If you mmdebstrap --keyring=/path/to/somekeyring ...  and that keyring
happens to not be readable by your subuid range (e.g.  when it is not
world readable) the error message is not very helpful.  The permission
problem is not displayed at all. Instead, a missing key is reported:

| $ mmdebstrap --keyring=/home/helmut/ubuntu-archive-keyring.gpg  --variant=apt resolute /dev/null 'deb http://archive.ubuntu.com/ubuntu resolute main'
| I: automatically chosen mode: unshare
| I: chroot architecture amd64 is equal to the host's architecture
| I: finding correct signed-by value...
| done
| I: automatically chosen format: null
| I: using /tmp/mmdebstrap.JCRAhtyKDG as tempdir
| I: running apt-get update...
| done
| Get:1 http://archive.ubuntu.com/ubuntu resolute InRelease [136 kB]
| Err:1 http://archive.ubuntu.com/ubuntu resolute InRelease
|   Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key F6ECB3762474EDA9D21B7022871920D1991BC93C, which is needed to verify signature.
| Reading package lists...
| W: http://archive.ubuntu.com/ubuntu/dists/resolute/InRelease: Loading /home/helmut/ubuntu-archive-keyring.gpg from deprecated option Dir::Etc::Trusted
| W: OpenPGP signature verification failed: http://archive.ubuntu.com/ubuntu resolute InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key F6ECB3762474EDA9D21B7022871920D1991BC93C, which is needed to verify signature.
| E: The repository 'http://archive.ubuntu.com/ubuntu resolute InRelease' is not signed.
| E: apt-get update --error-on=any -oAPT::Status-Fd=<$fd> -oDpkg::Use-Pty=false failed: process exited with 100 and error in console output
| W: hooklistener errored out: E: received eof on socket
|
| I: main() received signal PIPE: waiting for setup...
| I: removing tempdir /tmp/mmdebstrap.JCRAhtyKDG...
| E: mmdebstrap failed to run
| $

Notably, if the key file is plain missing, mmdebstrap immediately quits
with an error. Once making the key file world-readable, it just works.

It would be nice if this failure were reported in way that's easier to
understand.

Helmut

Hi,

Quoting Helmut Grohne (2026-06-09 13:59:27)
uses the wrong logic:

if (-e $options->{apttrusted} && !-r $options->{apttrusted}) {
    warning "cannot read $options->{apttrusted}";
}

The above assumes that the unshared user is able to see whether the file exists
but that can fail if there are insufficient permissions along the path. The new
code now also considers whether the unprivileged _apt user is able to read the
keyring:

    foreach my $path ($options->{apttrusted}, $options->{apttrustedparts}) {
        if (!-e $path) {
            warning("keyring does not exist (or insufficient permissions): "
                  . $path);
            next;
        }
        if (!-r $path) {
            warning("keyring cannot be read: " . $path);
            next;
        }
        my @testcmd = (
            '/usr/lib/apt/apt-helper', 'drop-privs', '--', 'test', '-r', $path
        );
        my $pid = fork() // error "fork() failed: $!";
        if ($pid == 0) {
            open(STDOUT, '>', '/dev/null')
              or error "cannot open /dev/null for writing: $!";
            open(STDERR, '>', '/dev/null')
              or error "cannot open /dev/null for writing: $!";
            exec { $testcmd[0] } @testcmd
              or error("cannot exec " . (join " ", @testcmd) . ": $!");
        }
        waitpid $pid, 0;
        if ($? != 0) {
            warning "apt is unable to read $path after dropping privileges";
        }
    }

But, please be careful when using the --keyring argument. apt developers
deprecated the Dir::Etc::Trusted option:

W: http://archive.ubuntu.com/ubuntu/dists/resolute/InRelease: Loading /home/josch/mmdebstrap/target/usr/share/keyrings/ubuntu-archive-keyring.gpg from deprecated option Dir::Etc::Trusted

Instead, you should be using the keyring option in your sources.list.

Thanks!

cheers, josch