Hi,

It was nice to see debci update-worker switch to non-root, but the
current permissions of /var/lib/debci don't allow the user to create
anything:

    # From debian/debci.tmpfiles
    d /var/lib/debci 0755 root root

The simplest solution would probably be to change ownership to debci:

    # From debian/debci.tmpfiles
    d /var/lib/debci 0755 debci debci

Though the problem should be obvious, nevertheless here is a reproducer:

    debci@scratch$ cat /etc/debci/debci.conf
    debci_backend="qemu"

    debci@scratch$ debci update-worker
    I: testbed setup [unstable/amd64/qemu]: starting at Sun Aug 23 11:54:52 UTC 2026
    mkdir: cannot create directory ‘/var/lib/debci/qemu’: Permission denied
    failed: unstable/amd64/qemu

Best,
Christian

Hello,

Bug #1145166 in debci reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/ci-team/debci/-/commit/fad7eed201faa33bd0f80c3309cc6e53e7838978
------------------------------------------------------------------------
Create /var/lib/debci with ownership debci:debci

Recently, the debci-update-worker service switched to call as
unprivileged used 'debci', and the backends may need to create
directories there.

Closes: #1145166
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1145166

We believe that the bug you reported is fixed in the latest version of
debci, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1145166@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Antonio Terceiro <terceiro@debian.org> (supplier of updated debci package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 06 Oct 2026 20:05:04 -0300
Source: debci
Architecture: source
Version: 4.4
Distribution: unstable
Urgency: medium
Maintainer: Debian CI team <team+ci@tracker.debian.org>
Changed-By: Antonio Terceiro <terceiro@debian.org>
Closes: 1145166 1149412
Changes:
 debci (4.4) unstable; urgency=medium
 .
   [ Jochen Sprickerhof ]
   * Use multiple --add-apt-source instead of newlines
 .
   [ Antonio Terceiro ]
   * debci drain: fix syntax error
   * debian/changelog: fix spelling error
   * debci drain: simplify log messages
   * debci cancel: update all records in one go
   * debci drain: fix short version of count option
   * Debci::Job#cancel: extract cancelling logic from debci-cancel
   * debci drain: rewrite in Ruby
   * Debci::Drain: split parsing the payload from discarding job
   * Debci::Drain: rename timeout to life cycle
   * Debci::Drain: exit early if seeing the same jobs again
   * Remove `debci job` command and associated library code
   * Debci::Job: remove last_pass_date and last_pass_version
   * Debci::Job: stop pre-calculating previous_status when receiving results
   * spec_helper: bump minimum required test coverage
   * api: delay fetching package data when retrieving results
   * api: remove unused varible assignment
   * api: optimize usage of test results retrieval endpoint
   * Debci::Job.public_api_attributes: avoid duplicate keys (Closes: #1149412)
   * web: redirect /foo to /packages/f/foo/
 .
   [ Christian Kastner ]
   * Parametrize testbed retention hours
   * Create /var/lib/debci with ownership debci:debci (Closes: #1145166)
 .
   [ Julian Gilbey ]
   * improve security of sudoers file
 .
   [ Paul Gevers ]
   * munin: report published results instead of publishing attempts
Checksums-Sha1:
 878390ebbb5b3d8b7ddfd8ca988c732bf5e0bfd4 2998 debci_4.4.dsc
 d0efb8387ce281f7d890ca246936bebe550fcdb0 188124 debci_4.4.tar.xz
 99a660c3b6a20a9af8473d9beadfbc414ca90547 12712 debci_4.4_source.buildinfo
Checksums-Sha256:
 2fd62ac20a2411c0bc4cc199950ecc6a65ebf0240f6c727e1a4306dadfc5d94a 2998 debci_4.4.dsc
 bc94c0192f447135050829b954a47d2187db42737d262dc101e2588acdb98816 188124 debci_4.4.tar.xz
 dcaa1b598d9c3f8f4d4e3a0fbe5bbc244245c5e58aff3f84ac72c7d88c980363 12712 debci_4.4_source.buildinfo
Files:
 fd4140211119b04f558239794306586a 2998 devel optional debci_4.4.dsc
 90d0b1959b7a7911e2108bfe8b81376e 188124 devel optional debci_4.4.tar.xz
 960c0e1a6605eb27a9f138cf3295e16b 12712 devel optional debci_4.4_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEst7mYDbECCn80PEM/A2xu81GC94FAmrFftcACgkQ/A2xu81G
C97uLw//R+ydentkJreiPJgxhr7sisuPT2TpFKETrzxnI16C7xhHqHXlZIrNfeIu
DvzqiYnhPZuuqPouTr8myxoMc7NfDqfZWNBLTlst5soysDcTATorwupocZzqcQQL
Tv/VkHSKzw0VfSBKwim43vIF3Km5Hv+K4YMA07Zr81oSFOU3W+NQ76QlI52kob/x
IHv7QtNUNnKeSCRzK3a9bmXmN99uWng/N+evkmAe8l5VNDHeMVTsVBmfkGvBmogi
jHR8B/05sl2+0ET2CjaNJKjPC9AEjPPcsRHjUMeX2k+Ba+eS8H7Eog/QksJAWA3t
6vgj9dmy+j+1Hkd8zQ+MffHVKRTtYpah4Vol+XcDYJaYZ+uHP3wsxiJ5AGVVCZvO
gPjTPdDdVSSibiMCIuemeIsWE/kc9fx0uJD7QLYRY7QF716KzmrWY3VmG4nU+7P9
GEkuk6ZdIFvLC+ETa+lRiUPfHeTjXWcqSok3LhdzdyYFnW0W+Pr+gmyRjiqG/fAI
9zbkbozxU93w7PR038fOmwuonMRSIBnyumsP7Lqn7NK8fd0qEXnffqpiSJ6+/gYo
RmB4ylaT2PfMlFsKtToN1IWzj7zNz5YQYjQxXXXrXHSNYF7QT52M36n7fHtinFyK
POeUsPM/dr3YbsraVzDYMhBDPsyWWiF+tgJTOos+1RpZP3+j/JA=
=yz7Y
-----END PGP SIGNATURE-----