apt/keyring: download 3 keyrings for sid

src/deb/ephemeral.rs

@@ -143,9 +143,9 @@ impl EphemeralContextGuard {
             .arg(lockfile_path.to_string_lossy().to_string())
             .status()?;
 
-        // Download the keyring to the cache directory
-        let keyring_path =
-            crate::apt::keyring::download_cache_keyring(Some(ctx.clone()), series).await?;
+        // Download the keyring(s)
+        let keyring_dir =
+            crate::apt::keyring::download_cache_keyrings(Some(ctx.clone()), series).await?;
 
         // Use mmdebstrap to download the tarball to the cache directory
         let mut cmd = ctx.command("mmdebstrap");
@@ -153,7 +153,13 @@ impl EphemeralContextGuard {
             .arg("--mode=unshare")
             .arg("--include=mount,curl,ca-certificates")
             .arg("--format=tar")
-            .arg(format!("--keyring={}", keyring_path.display()));
+            .arg(format!("--keyring={}", keyring_dir.display()))
+            // Setup hook to copy keyrings into the chroot so apt inside can use them
+            .arg("--setup-hook=mkdir -p \"$1/etc/apt/trusted.gpg.d\"")
+            .arg(format!(
+                "--setup-hook=cp {}/*.gpg \"$1/etc/apt/trusted.gpg.d/\"",
+                keyring_dir.display()
+            ));
 
         // Add architecture if specified
         if let Some(a) = arch {