Moin josch,

as already discussed in IRC, I don't find a use case for gpgvnoexpkeysig
and think it could be deprecated. According to mmdebstrap(1):

| Example: This is necessary for allowing old timestamps from
| snapshot.debian.org
|
|  --aptopt='Acquire::Check-Valid-Until "false"'
|  --aptopt='Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"'

As well as:

| Create a buildd tarball for EOL distro:
|
|  $ mmdebstrap --include=apt --variant=buildd --aptopt \
|      'Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' \
|      --aptopt='Acquire::Check-Valid-Until "false"' \
|      --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \
|      --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older \
|      jessie ~/.cache/sbuild/jessie-arm64.tar \
|      http://archive.debian.org/debian

Adding --aptopt Apt::Key::gpgvcommand has two consequences:

1. It is added to the outer apt config on the host system.

2. It is added to /etc/apt/apt.conf.d/99mmdebstrap inside the chroot.
   This is only needed when you want to use apt inside the chroot.

Let's inspect 1. first:

mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \
 --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \
 --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older jessie \
 /dev/null http://archive.debian.org/debian

as well as:

mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \
 --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \
 --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older unstable \
 /dev/null https://snapshot.debian.org/archive/debian/20131012T160100Z/

works just fine here. I was not able to test older then 20131012T160100Z
even with gpgvnoexpkeysig.

So with a recent apt 1. gpgvnoexpkeysig is not needed. It is also
problematic because it tries to call gpgv but there is not direct
dependency to it so on a system without gpgv installs it fails with:

W: http://snapshot.debian.org/archive/debian/20260824T022231Z/dists/unstable/InRelease: Loading /etc/apt/trusted.gpg from deprecated option Dir::Etc::Trusted
W: Signature verification failed: http://snapshot.debian.org/archive/debian/20260824T022231Z unstable InRelease: GPG: gpgv executable not found
E: The repository 'http://snapshot.debian.org/archive/debian/20260824T022231Z unstable InRelease' is not signed.

Which is not obvious.

For 2. the problem is that gpgvnoexpkeysig would need to exist inside
the chroot, which is not normally the case and the mmdebstrap versions
in older releases does not even provide it. So I think the real command
should be something like: