Dear Maintainer,

I'm executing piuparts through sbuild. I setup sbuild as instructed in
the wiki https://wiki.debian.org/sbuild.

My configuration of sbuild related to piuparts is the following:

$run_piuparts = 1;
$piuparts_opts = ['--distribution=%r', '--bootstrapcmd=mmdebstrap
--skip=check/empty --variant=minbase --aptopt="Acquire::http { Proxy 
\"http://192.168.3.55:3142\"; }"'];

I noticed that if the /etc/apt/sources.list of the host is the
following:

deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg]
http://ftp.fr.debian.org/debian/ unstable main non-free-firmware
deb-src [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg]
http://ftp.fr.debian.org/debian/ unstable main non-free-firmware

I get an error during the execution of piuparts:

% sbuild hello
[...]
0m0.0s DEBUG: Setting up minimal chroot for unstable at /tmp/tmp0rgv7d44.
0m0.0s DEBUG: Starting command: ['mmdebstrap', '--skip=check/empty',
'--variant=minbase', '--aptopt=Acquire::http { Proxy
"http://192.168.3.55:3142"; }',
'--keyring=/usr/share/keyrings/debian-archive-keyring.gpg',
'--include=eatmydata', '--merged-usr',
'--components=unstable,main,non-free-firmware', 'unstable',
'/tmp/tmp0rgv7d44',
'[signed-by=/usr/share/keyrings/debian-archive-keyring.gpg]']
0m0.3s DUMP:
   I: the option --merged-usr is a no-op. It only exists for
compatibility with some debootstrap wrappers.
   I: automatically chosen mode: root
   I: chroot architecture amd64 is equal to the host's architecture
   I: finding correct signed-by value...
   E: invalid mirror:
[signed-by=/usr/share/keyrings/debian-archive-keyring.gpg]
0m0.3s ERROR: Command failed (status=25): ['mmdebstrap',
'--skip=check/empty', '--variant=minbase', '--aptopt=Acquire::http {
Proxy "http://192.168.3.55:3142"; }',
'--keyring=/usr/share/keyrings/debian-archive-keyring.gpg',
'--include=eatmydata', '--merged-usr',
'--components=unstable,main,non-free-firmware', 'unstable',
'/tmp/tmp0rgv7d44',
'[signed-by=/usr/share/keyrings/debian-archive-keyring.gpg]']
   I: the option --merged-usr is a no-op. It only exists for
compatibility with some debootstrap wrappers.
   I: automatically chosen mode: root
   I: chroot architecture amd64 is equal to the host's architecture
   I: finding correct signed-by value...
   E: invalid mirror:
[signed-by=/usr/share/keyrings/debian-archive-keyring.gpg]


However, if I remove the [signed-by=] from the sources.list:

deb http://ftp.fr.debian.org/debian/ unstable main non-free-firmware
deb-src http://ftp.fr.debian.org/debian/ unstable main non-free-firmware

it works fine:

0m0.0s DEBUG: Starting command: ['mmdebstrap', '--skip=check/empty',
'--variant=minbase', '--aptopt=Acquire::http { Proxy
"http://192.168.3.55:3142"; }',
'--keyring=/usr/share/keyrings/debian-archive-keyring.gpg',
'--include=eatmydata', '--merged-usr',
'--components=main,non-free-firmware', 'unstable', '/tmp/tmpjhhhbwky',
'http://ftp.fr.debian.org/debian/']
0m7.3s DUMP:
   I: the option --merged-usr is a no-op. It only exists for
compatibility with some debootstrap wrappers.
   I: automatically chosen mode: root
   I: chroot architecture amd64 is equal to the host's architecture
   I: finding correct signed-by value...
   I: automatically chosen format: directory
   I: skipping check/empty as requested
   I: running apt-get update...
   I: downloading packages with apt...
   I: extracting archives...
   mount: /tmp/tmpjhhhbwky/sys: permission denied.
          dmesg(1) may have more information after failed mount system call.
   I: installing essential packages...
   I: installing remaining packages inside the chroot...
   I: cleaning package lists and apt cache...
   I: success in 7.1120 seconds

If you compare the arguments of the mmdebstrap command, it seems
"[signed-by=...]" is not ignored and is considered as the URL of the
repository.

The workaround for me was to remove these [signed-by=...] from my
sources.list (which doesn't seem to bother apt for
update/ugprade/install).

I don't know how you want to handle this bug, since it seems the new
default format for sources.list is now deb822, but I didn't try with
this format, maybe the bug does not occur.


Philippe.