Re: Using python-apt's apt_pkg with a chroot

On 12/2/25 7:17 PM, Johannes Schauer Marin Rodrigues wrote:
> Quoting Sebastiaan Couwenberg (2025-12-02 18:36:00)
>> Using python-apt's apt_pkg with a chroot turns out to be non-trivial unlike apt.cache.
>>
>> I'm running a script [0] on a trixie system and need to interact with the cache in a testing chroot.
>>
>> The chroot is created with mmdebstrap --mode=unshare, and the script is run via unshare as well.
> 
> maybe this is an XY problem.
> 
> Why do you need a full chroot for something that is as far as I get from the
> script just a "I want apt to resolve the dependencies with my custom
> sources.list"? This sounds like something like chdist is doing?

I want to use apt to resolve dependencies for packages (both source & binary) in testing (and unstable), but the code won't be running on a testing (or unstable) system.

See #1120799 for context.

> Maybe the mmdebstrap man page has an example which helps you. It is a snippet
> which is the very bare-bones of what mmdebstrap does with a few thousand more
> lines of code:
> 
>      mkdir -p "$2/etc/apt" "$2/var/cache" "$2/var/lib"
>      cat << END > "$2/apt.conf"
>      Apt::Architecture "$(dpkg --print-architecture)";
>      Apt::Architectures "$(dpkg --print-architecture)";
>      Dir "$(cd "$2" && pwd)";
>      Dir::Etc::Trusted "$(eval "$(apt-config shell v Dir::Etc::Trusted/f)"; printf %s "$v")";
>      Dir::Etc::TrustedParts "$(eval "$(apt-config shell v Dir::Etc::TrustedParts/d)"; printf %s "$v"
> 
>      END
>      echo "deb http://deb.debian.org/debian/ $1 main" > "$2/etc/apt/sources.list"
>      APT_CONFIG="$2/apt.conf" apt-get update
>      APT_CONFIG="$2/apt.conf" apt-get --yes --download-only install '?essential'
>      for f in "$2"/var/cache/apt/archives/*.deb; do dpkg-deb --extract "$f" "$2"; done
>      chroot "$2" sh -c "dpkg --install --force-depends /var/cache/apt/archives/*.deb"

How would python-apt's apt_pkg use this?

>> Setting RootDir in the config does not result in the chroot paths to be used:
> 
> I think you need Dir.

Not according to the apt.conf(5):

"
   The configuration item RootDir has a special meaning. If set, all paths will be relative to RootDir, even paths that are specified absolutely. So, for instance, if RootDir is set to /tmp/staging and Dir::State::status is set to /var/lib/dpkg/status, then the status file will be looked up in /tmp/staging/var/lib/dpkg/status. If you want to prefix only relative paths, set Dir instead.
"

Using Dir fails in the same way:

  $ unshare --map-auto --map-user=65536 --map-group=65536 --keep-caps -- ~/git/release-team/release.debian.org/bin/resolve-dependencies.py -vdp opencv -u 2>&1 | tee /tmp/resolve-dependencies.log
  Resolving dependencies for: opencv
  Chroot already exists: /var/tmp/testing-chroot
  config:
  Dir "/var/tmp/testing-chroot";

  list:
  [<apt_pkg.MetaIndex object: type='deb', uri:'http://ftp.nl.debian.org/debian/' dist='trixie' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://ftp.nl.debian.org/debian/' dist='trixie-updates' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://security.debian.org/debian-security/' dist='trixie-security' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://ftp.nl.debian.org/debian/' dist='trixie-backports' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://debug.mirrors.debian.org/debian-debug/' dist='trixie-debug' is_trusted='1'>]
  Reading package lists... Done
  Building dependency tree... Done
  Reading state information... Done
  Traceback (most recent call last):
    File "/home/bas/git/release-team/release.debian.org/bin/resolve-dependencies.py", line 216, in <module>
      sys.exit(main())
               ~~~~^^
    File "/home/bas/git/release-team/release.debian.org/bin/resolve-dependencies.py", line 212, in main
      return resolve_dependencies()
    File "/home/bas/git/release-team/release.debian.org/bin/resolve-dependencies.py", line 97, in resolve_dependencies
      cache.update(apt.progress.text, source_list)
      ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  apt_pkg.Error: E:Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied), E:Unable to lock directory /var/lib/apt/lists/

>>    apt_pkg.Error: E:Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied), E:Unable to lock directory /var/lib/apt/lists/
> 
> This sounds like you are trying to access something created for the unshared
> user as the normal user?

No, this is python-apt running outside the chroot as also hinted by the sources.list for trixie.

Running the script directory instead of via unshare fails in the same way because my unprivileged user is not allowed to write those directories:

  $ ~/git/release-team/release.debian.org/bin/resolve-dependencies.py -vdp opencv -u 2>&1 | tee /tmp/resolve-dependencies.log
  Resolving dependencies for: opencv
  Chroot already exists: /var/tmp/testing-chroot
  config:
  RootDir "/var/tmp/testing-chroot";

  list:
  [<apt_pkg.MetaIndex object: type='deb', uri:'http://ftp.nl.debian.org/debian/' dist='trixie' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://ftp.nl.debian.org/debian/' dist='trixie-updates' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://security.debian.org/debian-security/' dist='trixie-security' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://ftp.nl.debian.org/debian/' dist='trixie-backports' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://debug.mirrors.debian.org/debian-debug/' dist='trixie-debug' is_trusted='1'>]
  Reading package lists... Done
  Building dependency tree... Done
  Reading state information... Done
  Traceback (most recent call last):
    File "/home/bas/git/release-team/release.debian.org/bin/resolve-dependencies.py", line 216, in <module>
      sys.exit(main())
               ~~~~^^
    File "/home/bas/git/release-team/release.debian.org/bin/resolve-dependencies.py", line 212, in main
      return resolve_dependencies()
    File "/home/bas/git/release-team/release.debian.org/bin/resolve-dependencies.py", line 97, in resolve_dependencies
      cache.update(apt.progress.text, source_list)
      ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  apt_pkg.Error: E:Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied), E:Unable to lock directory /var/lib/apt/lists/

Running the script as root does not fail on update, but it works with the trixie data instead of the testing:

  $ su -c "~bas/git/release-team/release.debian.org/bin/resolve-dependencies.py -vdp opencv -u" 2>&1 | tee /tmp/resolve-dependencies.log
  Password:
  Resolving dependencies for: opencv
  Chroot already exists: /var/tmp/testing-chroot
  config:
  RootDir "/var/tmp/testing-chroot";

  list:
  [<apt_pkg.MetaIndex object: type='deb', uri:'http://ftp.nl.debian.org/debian/' dist='trixie' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://ftp.nl.debian.org/debian/' dist='trixie-updates' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://security.debian.org/debian-security/' dist='trixie-security' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://ftp.nl.debian.org/debian/' dist='trixie-backports' is_trusted='1'>,
   <apt_pkg.MetaIndex object: type='deb', uri:'http://debug.mirrors.debian.org/debian-debug/' dist='trixie-debug' is_trusted='1'>]
  Reading package lists... Done
  Building dependency tree... Done
  Reading state information... Done
  Error in function start
  TypeError: AcquireProgress.start() missing 1 required positional argument: 'self'
  [...]
  Error in function stop
  TypeError: AcquireProgress.stop() missing 1 required positional argument: 'self'
  Package: opencv
  Version: 4.10.0+dfsg-5
  Build-Depends: [...]

This the version in trixie, I need the data for forky:

  $ rmadison -s stable,testing opencv
  opencv     | 4.10.0+dfsg-5 | stable     | source
  opencv     | 4.10.0+dfsg-6 | testing    | source

Kind Regards,

Bas

-- 
  PGP Key ID: 4096R/6750F10AE88D4AF1
Fingerprint: 8182 DE41 7056 408D 6146  50D1 6750 F10A E88D 4AF1