mmdebstrap/mmdebstrap

#!/usr/bin/perl
#
# Copyright: 2018 Johannes Schauer <josch@mister-muffin.de>
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to
# deal in the Software without restriction, including without limitation the
# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
# sell copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.

use strict;
use warnings;

use English;
use Getopt::Long;
use Pod::Usage;
use File::Copy;
use File::Path qw(make_path remove_tree);
use File::Temp qw(tempfile tempdir);
use Cwd qw(abs_path);
require "syscall.ph";
use Fcntl qw(S_IFCHR S_IFBLK FD_CLOEXEC F_GETFD F_SETFD);
use List::Util qw(any none);

# from sched.h
use constant {
    CLONE_NEWNS   => 0x20000,
    CLONE_NEWUTS  => 0x4000000,
    CLONE_NEWIPC  => 0x8000000,
    CLONE_NEWUSER => 0x10000000,
    CLONE_NEWPID  => 0x20000000,
    CLONE_NEWNET  => 0x40000000,
};

# type codes:
#   0 -> normal file
#   1 -> hardlink
#   2 -> symlink
#   3 -> character special
#   4 -> block special
#   5 -> directory
my @devfiles = (
    # filename         mode  type link target        major  minor
    [ "./dev/",        0755, 5,   '',                undef, undef ],
    [ "./dev/console", 0666, 3,   '',                5,     1 ],
    [ "./dev/fd",      0777, 2,   '/proc/self/fd',   undef, undef ],
    [ "./dev/full",    0666, 3,   '',                1,     7 ],
    [ "./dev/null",    0666, 3,   '',                1,     3 ],
    [ "./dev/ptmx",    0666, 3,   '',                5,     2 ],
    [ "./dev/pts/",    0755, 5,   '',                undef, undef ],
    [ "./dev/random",  0666, 3,   '',                1,     8 ],
    [ "./dev/shm/",    0755, 5,   '',                undef, undef ],
    [ "./dev/stderr",  0777, 2,   '/proc/self/fd/2', undef, undef ],
    [ "./dev/stdin",   0777, 2,   '/proc/self/fd/0', undef, undef ],
    [ "./dev/stdout",  0777, 2,   '/proc/self/fd/1', undef, undef ],
    [ "./dev/tty",     0666, 3,   '',                5,     0 ],
    [ "./dev/urandom", 0666, 3,   '',                1,     9 ],
    [ "./dev/zero",    0666, 3,   '',                1,     5 ],
);

# tar cannot figure out the decompression program when receiving data on
# standard input, thus we do it ourselves. This is copied from tar's
# src/suffix.c
sub get_tar_compress_options($) {
    my $filename = shift;
    if ($filename =~ /\.(gz|tgz|taz)$/) {
	return ('--gzip');
    } elsif ($filename =~ /\.(Z|taZ)$/) {
	return ('--compress');
    } elsif ($filename =~ /\.(bz2|tbz|tbz2|tz2)$/) {
	return ('--bzip2');
    } elsif ($filename =~ /\.lz$/) {
	return ('--lzip');
    } elsif ($filename =~ /\.(lzma|tlz)$/) {
	return ('--lzma');
    } elsif ($filename =~ /\.lzo$/) {
	return ('--lzop');
    } elsif ($filename =~ /\.lz4$/) {
	return ('--use-compress-program', 'lz4');
    } elsif ($filename =~ /\.(xz|txz)$/) {
	return ('--xz');
    }
    return ();
}

sub test_unshare() {
    if ($EFFECTIVE_USER_ID == 0) {
	return 0;
    }
    # arguments to syscalls have to be stored in their own variable or
    # otherwise we will get "Modification of a read-only value attempted"
    my $unshare_flags = CLONE_NEWUSER;
    # we spawn a new per process because if unshare succeeds, we would
    # otherwise have unshared the mmdebstrap process itself which we don't want
    my $pid = fork() // die "fork() failed: $!";
    if ($pid == 0) {
	my $ret = syscall &SYS_unshare, $unshare_flags;
	if (($ret >> 8) == 0) {
	    exit 0;
	} else {
	    exit 1;
	}
    }
    waitpid($pid, 0);
    if (($? >> 8) != 0) {
	return 0;
    }
    # if newuidmap and newgidmap exist, the exit status will be 1 when
    # executed without parameters
    system "newuidmap 2>/dev/null";
    if (($? >> 8) != 1) {
	return 0;
    }
    system "newgidmap 2>/dev/null";
    if (($? >> 8) != 1) {
	return 0;
    }
    return 1;
}

sub read_subuid_subgid() {
    my $username = getpwuid $<;
    my ($subid, $num_subid, $fh, $n);
    my @result = ();

    if (! -e "/etc/subuid") {
	printf STDERR "/etc/subuid doesn't exist\n";
	return;
    }
    if (! -r "/etc/subuid") {
	printf STDERR "/etc/subuid is not readable\n";
	return;
    }

    open $fh, "<", "/etc/subuid" or die "cannot open /etc/subuid for reading: $!";
    while (my $line = <$fh>) {
	($n, $subid, $num_subid) = split(/:/, $line, 3);
	last if ($n eq $username);
    }
    close $fh;
    push @result, ["u", 0, $subid, $num_subid];

    if (scalar(@result) < 1) {
	printf STDERR "/etc/subuid does not contain an entry for $username\n";
	return;
    }
    if (scalar(@result) > 1) {
	printf STDERR "/etc/subuid contains multiple entries for $username\n";
	return;
    }

    open $fh, "<", "/etc/subgid" or die "cannot open /etc/subgid for reading: $!";
    while (my $line = <$fh>) {
	($n, $subid, $num_subid) = split(/:/, $line, 3);
	last if ($n eq $username);
    }
    close $fh;
    push @result, ["g", 0, $subid, $num_subid];

    if (scalar(@result) < 2) {
	printf STDERR "/etc/subgid does not contain an entry for $username\n";
	return;
    }
    if (scalar(@result) > 2) {
	printf STDERR "/etc/subgid contains multiple entries for $username\n";
	return;
    }

    return @result;
}

# This function spawns two child processes forming the following process tree
#
#   A
#   |
#  fork()
#   |  \
#   B   C
#   |   |
#   |  fork()
#   |   |  \
#   |   D   E
#   |   |   |
#   |unshare()
#   | close()
#   |   |   |
#   |   | read()
#   |   | newuidmap(D)
#   |   | newgidmap(D)
#   |   |  /
#   | waitpid()
#   |   |
#   |  fork()
#   |   |  \
#   |   F   G
#   |   |   |
#   |   |   exec()
#   |   |  /
#   | waitpid()
#   |  /
# waitpid()
#
# To better refer to each individual part, we give each process a new
# identifier after calling fork(). Process A is the main process. After
# executing fork() we call the parent and child B and C, respectively. This
# first fork() is done because we do not want to modify A. B then remains
# waiting for its child C to finish. C calls fork() again, splitting into
# the parent D and its child E. In the parent D we call unshare() and close a
# pipe shared by D and E to signal to E that D is done with calling unshare().
# E notices this by using read() and follows up with executing the tools
# new[ug]idmap on D. E finishes and D continues with doing another fork().
# This is because when unsharing the PID namespace, we need a PID 1 to be kept
# alive or otherwise any child processes cannot fork() anymore themselves. So
# we keep F as PID 1 and finally call exec() in G.
sub get_unshare_cmd(&$) {
    my $cmd = shift;
    my $idmap = shift;

    my $unshare_flags = CLONE_NEWUSER | CLONE_NEWNS | CLONE_NEWPID | CLONE_NEWUTS | CLONE_NEWIPC;

    if (0) {
	$unshare_flags |= CLONE_NEWNET;
    }

    # fork a new process and let the child get unshare()ed
    # we don't want to unshare the parent process
    my $gcpid = fork() // die "fork() failed: $!";
    if ($gcpid == 0) {
	# Create a pipe for the parent process to signal the child process that it is
	# done with calling unshare() so that the child can go ahead setting up
	# uid_map and gid_map.
	pipe my $rfh, my $wfh;

	# We have to do this dance with forking a process and then modifying the
	# parent from the child because:
	#  - new[ug]idmap can only be called on a process id after that process has
	#    unshared the user namespace
	#  - a process looses its capabilities if it performs an execve() with nonzero
	#    user ids see the capabilities(7) man page for details.
	#  - a process that unshared the user namespace by default does not have the
	#    privileges to call new[ug]idmap on itself
	#
	# this also works the other way around (the child setting up a user namespace
	# and being modified from the parent) but that way, the parent would have to
	# stay around until the child exited (so a pid would be wasted). Additionally,
	# that variant would require an additional pipe to let the parent signal the
	# child that it is done with calling new[ug]idmap. The way it is done here,
	# this signaling can instead be done by wait()-ing for the exit of the child.
	my $ppid = $$;
	my $cpid = fork() // die "fork() failed: $!";
	if ($cpid == 0) {
	    # child

	    # Close the writing descriptor at our end of the pipe so that we
	    # see EOF when parent closes its descriptor.
	    close $wfh;

	    # Wait for the parent process to finish its unshare() call by
	    # waiting for an EOF.
	    0 == sysread $rfh, my $c, 1 or die "read() did not receive EOF";

	    # The program's new[ug]idmap have to be used because they are
	    # setuid root.  These privileges are needed to map the ids from
	    # /etc/sub[ug]id to the user namespace set up by the parent.
	    # Without these privileges, only the id of the user itself can be
	    # mapped into the new namespace.
	    #
	    # Since new[ug]idmap is setuid root we also don't need to write
	    # "deny" to /proc/$$/setgroups beforehand (this is otherwise
	    # required for unprivileged processes trying to write to
	    # /proc/$$/gid_map since kernel version 3.19 for security reasons)
	    # and therefore the parent process keeps its ability to change its
	    # own group here.
	    #
	    # Since /proc/$ppid/[ug]id_map can only be written to once,
	    # respectively, instead of making multiple calls to new[ug]idmap,
	    # we assemble a command line that makes one call each.
	    my $uidmapcmd = "";
	    my $gidmapcmd = "";
	    foreach (@{$idmap}) {
		my ($t, $hostid, $nsid, $range) = @{$_};
		if ($t ne "u" and $t ne "g" and $t ne "b") {
		    die "invalid idmap type: $t";
		}
		if ($t eq "u" or $t eq "b") {
		    $uidmapcmd .= " $hostid $nsid $range";
		}
		if ($t eq "g" or $t eq "b") {
		    $gidmapcmd .= " $hostid $nsid $range";
		}
	    }
	    my $idmapcmd = '';
	    if ($uidmapcmd ne "") {
		0 == system "newuidmap $ppid $uidmapcmd" or die "newuidmap $ppid $uidmapcmd failed: $!";
	    }
	    if ($gidmapcmd ne "") {
		0 == system "newgidmap $ppid $gidmapcmd" or die "newgidmap $ppid $gidmapcmd failed: $!";
	    }
	    exit 0;
	}

	# parent

	# After fork()-ing, the parent immediately calls unshare...
	0 == syscall &SYS_unshare, $unshare_flags or die "unshare() failed: $!";

	# .. and then signals the child process that we are done with the
	# unshare() call by sending an EOF.
	close $wfh;

	# Wait for the child process to finish its setup by waiting for its
	# exit.
	$cpid == waitpid $cpid, 0 or die "waitpid() failed: $!";
	my $exit = $? >> 8;
	if ($exit != 0) {
	    die "child had a non-zero exit status: $exit";
	}

	# Currently we are nobody (uid and gid are 65534). So we become root
	# user and group instead.
	#
	# We are using direct syscalls instead of setting $(, $), $< and $>
	# because then perl would do additional stuff which we don't need or
	# want here, like checking /proc/sys/kernel/ngroups_max (which might
	# not exist). It would also also call setgroups() in a way that makes
	# the root user be part of the group unknown.
	0 == syscall &SYS_setgid, 0 or die "setgid failed: $!";
	0 == syscall &SYS_setuid, 0 or die "setuid failed: $!";
	0 == syscall &SYS_setgroups, 0, 0 or die "setgroups failed: $!";

	if (1) {
	    # When the pid namespace is also unshared, then processes expect a
	    # master pid to always be alive within the namespace. To achieve
	    # this, we fork() here instead of exec() to always have one dummy
	    # process running as pid 1 inside the namespace. This is also what
	    # the unshare tool does when used with the --fork option.
	    #
	    # Otherwise, without a pid 1, new processes cannot be forked
	    # anymore after pid 1 finished.
	    my $cpid = fork() // die "fork() failed: $!";
	    if ($cpid != 0) {
		# The parent process will stay alive as pid 1 in this
		# namespace until the child finishes executing. This is
		# important because pid 1 must never die or otherwise nothing
		# new can be forked.
		$cpid == waitpid $cpid, 0 or die "waitpid() failed: $!";
		exit ($? >> 8);
	    }
	}

	&{$cmd}();

	exit 0;
    }

    # parent
    return $gcpid;
}

sub havemknod($) {
    my $root = shift;
    my $havemknod = 0;
    if (-e "$root/test-dev-null") {
	die "/test-dev-null already exists";
    }
    TEST: {
	# we fork so that we can read STDERR
	my $pid = open my $fh, '-|' // die "failed to fork(): $!";
	if ($pid == 0) {
	    open(STDERR, '>&', STDOUT);
	    # we use mknod(1) instead of the system call because creating the
	    # right dev_t argument requires makedev(3)
	    exec 'mknod', "$root/test-dev-null", 'c', '1', '3';
	}
	chomp (my $content = do { local $/; <$fh> });
	close $fh;
	{
	    last TEST unless $? == 0 and $content eq '';
	    last TEST unless -c "$root/test-dev-null";
	    last TEST unless open my $fh, '>', "$root/test-dev-null";
	    last TEST unless print $fh 'test';
	}
	$havemknod = 1;
    }
    if (-e "$root/test-dev-null") {
	unlink "$root/test-dev-null" or die "cannot unlink /test-dev-null";
    }
    return $havemknod;
}

sub print_progress {
    my $perc = shift;
    if (!-t STDERR) {
	return;
    }
    if ($perc eq "done") {
	# \e[2K clears everything on the current line (i.e. the progress bar)
	print STDERR "\e[2Kdone\n";
	return;
    }
    if ($perc >= 100) {
	$perc = 100;
    }
    my $width = 50;
    my $num_x = int($perc*$width/100);
    my $bar = '=' x $num_x;
    if ($num_x != $width) {
	$bar .= '>';
	$bar .= ' ' x ($width - $num_x - 1);
    }
    printf STDERR "%6.2f [%s]\r", $perc, $bar;
}

sub run_dpkg_progress {
    my $debs = shift;
    my @args = @_;
    pipe my $rfh, my $wfh;
    my $dpkgpid = open (my $pipe_dpkg, '-|') // die "failed to fork(): $!";
    if ($dpkgpid == 0) {
	close $rfh;
	# Unset the close-on-exec flag, so that the file descriptor does not
	# get closed when we exec dpkg
	my $flags = fcntl( $wfh, F_GETFD, 0 ) or die "fcntl F_GETFD: $!";
	fcntl($wfh, F_SETFD, $flags & ~FD_CLOEXEC ) or die "fcntl F_SETFD: $!";
	my $fd = fileno $wfh;
	# redirect dpkg's stderr to stdout so that we can capture it
	open(STDERR, '>&', STDOUT);
	exec { $args[0] } @args, "--status-fd=$fd", @{$debs};
	die "cannot exec() dpkg";
    }
    close $wfh;

    # spawn two processes:
    #   parent will parse stdout
    #   child will parse $rfh for the progress meter
    my $pid = fork() // die "failed to fork(): $!";
    if ($pid == 0) {
	# child
	print_progress 0.0;
	my $num = 0;
	# each package has one install and one configure step, thus the total
	# number is twice the number of packages
	my $total = (scalar @{$debs}) * 2;
	while (my $line = <$rfh>) {
	    if ($line =~ /^processing: (install|configure): /) {
		$num += 1;
	    }
	    my $perc = $num/$total*100;
	    print_progress $perc;
	}
	print_progress "done";

	exit 0;
    }

    # parent
    my $dpkg_output;
    while (my $line = <$pipe_dpkg>) {
	# forward captured apt output
	#print STDERR $line;
	$dpkg_output .= $line;
    }
    close $pipe_dpkg;
    my $fail = 0;
    if ($? != 0) {
	$fail = 1;
    }

    waitpid $pid, 0;
    $? == 0 or die "progress parsing failed";

    # only print apt failure after progress output finished or otherwise it
    # might interfere
    if ($fail) {
	print STDERR $dpkg_output;
	die ((join ' ', @args) . ' failed');
    }
}

sub run_apt_progress {
    my @args = @_;
    pipe my $rfh, my $wfh;
    my $aptpid = open(my $pipe_apt, '-|') // die "failed to fork(): $!";
    if ($aptpid == 0) {
	close $rfh;
	# Unset the close-on-exec flag, so that the file descriptor does not
	# get closed when we exec apt-get
	my $flags = fcntl( $wfh, F_GETFD, 0 ) or die "fcntl F_GETFD: $!";
	fcntl($wfh, F_SETFD, $flags & ~FD_CLOEXEC ) or die "fcntl F_SETFD: $!";
	my $fd = fileno $wfh;
	# redirect apt's stderr to stdout so that we can capture it
	open(STDERR, '>&', STDOUT);
	exec { $args[0] } @args, "-oAPT::Status-Fd=$fd";
	die "cannot exec apt-get update: $!";
    }
    close $wfh;

    # spawn two processes:
    #   parent will parse stdout to look for errors
    #   child will parse $rfh for the progress meter
    my $pid = fork() // die "failed to fork(): $!";
    if ($pid == 0) {
	# child
	print_progress 0.0;
	while (my $line = <$rfh>) {
	    if ($line =~ /(pmstatus|dlstatus):[^:]+:(\d+\.\d+):.*/) {
		print_progress $2;
	    }
	    #print STDERR "apt: $line";
	}
	print_progress "done";

	exit 0;
    }

    # parent
    my $has_error = 0;
    # apt-get doesn't report a non-zero exit if the update failed. Thus, we
    # have to parse its output. See #778357, #776152, #696335 and #745735
    my $apt_output = '';
    while (my $line = <$pipe_apt>) {
	if ($line =~ '^W: ') {
	    $has_error = 1;
	} elsif ($line =~ '^Err:') {
	    $has_error = 1;
	}
	# forward captured apt output
	#print STDERR $line;
	$apt_output .= $line;
    }
    close($pipe_apt);
    my $fail = 0;
    if ($? != 0 or $has_error) {
	$fail = 1;
    }

    waitpid $pid, 0;
    $? == 0 or die "progress parsing failed";

    # only print apt failure after progress output finished or otherwise it
    # might interfere
    if ($fail) {
	print STDERR $apt_output;
	die ((join ' ', @args) . ' failed');
    }
}

sub setup {
    my $options = shift;

    if (0) {
	foreach my $key (sort keys %{$options}) {
	    my $value = $options->{$key};
	    if (!defined $value) {
		next;
	    }
	    if (ref $value eq '') {
		print STDERR "I: $key: $options->{$key}\n";
	    } elsif (ref $value eq 'ARRAY') {
		print STDERR "I: $key: [" . (join ', ', @{$value}) . "]\n";
	    } else {
		die "unknown type";
	    }
	}
    }

    my ($conf, $tmpfile) = tempfile(UNLINK => 1) or die "cannot open apt.conf: $!";
    print $conf "Apt::Architecture \"$options->{nativearch}\";\n";
    # the host system might have configured additional architectures
    # force only the native architecture
    if (scalar @{$options->{foreignarchs}} > 0) {
	print $conf "Apt::Architectures \"$options->{nativearch} @{$options->{foreignarchs}}\";\n";
    } else {
	print $conf "Apt::Architectures \"$options->{nativearch}\";\n";
    }
    print $conf "Dir::Etc \"$options->{root}/etc/apt\";\n";
    print $conf "Dir::State \"$options->{root}/var/lib/apt\";\n";
    print $conf "Dir::Cache \"$options->{root}/var/cache/apt\";\n";
    # for retrieving the essential packages set, only download
    print $conf "Apt::Get::Download-Only true;\n";
    # for authentication, use the keyrings from the host
    print $conf "Dir::Etc::Trusted \"/etc/apt/trusted.gpg\";\n";
    print $conf "Dir::Etc::TrustedParts \"/etc/apt/trusted.gpg.d\";\n";
    close $conf;

    foreach my $dir ('/etc/apt/apt.conf.d', '/etc/apt/sources.list.d',
	'/etc/apt/preferences.d', '/var/cache/apt',
	'/var/lib/apt/lists/partial', '/var/lib/dpkg',
	'/etc/dpkg/dpkg.cfg.d/') {
	make_path("$options->{root}/$dir") or die "failed to create $dir: $!";
    }

    # We put certain configuration items in their own configuration file
    # because they have to be valid for apt invocation from outside as well as
    # from inside the chroot.
    # The config filename is chosen such that any settings in it will be
    # overridden by what the user specified with --aptopt.
    {
	open my $fh, '>', "$options->{root}/etc/apt/apt.conf.d/00mmdebstrap" or die "cannot open /etc/apt/apt.conf.d/00mmdebstrap: $!";
	print $fh "Apt::Install-Recommends false;\n";
	print $fh "Acquire::Languages \"none\";\n";
	close $fh;
    }

    {
	open my $fh, '>', "$options->{root}/var/lib/dpkg/status" or die "failed to open(): $!";
	close $fh;
    }

    if (scalar @{$options->{foreignarchs}} > 0) {
	open my $fh, '>', "$options->{root}/var/lib/dpkg/arch" or die "cannot open /var/lib/dpkg/arch: $!";
	print $fh "$options->{nativearch}\n";
	foreach my $arch ($options->{foreignarchs}) {
	    print $fh "$arch\n";
	}
	close $fh;
    }

    if (scalar @{$options->{aptopts}} > 0) {
	open my $fh, '>', "$options->{root}/etc/apt/apt.conf.d/99mmdebstrap" or die "cannot open /etc/apt/apt.conf.d/99mmdebstrap: $!";
	foreach my $opt (@{$options->{aptopts}}) {
	    if (-r $opt) {
		copy $opt, $fh or die "cannot copy $opt: $!";
	    } else {
		print $fh $opt;
		if ($opt !~ /;$/) {
		    print $fh ';';
		}
		if ($opt !~ /\n$/) {
		    print $fh "\n";
		}
	    }
	}
	close $fh;
    }

    if (scalar @{$options->{dpkgopts}} > 0) {
	open my $fh, '>', "$options->{root}/etc/dpkg/dpkg.cfg.d/99mmdebstrap" or die "cannot open /etc/dpkg/dpkg.cfg.d/99mmdebstrap: $!";
	foreach my $opt (@{$options->{dpkgopts}}) {
	    if (-r $opt) {
		copy $opt, $fh or die "cannot copy $opt: $!";
	    } else {
		print $fh $opt;
		if ($opt !~ /\n$/) {
		    print $fh "\n";
		}
	    }
	}
	close $fh;
    }

    # setup merged usr
    my @amd64_dirs = ('lib32', 'lib64', 'libx32'); # only amd64 for now
    foreach my $dir ("bin", "sbin", "lib", @amd64_dirs) {
	symlink "usr/$dir", "$options->{root}/$dir" or die "cannot create symlink: $!";
	make_path("$options->{root}/usr/$dir") or die "cannot create /usr/$dir: $!";
    }

    {
	open my $fh, '>', "$options->{root}/etc/fstab" or die "cannot open fstab: $!";
	print $fh "# UNCONFIGURED FSTAB FOR BASE SYSTEM\n";
	close $fh;
	chmod 0644, "$options->{root}/etc/fstab" or die "cannot chmod fstab: $!";
    }

    # write /etc/apt/sources.list
    {
	open my $fh, '>', "$options->{root}/etc/apt/sources.list" or die "cannot open /etc/apt/sources.list: $!";
	print $fh $options->{sourceslist};
	close $fh;
    }

    # we tell apt about the configuration via a config file passed via the
    # APT_CONFIG environment variable instead of using the --option command
    # line arguments because configuration settings like Dir::Etc have already
    # been evaluated at the time that apt takes its command line arguments
    # into account.
    $ENV{"APT_CONFIG"} = "$tmpfile";

    print STDERR "I: running apt-get update...\n";
    run_apt_progress 'apt-get', 'update';

    # check if anything was downloaded at all
    {
	open my $fh, '-|', 'apt-get', 'indextargets' // die "failed to fork(): $!";
	chomp (my $indextargets = do { local $/; <$fh> });
	close $fh;
	if ($indextargets eq '') {
	    print STDERR "content of /etc/apt/sources.list:\n";
	    copy("$options->{root}/etc/apt/sources.list", *STDERR);
	    die "apt-get update didn't download anything";
	}
    }

    # setting PATH for chroot, ldconfig, start-stop-daemon...
    $ENV{"PATH"} = "/usr/sbin:/usr/bin:/sbin:/bin";

    my %pkgs_to_install;
    if (defined $options->{include}) {
	for my $pkg (split /,/, $options->{include}) {
	    $pkgs_to_install{$pkg} = ();
	}
    }
    if ($options->{variant} eq 'buildd') {
	$pkgs_to_install{'build-essential'} = ();
    }
    # To figure out the right package set for the apt variant we can use:
    #     $ apt-get dist-upgrade -o dir::state::status=/dev/null
    # This is because that variants only contain essential packages and
    # apt and libapt treats apt as essential. If we want to install less
    # (essential variant) then we have to compute the package set ourselves.
    # Same if we want to install priority based variants.
    if ($options->{variant} ne 'apt') {
	my %ess_pkgs;
	open(my $pipe_apt, '-|', 'apt-get', 'indextargets', '--format', '$(FILENAME)', 'Created-By: Packages', "Architecture: $options->{nativearch}") or die "cannot start apt-get indextargets: $!";
	while (my $fname = <$pipe_apt>) {
	    chomp $fname;
	    open (my $pipe_cat, '-|', '/usr/lib/apt/apt-helper', 'cat-file', $fname) or die "cannot start apt-helper cat-file: $!";

	    my $pkgname;
	    my $ess = '';
	    my $prio = 'optional';
	    while (my $line = <$pipe_cat>) {
		chomp $line;
		# Dpkg::Index takes 10 seconds to parse a typical Packages
		# file. Thus we instead use a simple parser that just retrieve
		# the information we need.
		if ($line ne "") {
		    if ($line =~ /^Package: (.*)/) {
			$pkgname = $1;
		    } elsif ($line =~ /^Essential: yes$/) {
			$ess = 'yes'
		    } elsif ($line =~ /^Priority: (.*)/) {
			$prio = $1;
		    }
		    next;
		}
		# the line is empty, thus a package stanza just finished
		# processing and we can handle it now
		if ($ess eq 'yes') {
		    $ess_pkgs{$pkgname} = ();
		} elsif ($options->{variant} eq 'essential') {
		    # for this variant we are only interested in the
		    # essential packages
		} elsif (any { $_ eq $options->{variant} } ('standard', 'important', 'required', 'buildd', 'minbase')) {
		    if ($prio eq 'optional' or $prio eq 'extra') {
			# always ignore packages of priority optional and extra
		    } elsif ($prio eq 'standard') {
			if (none { $_ eq $options->{variant} } ('important', 'required', 'buildd', 'minbase')) {
			    $pkgs_to_install{$pkgname} = ();
			}
		    } elsif ($prio eq 'important') {
			if (none { $_ eq $options->{variant} } ('required', 'buildd', 'minbase')) {
			    $pkgs_to_install{$pkgname} = ();
			}
		    } elsif ($prio eq 'required') {
			# required packages are part of all sets except
			# essential and apt
			$pkgs_to_install{$pkgname} = ();
		    } else {
			die "unknown priority: $prio";
		    }
		} else {
		    die "unknown variant: $options->{variant}";
		}
		# reset values
		undef $pkgname;
		$ess = '';
		$prio = 'optional';
	    }

	    close $pipe_cat;
	    $? == 0 or die "apt-helper cat-file failed: $?";
	}
	close $pipe_apt;
	$? == 0 or die "apt-get indextargets failed: $?";

	print STDERR "I: downloading packages with apt...\n";
	run_apt_progress 'apt-get', '--yes', 'install', keys %ess_pkgs;
    } else {
	# if we just want to install Essential:yes packages, apt and their
	# dependencies then we can make use of libapt treating apt as
	# implicitly essential. An upgrade with the (currently) empty status
	# file will trigger an installation of the essential packages plus apt.
	#
	# 2018-09-02, #debian-dpkg on OFTC, times in UTC+2
	# 23:39 < josch> I'll just put it in my script and if it starts
	#                breaking some time I just say it's apt's fault. :P
	# 23:42 < DonKult> that is how it usually works, so yes, do that :P (<-
	#                  and please add that line next to it so you can
	#                  remind me in 5+ years that I said that after I wrote
	#                  in the bugreport: "Are you crazy?!? Nobody in his
	#                  right mind would even suggest depending on it!")
	print STDERR "I: downloading packages with apt...\n";
	run_apt_progress 'apt-get', '--yes', 'dist-upgrade';
    }

    # extract the downloaded packages
    my @essential_pkgs;
    {
	my $apt_archives = "/var/cache/apt/archives/";
	opendir my $dh, "$options->{root}/$apt_archives" or die "cannot read $apt_archives";
	while (my $deb = readdir $dh) {
	    if ($deb !~ /\.deb$/) {
		next;
	    }
	    $deb = "$apt_archives/$deb";
	    if (!-f "$options->{root}/$deb") {
		next;
	    }
	    push @essential_pkgs, $deb;
	}
	close $dh;
    }

    if (scalar @essential_pkgs == 0) {
	# check if a file:// URI was used
	open(my $pipe_apt, '-|', 'apt-get', 'indextargets', '--format', '$(URI)', 'Created-By: Packages') or die "cannot start apt-get indextargets: $!";
	while (my $uri = <$pipe_apt>) {
	    if ($uri =~ /^file:\/\//) {
		die "nothing got downloaded -- use copy:// instead of file://";
	    }
	}
	die "nothing got downloaded";
    }

    print STDERR "I: extracting archives...\n";
    print_progress 0.0;
    my $counter = 0;
    my $total = scalar @essential_pkgs;
    foreach my $deb (@essential_pkgs) {
	$counter += 1;
	# not using dpkg-deb --extract as that would replace the
	# merged-usr symlinks with plain directories
	pipe my $rfh, my $wfh;
	my $pid1 = fork() // die "fork() failed: $!";
	if ($pid1 == 0) {
	    open(STDOUT, '>&', $wfh);
	    exec 'dpkg-deb', '--fsys-tarfile', "$options->{root}/$deb";
	}
	my $pid2 = fork() // die "fork() failed: $!";
	if ($pid2 == 0) {
	    open(STDIN, '<&', $rfh);
	    exec 'tar', '-C', $options->{root}, '--keep-directory-symlink', '--extract', '--file', '-';
	}
	waitpid($pid1, 0);
	$? == 0 or die "dpkg-deb --fsys-tarfile failed: $?";
	waitpid($pid2, 0);
	$? == 0 or die "tar --extract failed: $?";
	print_progress ($counter/$total*100);
    }
    print_progress "done";

    if ($options->{mode} eq 'fakechroot') {
	$ENV{FAKECHROOT_CMD_SUBST} = join ':', (
	    '/bin/mount=/bin/true',
	    '/usr/bin/env=/usr/bin/env.fakechroot',
	    '/usr/bin/ldd=/usr/bin/ldd.fakechroot',
	    '/usr/bin/mkfifo=/bin/true',
	    '/usr/sbin/ldconfig=/bin/true',
	);
    }

    # make sure that APT_CONFIG is not set when executing anything inside the
    # chroot
    my @chrootcmd = ('env', '--unset=APT_CONFIG');
    if ($options->{mode} eq 'proot') {
	# FIXME: proot currently cannot install apt because of https://github.com/proot-me/PRoot/issues/147
	push @chrootcmd, ('proot', '--root-id', '--bind=/dev', "--rootfs=$options->{root}", '--cwd=/');
    } else {
	push @chrootcmd, ('/usr/sbin/chroot', $options->{root});
    }

    # copy qemu-user-static binary into chroot or setup proot with --qemu
    if (defined $options->{qemu}) {
	if ($options->{mode} eq 'proot') {
	    push @chrootcmd, "--qemu=qemu-$options->{qemu}";
	} elsif ($options->{mode} eq 'fakechroot') {
	    # The binfmt support on the outside is used, so qemu needs to know
	    # where it has to look for shared libraries
	    $ENV{QEMU_LD_PREFIX} = $options->{root};
	    # Make sure that the fakeroot and fakechroot shared libraries
	    # exist for the right architecture
	    open my $fh, '-|', 'dpkg-architecture', '-a', $options->{nativearch}, '-qDEB_HOST_MULTIARCH' // die "failed to fork(): $!";
	    chomp (my $deb_host_multiarch = do { local $/; <$fh> });
	    close $fh;
	    if ($? != 0 or !$deb_host_multiarch) {
		die "dpkg-architecture failed: $?";
	    }
	    my $fakechrootdir = "/usr/lib/$deb_host_multiarch/fakechroot";
	    if (!-e "$fakechrootdir/libfakechroot.so") {
		die "$fakechrootdir/libfakechroot.so doesn't exist. Install libfakechroot:$options->{nativearch} outside the chroot";
	    }
	    my $fakerootdir = "/usr/lib/$deb_host_multiarch/libfakeroot";
	    if (!-e "$fakerootdir/libfakeroot-sysv.so") {
		die "$fakerootdir/libfakeroot-sysv.so doesn't exist. Install libfakeroot:$options->{nativearch} outside the chroot";
	    }
	    # fakechroot only fills LD_LIBRARY_PATH with the directories of
	    # the host's architecture. We append the directories of the chroot
	    # architecture.
	    $ENV{LD_LIBRARY_PATH} .= ":$fakechrootdir:$fakerootdir";
	} else {
	    # other modes require a static qemu-user binary
	    my $qemubin = "/usr/bin/qemu-$options->{qemu}-static";
	    if (!-e $qemubin) {
		die "cannot find $qemubin";
	    }
	    copy $qemubin, "$options->{root}/$qemubin" or die "cannot copy $qemubin: $!";
	}
    }

    if ($options->{havemknod}) {
	foreach my $file (@devfiles) {
	    my ($fname, $mode, $type, $linkname, $devmajor, $devminor) = @{$file};
	    next if $fname eq './dev/';
	    if ($type == 0) { # normal file
		die "type 0 not implemented";
	    } elsif ($type == 1) { # hardlink
		die "type 1 not implemented";
	    } elsif ($type == 2) { # symlink
		# nothing to do
		next;
	    } elsif ($type == 3) { # character special
		0 == system('mknod', "$options->{root}/$fname", 'c', $devmajor, $devminor) or die "mknod failed: $?";
	    } elsif ($type == 4) { # block special
		0 == system('mknod', "$options->{root}/$fname", 'b', $devmajor, $devminor) or die "mknod failed: $?";
	    } elsif ($type == 5) { # directory
		make_path "$options->{root}/$fname", { error => \my $err };
		if (@$err) {
		    die "cannot create $fname";
		}
	    } else {
		die "unsupported type: $type";
	    }
	    chmod $mode, "$options->{root}/$fname" or die "cannot chmod $fname: $!";
	}
    }

    # install the extracted packages properly
    # we need --force-depends because dpkg does not take Pre-Depends into
    # account and thus doesn't install them in the right order
    print STDERR "I: installing packages...\n";
    run_dpkg_progress [@essential_pkgs], @chrootcmd, 'dpkg', '--install', '--force-depends';

    # if the path-excluded option was added to the dpkg config, reinstall all
    # packages
    if (-e "$options->{root}/etc/dpkg/dpkg.cfg.d/99mmdebstrap") {
	open(my $fh, '<', "$options->{root}/etc/dpkg/dpkg.cfg.d/99mmdebstrap") or die "cannot open /etc/dpkg/dpkg.cfg.d/99mmdebstrap: $!";
	my $num_matches = grep /^path-exclude=/, <$fh>;
	close $fh;
	if ($num_matches > 0) {
	    # without --skip-same-version, dpkg will install the given
	    # packages even though they are already installed
	    print STDERR "I: re-installing packages because of path-exclude...\n";
	    run_dpkg_progress [@essential_pkgs], @chrootcmd, 'dpkg', '--install';
	}
    }

    foreach my $deb (@essential_pkgs) {
	unlink "$options->{root}/$deb" or die "cannot unlink $deb";
    }

    if (%pkgs_to_install) {
	# some packages have to be installed from the outside before anything
	# can be installed from the inside.
	#
	# we do not need to install any *-archive-keyring packages inside the
	# chroot prior to installing the packages, because the keyring is only
	# used when doing "apt-get update" and that was already done at the
	# beginning using key material from the outside. Since the apt cache
	# is already filled and we are not calling "apt-get update" again, the
	# keyring can be installed later during installation. But: if it's not
	# installed during installation, then we might end up with a fully
	# installed system without keyrings that are valid for its
	# sources.list.
	my %pkgs_to_install_from_outside;

	# install apt if necessary
	if ($options->{variant} ne 'apt') {
	    $pkgs_to_install_from_outside{apt} = ();
	}

	# since apt will be run inside the chroot, make sure that
	# apt-transport-https and ca-certificates gets installed first if any
	# mirror is a https URI
	open(my $pipe_apt, '-|', 'apt-get', 'indextargets', '--format', '$(URI)', 'Created-By: Packages') or die "cannot start apt-get indextargets: $!";
	while (my $uri = <$pipe_apt>) {
	    if ($uri =~ /^https:\/\//) {
		# FIXME: support for https is part of apt >= 1.5
		$pkgs_to_install_from_outside{'apt-transport-https'} = ();
		$pkgs_to_install_from_outside{'ca-certificates'} = ();
		last;
	    } elsif ($uri =~ /^tor(\+[a-z]+)*:\/\//) {
		# tor URIs can be tor+http://, tor+https:// or even
		# tor+mirror+file://
		$pkgs_to_install_from_outside{'apt-transport-tor'} = ();
		last;
	    }
	}
	close $pipe_apt;
	$? == 0 or die "apt-get indextargets failed";

	if (%pkgs_to_install_from_outside) {
	    print STDERR 'I: downloading ' . (join ', ', keys %pkgs_to_install_from_outside) . "...\n";
	    run_apt_progress 'apt-get', '--yes', 'install', (keys %pkgs_to_install_from_outside);
	    my @debs_to_install;
	    my $apt_archives = "/var/cache/apt/archives/";
	    opendir my $dh, "$options->{root}/$apt_archives" or die "cannot read $apt_archives";
	    while (my $deb = readdir $dh) {
		if ($deb !~ /\.deb$/) {
		    next;
		}
		$deb = "$apt_archives/$deb";
		if (!-f "$options->{root}/$deb") {
		    next;
		}
		push @debs_to_install, $deb;
	    }
	    close $dh;
	    if (scalar @debs_to_install == 0) {
		die "nothing got downloaded";
	    }
	    # we need --force-depends because dpkg does not take Pre-Depends
	    # into account and thus doesn't install them in the right order
	    print STDERR 'I: installing ' . (join ', ', keys %pkgs_to_install_from_outside) . "...\n";
	    run_dpkg_progress [@debs_to_install], @chrootcmd, 'dpkg',  '--install', '--force-depends';
	    foreach my $deb (@debs_to_install) {
		unlink "$options->{root}/$deb" or die "cannot unlink $deb";
	    }
	}

	# if more than essential should be installed, make the system look
	# more like a real one by creating or bind-mounting the device nodes
	foreach my $file (@devfiles) {
	    my ($fname, $mode, $type, $linkname, $devmajor, $devminor) = @{$file};
	    next if $fname eq './dev/';
	    if ($type == 0) { # normal file
		die "type 0 not implemented";
	    } elsif ($type == 1) { # hardlink
		die "type 1 not implemented";
	    } elsif ($type == 2) { # symlink
		symlink $linkname, "$options->{root}/$fname";
	    } elsif ($type == 3 or $type == 4) { # character/block special
		if (!$options->{havemknod}) {
		    open my $fh, '>', "$options->{root}/$fname" or die "cannot open $options->{root}/$fname: $!";
		    close $fh;
		    0 == system('mount', '-o', 'bind', "/$fname", "$options->{root}/$fname") or die "mount failed: $?";
		}
	    } elsif ($type == 5) { # directory
		if (!$options->{havemknod}) {
		    make_path "$options->{root}/$fname";
		    chmod $mode, "$options->{root}/$fname" or die "cannot chmod $fname: $!";
		}
		0 == system('mount', '-o', 'bind', "/$fname", "$options->{root}/$fname") or die "mount failed: $?";
	    } else {
		die "unsupported type: $type";
	    }
	}
	# We can only mount /proc and /sys after extracting the essential
	# set because if we mount it before, then base-files will not be able
	# to extract those
	if ($options->{mode} eq 'unshare') {
	    # without the network namespace unshared, we cannot mount a new
	    # sysfs. Since we need network, we just bind-mount.
	    #
	    # we have to rbind because just using bind results in "wrong fs
	    # type, bad option, bad superblock" error
	    0 == system('mount', '-o', 'rbind', '/sys', "$options->{root}/sys") or die "mount failed: $?";
	} else {
	    0 == system('mount', '-t', 'sysfs', '-o', 'nosuid,nodev,noexec', 'sys', "$options->{root}/sys") or die "mount failed: $?";
	}
	0 == system('mount', '-t', 'proc', 'proc', "$options->{root}/proc") or die "mount failed: $?";

	# prevent daemons from starting
	{
	    open my $fh, '>', "$options->{root}/usr/sbin/policy-rc.d" or die "cannot open policy-rc.d: $!";
	    print $fh "#!/bin/sh\n";
	    print $fh "exit 101\n";
	    close $fh;
	    chmod 0755, "$options->{root}/usr/sbin/policy-rc.d" or die "cannot chmod policy-rc.d: $!";
	}

	{
	    move("$options->{root}/sbin/start-stop-daemon", "$options->{root}/sbin/start-stop-daemon.REAL") or die "cannot move start-stop-daemon";
	    open my $fh, '>', "$options->{root}/sbin/start-stop-daemon" or die "cannot open policy-rc.d: $!";
	    print $fh "#!/bin/sh\n";
	    print $fh "echo \"Warning: Fake start-stop-daemon called, doing nothing\">&2\n";
	    close $fh;
	    chmod 0755, "$options->{root}/sbin/start-stop-daemon" or die "cannot chmod start-stop-daemon: $!";
	}

	# allow network access from within
	copy("/etc/resolv.conf", "$options->{root}/etc/resolv.conf") or die "cannot copy /etc/resolv.conf: $!";
	copy("/etc/hostname", "$options->{root}/etc/hostname") or die "cannot copy /etc/hostname: $!";

	print STDERR "I: installing remaining packages inside the chroot...\n";
	run_apt_progress @chrootcmd, 'apt-get',  '--yes', 'install', keys %pkgs_to_install;

	# cleanup
	move("$options->{root}/sbin/start-stop-daemon.REAL", "$options->{root}/sbin/start-stop-daemon") or die "cannot move start-stop-daemon";
	unlink "$options->{root}/usr/sbin/policy-rc.d" or die "cannot unlink policy-rc.d";

	foreach my $file (@devfiles) {
	    my ($fname, undef, $type, $linkname, undef, undef) = @{$file};
	    next if $fname eq './dev/';
	    if ($type == 0) { # normal file
		die "type 0 not implemented";
	    } elsif ($type == 1) { # hardlink
		die "type 1 not implemented";
	    } elsif ($type == 2) { # symlink
		unlink "$options->{root}/$fname" or die "cannot unlink $fname: $!";
	    } elsif ($type == 3 or $type == 4) { # character/block special
		if (!$options->{havemknod}) {
		    if ($options->{mode} eq 'unshare') {
			0 == system('umount', '--no-mtab', "$options->{root}/$fname") or die "umount failed: $?";
		    } else {
			0 == system('umount', "$options->{root}/$fname") or die "umount failed: $?";
		    }
		    unlink "$options->{root}/$fname";
		}
	    } elsif ($type == 5) { # directory
		if ($options->{mode} eq 'unshare') {
		    0 == system('umount', '--no-mtab', "$options->{root}/$fname") or die "umount failed: $?";
		} else {
		    0 == system('umount', "$options->{root}/$fname") or die "umount failed: $?";
		}
		if (!$options->{havemknod}) {
		    rmdir "$options->{root}/$fname" or die "cannot rmdir $fname: $!";
		}
	    } else {
		die "unsupported type: $type";
	    }
	}
	# no need to umount if the mount namespace was unshared
	if ($options->{mode} ne 'unshare') {
	    0 == system('umount', '--no-mtab', "$options->{root}/sys") or die "umount failed: $?";
	    0 == system('umount', '--no-mtab', "$options->{root}/proc") or die "umount failed: $?";
	}
    }

    # clean up temporary configuration file
    unlink "$options->{root}/etc/apt/apt.conf.d/00mmdebstrap" or die "failed to unlink /etc/apt/apt.conf.d/00mmdebstrap: $!";

    # apt since 1.6 creates the auxfiles directory. If apt inside the chroot
    # is older than that, then it will not know how to clean it.
    rmdir "$options->{root}/var/lib/apt/lists/auxfiles" or die "cannot rmdir /var/lib/apt/lists/auxfiles: $!";
    # if there is no apt inside the chroot, clean it from the outside
    print STDERR "I: cleaning package lists and apt cache...\n";
    if ($options->{variant} eq 'essential') {
	run_apt_progress 'apt-get', '--option', 'Dir::Etc::SourceList=/dev/null', 'update';
	run_apt_progress 'apt-get', 'clean';
    } else {
	run_apt_progress @chrootcmd, 'apt-get', '--option', 'Dir::Etc::SourceList=/dev/null', 'update';
	run_apt_progress @chrootcmd, 'apt-get', 'clean';
    }

    if (defined $options->{qemu} and $options->{mode} ne 'proot' and $options->{mode} ne 'fakechroot') {
	unlink "$options->{root}/usr/bin/qemu-$options->{qemu}-static" or die "cannot unlink /usr/bin/qemu-$options->{qemu}-static";
    }

    # clean up certain files to make output reproducible
    unlink "$options->{root}/var/log/dpkg.log";
    unlink "$options->{root}/var/log/apt/history.log";
    unlink "$options->{root}/var/log/apt/term.log";
    unlink "$options->{root}/var/log/alternatives.log";
    unlink "$options->{root}/var/cache/ldconfig/aux-cache";

    # clean up leftover lock files
    unlink "$options->{root}/var/cache/apt/archives/lock";
    unlink "$options->{root}/var/lib/apt/extended_states";
    unlink "$options->{root}/var/lib/apt/lists/lock";
    unlink "$options->{root}/var/lib/dpkg/lock-frontend";
    unlink "$options->{root}/var/lib/dpkg/lock";
}

sub main() {
    umask 022;

    my $mtime = time;
    if (exists $ENV{SOURCE_DATE_EPOCH}) {
	$mtime = $ENV{SOURCE_DATE_EPOCH}+0;
    }

    $ENV{DEBIAN_FRONTEND} = 'noninteractive';
    $ENV{DEBCONF_NONINTERACTIVE_SEEN} = 'true';
    $ENV{LC_ALL} = 'C.UTF-8';
    $ENV{LANGUAGE} = 'C.UTF-8';
    $ENV{LANG} = 'C.UTF-8';

    # copy ARGV because getopt modifies it
    my @ARGVORIG = @ARGV;

    my $options = {
	components => "main",
	variant => "important",
	include => undef,
	mode => 'auto',
	dpkgopts => [],
	aptopts => [],
    };
    chomp ($options->{architectures} = `dpkg --print-architecture`);
    Getopt::Long::Configure ("bundling");
    GetOptions(
	'h|help'   => sub { pod2usage(-exitval => 0, -verbose => 2) },
	'components=s' => \$options->{components},
	'variant=s' => \$options->{variant},
	'include=s' => \$options->{include},
	'architectures=s' => \$options->{architectures},
	'mode=s' => \$options->{mode},
	'dpkgopt=s@' => \$options->{dpkgopts},
	'aptopt=s@' => \$options->{aptopts},
    ) or pod2usage(-exitval => 2, -verbose => 1);

    my @valid_variants = ('essential', 'apt', 'required', 'minbase', 'buildd',
	'important', 'debootstrap', '-', 'standard');
    if (none { $_ eq $options->{variant}} @valid_variants) {
	die "invalid variant. Choose from " . (join ', ', @valid_variants);
    }
    # debootstrap and - are an alias for important
    if (any { $_ eq $options->{variant} } ('-', 'debootstrap')) {
	$options->{variant} = 'important';
    }

    # fakeroot is an alias for fakechroot
    if ($options->{mode} eq 'fakeroot') {
	$options->{mode} = 'fakechroot';
    }
    # sudo is an alias for root
    if ($options->{mode} eq 'sudo') {
	$options->{mode} = 'root';
    }
    my @valid_modes = ('auto', 'root', 'unshare', 'fakechroot', 'proot');
    if (none { $_ eq $options->{mode} } @valid_modes) {
	die "invalid mode. Choose from " . (join ', ', @valid_modes);
    }

    if ($options->{variant} eq 'essential' and defined $options->{include}) {
	die "cannot install extra packages in essential and required variants because apt is missing";
    }

    my ($nativearch, @foreignarchs) = split /,/, $options->{architectures};
    $options->{nativearch} = $nativearch;
    $options->{foreignarchs} = \@foreignarchs;

    {
	# FIXME: autogenerate this list
	my $deb2qemu = {
	    alpha => 'alpha',
	    amd64 => 'x86_64',
	    arm => 'arm',
	    arm64 => 'aarch64',
	    armel => 'arm',
	    armhf => 'arm',
	    hppa => 'hppa',
	    i386 => 'i386',
	    m68k => 'm68k',
	    mips => 'mips',
	    mips64 => 'mips64',
	    mips64el => 'mips64el',
	    mipsel => 'mipsel',
	    powerpc => 'ppc',
	    ppc64 => 'ppc64',
	    ppc64el => 'ppc64le',
	    riscv64 => 'riscv64',
	    s390x => 's390x',
	    sh4 => 'sh4',
	    sparc => 'sparc',
	    sparc64 => 'sparc64',
	};
	chomp (my $hostarch = `dpkg --print-architecture`);
	if ($hostarch ne $nativearch) {
	    my $pid = open my $fh, '-|' // die "failed to fork(): $!";
	    if ($pid == 0) {
		{
		    no warnings; # don't print a warning if the following fails
		    exec 'arch-test', '-n', $nativearch;
		}
		# if exec didn't work (for example because the arch-test program is
		# missing) prepare for the worst and assume that the architecture
		# cannot be executed
		print "$nativearch: not supported on this machine/kernel\n";
		exit 1;
	    }
	    chomp (my $content = do { local $/; <$fh> });
	    close $fh;
	    if ($? != 0 or $content ne "$nativearch: ok") {
		print STDERR "I: $nativearch cannot be executed, falling back to qemu-user\n";
		if (!exists $deb2qemu->{$nativearch}) {
		    die "no mapping from $nativearch to qemu-user binary";
		}
		$options->{qemu} = $deb2qemu->{$nativearch};
	    } else {
		print STDERR "I: $nativearch can be executed on this $hostarch machine\n";
	    }
	} else {
	    print STDERR "I: chroot architecture $nativearch is equal to the host's architecture\n";
	}
    }

    {
	my $suite;
	if (scalar @ARGV > 0) {
	    $suite = shift @ARGV;
	    if (scalar @ARGV > 0) {
		$options->{target} = shift @ARGV;
	    } else {
		$options->{target} = '-';
	    }
	} else {
	    print STDERR "I: No SUITE specified, expecting sources.list on standard input\n";
	    $options->{target} = '-';
	}

	my $sourceslist = '';
	my $stdindata = '';
	# make sure that we only attempt to read from STDIN if it's *not*
	# connected to the terminal (because we don't expect the user to type
	# the sources.list file
	if (! -t STDIN) {
	    print STDERR "I: Reading sources.list from standard input...\n";
	    $stdindata = do { local $/; <STDIN> };
	}
	if (! defined $suite) {
	    # If no suite was specified, then the whole sources.list has to
	    # come from standard input
	    $sourceslist .= $stdindata;
	} else {
	    my $archopt = '';
	    if (scalar @{$options->{foreignarchs}} > 0) {
		$archopt = " [arch=$options->{nativearch}]";
	    }
	    if (scalar @ARGV > 0) {
		for my $arg (@ARGV) {
		    if ($arg eq '-') {
			$sourceslist .= $stdindata;
		    } elsif ($arg =~ /^deb(-src)? /) {
			$sourceslist .= "$arg\n";
		    } elsif ($arg =~ /:\/\//) {
			$sourceslist .= "deb$archopt $arg $suite $options->{components}\n";
		    } elsif (-f $arg) {
			open my $fh, '<', $arg or die "cannot open $arg: $!";
			while (my $line = <$fh>) {
			    $sourceslist .= $line;
			}
			close $fh;
		    } else {
			die "invalid mirror: $arg";
		    }
		}
		# if there was no explicit '-' mirror listed and something was
		# read on standard input, then just append it to the end
		if (none { $_ eq '-' } @ARGV) {
		    # if nothing was read on standard input then nothing will
		    # be appended
		    $sourceslist .= $stdindata;
		}
	    } elsif ($stdindata ne '') {
		$sourceslist .= $stdindata;
	    } else {
		$sourceslist .= "deb$archopt http://deb.debian.org/debian $suite $options->{components}\n";
		if (any { $_ eq $suite } ('stable', 'oldstable', 'stretch') ) {
		    $sourceslist .= "deb$archopt http://deb.debian.org/debian $suite-updates $options->{components}\n";
		    $sourceslist .= "deb$archopt http://security.debian.org/debian-security $suite/updates $options->{components}\n";
		}
	    }
	}
	if ($sourceslist eq '') {
	    die "empty apt sources.list";
	}
	$options->{sourceslist} = $sourceslist;
    }

    if ($options->{target} ne '-') {
	my $abs_path = abs_path($options->{target});
	if (!defined $abs_path) {
	    die "unable to get absolute path of target directory $options->{target}";
	}
	$options->{target} = $abs_path;
    }

    if ($options->{target} eq '/') {
	die "refusing to use the filesystem root as output directory";
    }

    # figure out the mode to use or test whether the chosen mode is legal
    if ($options->{mode} eq 'auto') {
	if ($EFFECTIVE_USER_ID == 0) {
	    $options->{mode} = 'root';
	} elsif (test_unshare()) {
	    $options->{mode} = 'unshare';
	} elsif (system('proot --version>/dev/null') == 0) {
	    $options->{mode} = 'proot';
	} elsif (system('fakechroot --version>/dev/null') == 0) {
	    $options->{mode} = 'fakechroot';
	} else {
	    die "unable to pick chroot mode automatically";
	}
	print STDERR "I: automatically chosen mode: $options->{mode}\n";
    } elsif ($options->{mode} eq 'root') {
	if ($EFFECTIVE_USER_ID != 0) {
	    die "need to be root";
	}
    } elsif ($options->{mode} eq 'proot') {
	if (system('proot --version>/dev/null') != 0) {
	    die "need working proot binary";
	}
    } elsif ($options->{mode} eq 'fakechroot') {
	# test if we are inside fakechroot already
	# We fork a child process because setting FAKECHROOT_DETECT seems to
	# be an irreversible operation for fakechroot.
	my $pid = open my $rfh, '-|' // die "failed to fork(): $!";
	if ($pid == 0) {
	    # with the FAKECHROOT_DETECT environment variable set, any program
	    # execution will be replaced with the output "fakeroot [version]"
	    $ENV{FAKECHROOT_DETECT} = 0;
	    exec 'echo', 'If fakechroot is running, this will not be printed';
	}
	my $content = do { local $/; <$rfh> };
	waitpid $pid, 0;
	if ($? == 0 and $content =~ /^fakechroot \d\.\d+$/) {
	    # fakechroot is already running
	} elsif (system('fakechroot --version>/dev/null') != 0) {
	    die "need working fakechroot binary";
	} else {
	    # exec ourselves again but within fakechroot
	    exec 'fakechroot', 'fakeroot', $PROGRAM_NAME, @ARGVORIG;
	}
    } elsif ($options->{mode} eq 'unshare') {
	if (!test_unshare()) {
	    if ($EFFECTIVE_USER_ID == 0) {
		print STDERR "I: cannot use unshare mode when executing as root\n";
	    }
	    system "newuidmap 2>/dev/null";
	    if (($? >> 8) != 1) {
		if (($? >> 8) == 127) {
		    print STDERR "I: cannot find newuidmap\n";
		} else {
		    print STDERR "I: newuidmap returned unknown exit status\n";
		}
	    }
	    system "newgidmap 2>/dev/null";
	    if (($? >> 8) != 1) {
		if (($? >> 8) == 127) {
		    print STDERR "I: cannot find newgidmap\n";
		} else {
		    print STDERR "I: newgidmap returned unknown exit status\n";
		}
	    }
	    my $procfile = '/proc/sys/kernel/unprivileged_userns_clone';
	    open(my $fh, '<', $procfile) or die "failed to open $procfile: $!";
	    chomp(my $content = do { local $/; <$fh> });
	    close($fh);
	    if ($content ne "1") {
		print STDERR "I: /proc/sys/kernel/unprivileged_userns_clone is set to $content\n";
		print STDERR "I: try running: sudo sysctl -w kernel.unprivileged_userns_clone=1\n";
		print STDERR "I: or permanently enable unprivileged usernamespaces by putting the setting into /etc/sysctl.d/\n";
	    }
	    exit 1;
	}
    } else {
	die "unknown mode: $options->{mode}";
    }

    my @tar_compress_opts = get_tar_compress_options($options->{target});

    # figure out whether a tarball has to be created in the end
    $options->{maketar} = 0;
    if (scalar @tar_compress_opts > 0 or $options->{target} =~ /\.tar$/ or $options->{target} eq '-') {
	$options->{maketar} = 1;
    }

    if ($options->{maketar}) {
	# since the output is a tarball, we create the rootfs in a temporary
	# directory
	$options->{root} = tempdir();
	# in unshare and root mode, other users than the current user need to
	# access the rootfs, most prominently, the _apt user. Thus, make the
	# temporary directory world readable.
	if (any { $_ eq $options->{mode} } ('unshare', 'root')) {
	    chmod 0755, $options->{root} or die "cannot chmod root: $!";
	}
    } else {
	# user does not seem to have specified a tarball as output, thus work
	# directly in the supplied directory
	$options->{root} = $options->{target};
	if (-e $options->{root}) {
	    if (!-d $options->{root}) {
		die "$options->{root} exists and is not a directory";
	    }
	    opendir(my $dh, $options->{root}) or die "Can't opendir($options->{root}): $!";
	    # Attempt reading the directory thrice. If the third time succeeds,
	    # then it has more entries than just "." and ".." and must thus not
	    # be empty.
	    readdir $dh;
	    readdir $dh;
	    # rationale for requiring an empty directory: https://bugs.debian.org/833525
	    die "$options->{root} is not empty" if (readdir $dh);
	} else {
	    make_path($options->{root}) or die "cannot create root: $!";
	}
    }

    my @idmap;
    # for unshare mode the rootfs directory has to have appropriate
    # permissions
    if ($options->{mode} eq 'unshare') {
	@idmap = read_subuid_subgid;
	# sanity check
	if (scalar(@idmap) != 2 || $idmap[0][0] ne 'u' || $idmap[1][0] ne 'g') {
	    printf STDERR "invalid idmap\n";
	    return 0;
	}

	my $outer_gid = $REAL_GROUP_ID+0;

	my $pid = get_unshare_cmd { chown 1, 1, $options->{root} }
	[
	    ['u', '0', $REAL_USER_ID, '1'],
	    ['g', '0', $outer_gid, '1'],
	    ['u', '1', $idmap[0][2], '1'],
	    ['g', '1', $idmap[1][2], '1']];
	waitpid $pid, 0;
	$? == 0 or die "chown failed";
    }

    # figure out whether we have mknod
    $options->{havemknod} = 0;
    if ($options->{mode} eq 'unshare') {
	my $pid = get_unshare_cmd {
	    $options->{havemknod} = havemknod($options->{root});
	} \@idmap;
	waitpid $pid, 0;
	$? == 0 or die "havemknod failed";
    } else {
	$options->{havemknod} = havemknod($options->{root});
    }

    my $devtar = '';
    # without real device nodes having been created, we manually craft the
    # right entries for the final tarball
    if ($options->{maketar} and not $options->{havemknod}) {
	foreach my $file (@devfiles) {
	    my ($fname, $mode, $type, $linkname, $devmajor, $devminor) = @{$file};
	    my $entry = pack('a100 a8 a8 a8 a12 a12 A8 a1 a100 a8 a32 a32 a8 a8 a155 x12',
		$fname,
		sprintf('%07o', $mode),
		sprintf('%07o', 0), # uid
		sprintf('%07o', 0), # gid
		sprintf('%011o', 0), # size
		sprintf('%011o', $mtime),
		'', # checksum
		$type,
		$linkname,
		"ustar  ",
		'', # username
		'', # groupname
		defined($devmajor) ? sprintf('%07o', $devmajor) : '',
		defined($devminor) ? sprintf('%07o', $devminor) : '',
		'', # prefix
	    );
	    # compute and insert checksum
	    substr($entry,148,7) = sprintf("%06o\0", unpack("%16C*",$entry));
	    $devtar .= $entry;
	}
    }

    my $exitstatus = 0;
    my @taropts = ('--sort=name', "--mtime=\@$mtime", '--clamp-mtime', '--numeric-owner', '--one-file-system', '-c');
    push @taropts, @tar_compress_opts;
    my $pid;
    pipe my $rfh, my $wfh;
    if ($options->{mode} eq 'unshare') {
	$pid = get_unshare_cmd {
	    close $rfh;
	    open(STDOUT, '>&', STDERR);

	    setup($options);

	    if ($options->{maketar}) {
		print STDERR "I: creating tarball...\n";

		# redirect tar output to the writing end of the pipe so that the
		# parent process can capture the output
		open(STDOUT, '>&', $wfh);

		# Add ./dev as the first entries of the tar file.
		# We cannot add them after calling tar, because there is no way to
		# prevent tar from writing NULL entries at the end.
		print $devtar;

		# pack everything except ./dev
		0 == system('tar', @taropts, '--exclude=./dev', '-C', $options->{root}, '.') or die "tar failed: $?";

		print STDERR "done\n";
	    }

	    exit 0;
	} \@idmap;
    } else {
	$pid = fork() // die "fork() failed: $!";
	if ($pid == 0) {
	    close $rfh;
	    open(STDOUT, '>&', STDERR);

	    setup($options);

	    if ($options->{maketar}) {
		print STDERR "I: creating tarball...\n";

		# redirect tar output to the writing end of the pipe so that the
		# parent process can capture the output
		open(STDOUT, '>&', $wfh);

		# Add ./dev as the first entries of the tar file.
		# We cannot add them after calling tar, because there is no way to
		# prevent tar from writing NULL entries at the end.
		print $devtar;

		if ($options->{mode} eq 'fakechroot') {
		    # Fakechroot requires tar to run inside the chroot or
		    # otherwise absolute symlinks will include the path to the
		    # root directory
		    0 == system('/usr/sbin/chroot', $options->{root}, 'tar', @taropts, '-C', '/', '.') or die "tar failed: $?";
		} elsif ($options->{mode} eq 'proot') {
		    # proot requires tar to run inside proot or otherwise
		    # permissions will be completely off
		    0 == system('proot', '--root-id', "--rootfs=$options->{root}", 'tar', @taropts, '-C', '/', '.') or die "tar failed: $?";
		} else {
		    0 == system('tar', @taropts, '-C', $options->{root}, '.') or die "tar failed: $?";
		}

		print STDERR "done\n";
	    }

	    exit 0;
	}
    }

    close $wfh;
    if ($options->{maketar}) {
	if ($options->{target} ne '-') {
	    copy($rfh, $options->{target}) or die "cannot copy to $options->{target}: $!";
	} else {
	    copy($rfh, *STDOUT) or die "cannot copy to standard output: $!";
	}
    }
    close($rfh);
    waitpid $pid, 0;
    if ($? != 0) {
	$exitstatus = 1;
    }

    if ($options->{maketar} and -e $options->{root}) {
	if ($options->{mode} eq 'unshare') {
	    # We don't have permissions to remove the directory outside
	    # the unshared namespace, so we remove it here.
	    # Since this is still inside the unshared namespace, there is
	    # no risk of removing anything important.
	    $pid = get_unshare_cmd {
		remove_tree($options->{root}, {error => \my $err});
		if (@$err) {
		    for my $diag (@$err) {
			my ($file, $message) = %$diag;
			if ($file eq '') {
			    print "general error: $message\n";
			}
			else {
			    print "problem unlinking $file: $message\n";
			}
		    }
		}
	    } \@idmap;
	    waitpid $pid, 0;
	    $? == 0 or die "remove_tree failed";
	} else {
	    # without unshare, we use the system's rm to recursively remove the
	    # temporary directory just to make sure that we do not accidentally
	    # remove more than we should by using --one-file-system.
	    0 == system('rm', '--recursive', '--preserve-root', '--one-file-system', $options->{root}) or die "rm failed: $!";
	}
    }

    exit $exitstatus;
}

main();

__END__

=head1 NAME

mmdebstrap - multi-mirror Debian chroot creation

=head1 SYNOPSIS

B<mmdebstrap> [B<OPTION...>] [I<SUITE> [I<TARGET> [I<MIRROR>...]]]

=head1 DESCRIPTION

B<mmdebstrap> creates a Debian chroot of I<SUITE> into I<TARGET> from one or
more I<MIRROR>s. It is meant as an alternative to the debootstrap tool (see
section B<DEBOOTSTRAP>). In contrast to debootstrap it uses apt to resolve
dependencies and is thus able to use more than one mirror and resolve more
complex dependencies.

If no I<MIRROR> option is provided, http://deb.debian.org/debian is used,
except if data was given on standard input in which case the lines read from
there are used as the content of the chroot's sources.list file. If
I<SUITE> is a stable release name, then mirrors for updates and security are
automatically added. If a I<MIRROR> option starts with "deb " or "deb-src "
then it is used as a one-line-style format entry for apt's sources.list inside
the chroot.  If a I<MIRROR> option contains a "://" then it is interpreted as
a mirror URI and the apt line inside the chroot is assembled as "deb [arch=A]
B C D" where A is the host's native architecture, B is the I<MIRROR>, C is the
given I<SUITE> and D is the components given via --components (defaults to
"main"). If a I<MIRROR> option happens to be an existing file, then its
contents are pasted into the chroot's sources.list.  This can be used to
supply a deb822 style sources.list. If I<MIRROR> is C<-> then standard input
is pasted into the chroot's sources.list. If there was data on standard input
but no C<-> mirror was listed, the lines read from standard input will be
appended to the end of the chroot's sources.list. More than one mirror can be
specified and are appended to the chroot's sources.list in the given order. If
any mirror contains a https URI, then the packages apt-transport-https and
ca-certificates will be installed inside the chroot.

The I<TARGET> argument can either be a directory or a tarball filename. If
I<TARGET> is a directory, then it must not exist beforehand. A tarball
filename is detected by the filename extension of I<TARGET>. Choosing a
directory only makes sense with the B<sudo> mode because otherwise the
contents of the chroot will not be owned by the superuser. If no I<TARGET> was
specified or if I<TARGET> is C<->, then a tarball of the chroot is written to
standard output.

The I<SUITE> may be a valid release code name (eg, sid, stretch, jessie) or a
symbolic name (eg, unstable, testing, stable, oldstable). Any suite name that
works with apt on the given mirror will work. If no I<SUITE> was specified,
then a single I<MIRROR> C<-> is added and thus the information of the desired
suite has to come from standard input as part of a valid apt sources.list
file.

=head1 OPTIONS

=over 8

=item B<-h,--help>

Print this help text and exit.

=item B<--variant>

Choose which package set to install. Valid variant names are B<essential>,
B<apt>, B<required>, B<minbase>, B<buildd>, B<important>, B<debootstrap>,
B<->, and B<standard>. The default variant is B<required>. See the section
B<VARIANTS> for more information.

=item B<--mode>

Choose how to perform the chroot operation and create a filesystem with
ownership information different from the current user. Valid modes are B<auto>,
B<sudo>, B<root>, B<unshare>, B<fakeroot>, B<fakechroot> and B<proot>. The
default mode is B<auto>. See the section B<MODES> for more information.

=item B<--aptopt>

Pass arbitrary options to apt. Will be added to
/etc/apt/apt.conf.d/99mmdebstrap inside the chroot.  Can be specified multiple
times. Each option with be appended to 99mmdebstrap. A semicolon will be added
at the end of the option if necessary. If the command line argument is an
existing file, the content of the file will be appended to 99mmdebstrap
verbatim.

Examples:

    --aptopt="Acquire::Check-Valid-Until false"
    --aptopt="Acquire::Languages { \"environment\"; \"en\"; }"
    --aptopt="Apt::Install-Recommends true"

=item B<--dpkgopt>

Pass arbitrary options to dpkg. Will be added to
/etc/dpkg/dpkg.cfg.d/99mmdebstrap inside the chroot. Can be specified multiple
times. Each option will be appended to 99mmdebstrap. If the command line
argument is an existing file, the content of the file will be appended to
99mmdebstrap verbatim.

Example: --dpkgopt="path-exclude=/usr/share/man/*"

=item B<--include>

Comma separated list of packages which will be installed in addition to the
packages installed by the specified variant. This option is incompatible with
the essential variant because apt inside the chroot is needed to install extra
packages.

=item B<--components>

Comma separated list of components like main, contrib and non-free.

=item B<--architectures>

Comma separated list of architectures. The first architecture is the native
architecture inside the chroot. The remaining architectures will be added to
the foreign architectures. This defaults to the native architecture of the
system running this program.

=back

=head1 MODES

Creating a Debian chroot requires not only permissions for running chroot but
also the ability to create files owned by the superuser. The selected mode
decides which way this is achieved.

=over 8

=item B<auto>

This mode automatically selects a fitting mode. If the effective user id is the
one of the superuser, then the B<sudo> mode is chosen. Otherwise, the
B<unshare> mode is picked if the system has the sysctl
C<kernel.unprivileged_userns_clone> set to C<1>. Should that not be the case
and if the proot binary exists, the B<proot> mode is chosen. Lastly, the
B<fakechroot> is used if the fakechroot binary exists.

=item B<sudo>, B<root>

This mode directly executes chroot and is the same mode of operation as is used
by debootstrap. It is the only mode that can directly create a directory chroot
with the right permissions.

=item B<unshare>

This mode uses Linux user namespaces to allow unpriviliged use of chroot and
creation of files that appear to be owned by the superuser inside the unshared
namespace. A directory chroot created with this mode will end up with wrong
permissions. Choose to create a tarball instead.

=item B<fakeroot>, B<fakechroot>

This mode will exec this program again under C<fakechroot fakeroot>. A
directory chroot created with this mode will end up with wrong permissions.
Choose to create a tarball instead.

=item B<proot>

This mode will carry out all calls to chroot with proot instead. Since
permissions are only retained while proot is still running, this will lead to
wrong permissions in the final directory and tarball. This mode is useful if
you plan to use the chroot with proot.

=back

=head1 VARIANTS

All package sets also include the hard dependencies (but not recommends) of
the selected package sets. The variants B<minbase>, B<buildd> and B<->,
resemble the package sets that debootstrap would install with the same
I<--variant> argument.

=over 8

=item B<essential>

Essential:yes packages.

=item B<apt>

The B<essential> set plus apt.

=item B<required>, B<minbase>

The B<essential> set plus all packages with Priority:required and apt.

=item B<buildd>

The B<minbase> set plus build-essential.

=item B<important>, B<debootstrap>, B<->

The B<required> set plus all packages with Priority:important. This is the default of debootstrap.

=item B<standard>

The B<important> set plus all packages with Priority:standard.

=back

=head1 EXAMPLES

Use like debootstrap:

    sudo mmdebstrap unstable ./unstable-chroot

Without superuser privileges:

    mmdebstrap unstable unstable-chroot.tar

With complex apt options:

    mmdebstrap < /etc/apt/sources.list > unstable-chroot.tar

Drop locales (but not the symlink to the locale name alias database),
translated manual packages (but not the untranslated ones), and documentation
(but not copyright and Debian changelog).

    mmdebstrap --variant=essential \
        --dpkgopt='path-exclude=/usr/share/man/*' \
        --dpkgopt='path-include=/usr/share/man/man[1-9]/*' \
        --dpkgopt='path-exclude=/usr/share/locale/*' \
        --dpkgopt='path-include=/usr/share/locale/locale.alias' \
        --dpkgopt='path-exclude=/usr/share/doc/*' \
        --dpkgopt='path-include=/usr/share/doc/*/copyright' \
        --dpkgopt='path-include=/usr/share/doc/*/changelog.Debian.*' \
        unstable debian-unstable.tar

=head1 DEBOOTSTRAP

This section lists some differences to debootstrap.

=over 8

=item * More than one mirror possible

=item * Default mirrors for stable releases include updates and security mirror

=item * Multiple ways to operate as non-root: fakechroot, proot, unshare

=item * 3-6 times faster

=item * Can create a chroot with only Essential:yes packages and their dependencies

=item * Reproducible output by default if $SOURCE_DATE_EPOCH is set

=item * Can create output on filesystems with nodev set

=item * apt cache and lists are cleaned at the end

=item * foreign architecture chroots using qemu-user

=back

Limitations in comparison to debootstrap:

=over 8

=item * Only runs on systems with apt installed

=item * No I<SCRIPT> argument

=item * No I<--second-stage> option.

=back

=head1 SEE ALSO

    debootstrap(8)

=cut