diff --git a/debian/changelog b/debian/changelog
index 4176ee3..2bac2d0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -16,8 +16,10 @@ multistrap (2.1.8) experimental; urgency=low
 
   [ Neil Williams ]
   * Improve check-deps to find missing packages
+  * Drop all use of forceyes - no longer necessary.
+  * Handle missing 'include' files cleanly and early. (Closes: #595006)
 
- -- Neil Williams <codehelp@debian.org>  Sun, 03 Oct 2010 16:17:16 +0100
+ -- Neil Williams <codehelp@debian.org>  Sun, 03 Oct 2010 19:08:43 +0100
 
 multistrap (2.1.7) unstable; urgency=low
 
diff --git a/debian/rules b/debian/rules
index 2497423..a632eff 100755
--- a/debian/rules
+++ b/debian/rules
@@ -4,4 +4,3 @@ include /usr/share/cdbs/1/rules/debhelper.mk
 
 DEB_MAKE_INSTALL_TARGET=install
 DEB_COMPRESS_EXCLUDE_ALL := device_table.txt
-
diff --git a/multistrap b/multistrap
index cc7cdee..ade3e20 100755
--- a/multistrap
+++ b/multistrap
@@ -147,7 +147,10 @@ unless (keys %sources and @aptsources) {
 
 # Translators: fields are: programname, architecture, host architecture.
 printf (_g("%s building %s multistrap on '%s'\n"), $progname, $arch, $host);
-
+if ($dir =~ /^$/) {
+	my $msg = _g("No directory specified!");
+	die "$progname: $msg\n";
+}
 if (not -d "$dir") {
 	my $ret = system ("mkdir -p $dir");
 	$ret /= 256 if (defined $ret);
@@ -267,11 +270,16 @@ foreach my $pkg (values %keyrings) {
 }
 if ((defined $k) and (not defined $noauth)) {
 	printf (_g("I: Installing %s\n"), $k);
+	# the keyring package must be available to the external apt
 	system ("apt-get -y -d --reinstall install $k");
 	foreach my $keyring_pkg (values %keyrings) {
 		my @files=();
 		my $file = `find /var/cache/apt/archives/ -name "$keyring_pkg*"`;
 		chomp ($file);
+		if ($file eq "") {
+			my $msg = sprintf (_g("Unable to download keyring package: '%s'"),$dir);
+			die "$progname: $msg\n";
+		}
 		my $xdir = `mktemp -d -t keyring.XXXXXX`;
 		chomp ($xdir);
 		system ("dpkg -X $file $xdir >/dev/null");
@@ -348,9 +356,7 @@ foreach my $a (@s) {
 }
 $str = join (' ', sort keys %uniq);
 @dsclist = sort keys %uniq;
-my $forceyes="";
-$forceyes="--force-yes" if (defined $noauth);
-print "apt-get $forceyes -y $config_str install $str\n";
+print "apt-get -y $config_str install $str\n";
 $retval = system ("apt-get -y $config_str install $str");
 die (sprintf (_g("apt download failed. Exit value: %d\n"),($retval/256)))
 	if ($retval != 0);
@@ -684,7 +690,7 @@ sub native {
 	}
 	# reinstall set
 	foreach my $reinst (sort @reinstall) {
-		system ("$str $env chroot $dir apt-get --reinstall -y $forceyes install $reinst");
+		system ("$str $env chroot $dir apt-get --reinstall -y install $reinst");
 	}
 }
 
@@ -865,6 +871,18 @@ sub cascade {
 			my @a = split (' ', lc($keys{$section}{'aptsources'}));
 			push @aptsources, @a;
 			my @i = split (' ', lc($keys{$section}{'include'}));
+			foreach my $inc (@i) {
+				# look for the full filepath or try same directory as current conf.
+				if (not -f $inc) {
+					$chk = `realpath $cfgdir/$inc 2>/dev/null`;
+					chomp ($chk) if (defined $chk);
+					$inc = $chk if (-f $chk);
+				}
+				if (not -f $inc) {
+					my $dirmsg = sprintf (_g("ERR: Cannot find include file: '%s' for '%s'"), $inc, $file);
+					die ("$dirmsg\n");
+				}
+			}
 			push @includes, @i;
 		} else {
 			$sources{$section}=$keys{$section}{'source'} if (not exists $source{$section});
diff --git a/pod/multistrap b/pod/multistrap
index 6ff8894..de6b08d 100644
--- a/pod/multistrap
+++ b/pod/multistrap
@@ -203,10 +203,13 @@ The codename (etch, lenny, squeeze, sid) does not change.
 
 =head1 Secure Apt
 
-To use authenticated apt repositories, multistrap either needs to be
-able to install an appropriate keyring package from the existing apt
-sources B<outside the multistrap environment> or have the relevant keys
-already configured using apt-key B<on the host system>.
+To use authenticated apt repositories, multistrap needs to be able to
+install an appropriate keyring package from the existing apt
+sources B<outside the multistrap environment> into the destination
+system. Unfortunately, keyring packages cannot be downloaded from
+the repositories specified in the multistrap configuration - this is
+because C<apt> needs the keyring to be updated before being able to
+use repositories not previously known.
 
 If relevant packages exist, specify them in the 'keyring' option for
 each repository. multistrap will then check that apt has already
@@ -218,15 +221,11 @@ authenticated or apt will fail. Similarly, secure apt can only be
 disabled for all repositories (by using the --no-auth command line
 option or setting the general noauth option in the configuration
 file), even if only one repository does not have a suitable keyring
-available. Not all packages need keyring packages, if you configure
-apt-key appropriately.
+available.
 
 The keyring package(s) will also be installed inside the multistrap
 environment to match the installed apt sources for the multistrap.
 
-All configuration of apt-key needs to be done for the machine
-running multistrap itself.
-
 =head1 State
 
 multistrap is stateless - if the directory exists, it will simply