newdev ~ % sudo debootstrap --arch=amd64  --no-check-gpg 
--include=apt-utils,bzip2,gnupg2,dirmngr,xz-utils,perl --variant=minbase sid 
./fuck https://debian.siduction.org:(
I: Target architecture can be executed
I: Retrieving InRelease
I: Retrieving Release
E: Failed getting release file https://debian.siduction.org/dists/sid/Release
1 agaida@newdev ~ % sudo debootstrap --arch=amd64  --no-check-gpg 
--include=apt-utils,bzip2,gnupg2,dirmngr,xz-utils,perl --variant=minbase sid 
./fuck http://debian.siduction.org :(
I: Target architecture can be executed
I: Retrieving InRelease
I: Validating Packages
I: Found packages in base already in required: apt
I: Resolving dependencies of required packages...
I: Resolving dependencies of base packages...
I: Found additional required dependencies:  adduser debian-archive-keyring 
fdisk gcc-8-base gpgv libacl1 libapt-pkg5.0 libattr1 libaudit1 libaudit-common 
libblkid1 libbz2-1.0 libc6 libcap-ng0 libcom-err2 libdb5.3 libdebconfclient0 
libext2fs2 libfdisk1 libffi6 libgcc1 libgcrypt20 libgmp10 libgnutls30 
libgpg-error0 libhogweed4 libidn2-0 liblz4-1 liblzma5 libmount1 libncursesw5 
libnettle6 libp11-kit0 libpam0g libpcre3 libseccomp2 libselinux1 libsemanage1 
libsemanage-common libsepol1 libsmartcols1 libss2 libstdc++6 libsystemd0 
libtasn1-6 libtinfo5 libudev1 libunistring2 libuuid1 libzstd1 zlib1g
I: Found additional base dependencies: gnupg gnupg-l10n gnupg-utils gpg 
gpg-agent gpgconf gpgsm gpg-wks-client gpg-wks-server libapt-inst2.0 libassuan0 
libgdbm5 libgdbm-compat4 libksba8 libldap-2.4-2 libldap-common libnpth0 
libperl5.26 libreadline7 libsasl2-2 libsasl2-modules-db libsqlite3-0 lsb-base 
perl-modules-5.26 pinentry-curses readline-common
I: Checking component main on http://debian.siduction.org...
^CE: Interrupt caught ... exiting
sudo debootstrap --arch=amd64 --no-check-gpg  --variant=minbase sid ./fuck   
17,81s user 0,47s system 97% cpu 18,774 total


works fine with 1.0.96

Cheers Alf

-- System Information:
Debian Release: buster/sid
  APT prefers unstable
  APT policy: (990, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 
'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.15.0-2-amd64 (SMP w/8 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), 
LANGUAGE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages debootstrap depends on:
ii  wget  1.19.4-1

Versions of packages debootstrap recommends:
ii  arch-test   0.11-1
ii  debian-archive-keyring  2017.7
ii  gnupg   2.2.5-1

Versions of packages debootstrap suggests:
pn  squid-deb-proxy-client  
pn  ubuntu-archive-keyring  

-- no debconf information