We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
`RepositoryKeyCheck` is not respected for Deb-based distros
Hey there!

The man page suggests that the `Distribution.RepositoryKeyCheck` configuration option is not used for DNF-based distros yet (which would imply to me that it is used for other distributions). When looking at the code, however, it seems that it is only used for `pacman`, `zypper`, and `dnf` (i.e. DNF-based distros, too). Furthermore, it seems that the input is not respected for Deb-based distros. When trying to build an Ubuntu image without making the public key available to the build environment and with setting the `RepositoryKeyCheck` option to `false`, I receive the following error:

```console
‣  Installing Ubuntu
Get:1 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:2 http://security.ubuntu.com/ubuntu jammy-security InRelease [110 kB]
Err:2 http://security.ubuntu.com/ubuntu jammy-security InRelease   
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
Get:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [119 kB]
Err:1 http://archive.ubuntu.com/ubuntu jammy InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
Err:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
Reading package lists... Done
W: GPG error: http://security.ubuntu.com/ubuntu jammy-security InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
E: The repository 'http://security.ubuntu.com/ubuntu jammy-security InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: GPG error: http://archive.ubuntu.com/ubuntu jammy InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
E: The repository 'http://archive.ubuntu.com/ubuntu jammy InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: GPG error: http://archive.ubuntu.com/ubuntu jammy-updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
E: The repository 'http://archive.ubuntu.com/ubuntu jammy-updates InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
```

When the public key is supplied via `mkosi.skeleton`, the build succeeds.

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `mkosi/installer/apt.py`
Content:
```
1 # SPDX-License-Identifier: LGPL-2.1+
2 import textwrap
3 from collections.abc import Sequence
4 
5 from mkosi.context import Context
6 from mkosi.installer import finalize_package_manager_mounts
7 from mkosi.mounts import finalize_ephemeral_source_mounts
8 from mkosi.run import find_binary, run
9 from mkosi.sandbox import apivfs_cmd
10 from mkosi.types import PathString
11 from mkosi.util import sort_packages, umask
12 
13 
14 def setup_apt(context: Context, repos: Sequence[str]) -> None:
15     (context.pkgmngr / "etc/apt").mkdir(exist_ok=True, parents=True)
16     (context.pkgmngr / "etc/apt/apt.conf.d").mkdir(exist_ok=True, parents=True)
17     (context.pkgmngr / "etc/apt/preferences.d").mkdir(exist_ok=True, parents=True)
18     (context.pkgmngr / "etc/apt/sources.list.d").mkdir(exist_ok=True, parents=True)
19 
20     # TODO: Drop once apt 2.5.4 is widely available.
21     with umask(~0o755):
22         (context.root / "var/lib/dpkg").mkdir(parents=True, exist_ok=True)
23         (context.root / "var/lib/dpkg/status").touch()
24 
25     (context.cache_dir / "lib/apt").mkdir(exist_ok=True, parents=True)
26     (context.cache_dir / "cache/apt").mkdir(exist_ok=True, parents=True)
27 
28     # We have a special apt.conf outside of pkgmngr dir that only configures "Dir::Etc" that we pass to APT_CONFIG to
29     # tell apt it should read config files from /etc/apt in case this is overridden by distributions. This is required
30     # because apt parses CLI configuration options after parsing its configuration files and as such we can't use CLI
31     # options to tell apt where to look for configuration files.
32     config = context.workspace / "apt.conf"
33     if not config.exists():
34         config.write_text(
35             textwrap.dedent(
36                 """\
37                 Dir::Etc "etc/apt";
38                 """
39             )
40         )
41 
42     sources = context.pkgmngr / "etc/apt/sources.list"
43     if not sources.exists():
44         with sources.open("w") as f:
45             for repo in repos:
46                 f.write(f"{repo}\n")
47 
48 
49 def apt_cmd(context: Context, command: str) -> list[PathString]:
50     debarch = context.config.distribution.architecture(context.config.architecture)
51 
52     cmdline: list[PathString] = [
53         "env",
54         f"APT_CONFIG={context.workspace / 'apt.conf'}",
55         "DEBIAN_FRONTEND=noninteractive",
56         "DEBCONF_INTERACTIVE_SEEN=true",
57         "INITRD=No",
58         command,
59         "-o", f"APT::Architecture={debarch}",
60         "-o", f"APT::Architectures={debarch}",
61         "-o", f"APT::Install-Recommends={str(context.config.with_recommends).lower()}",
62         "-o", "APT::Immediate-Configure=off",
63         "-o", "APT::Get::Assume-Yes=true",
64         "-o", "APT::Get::AutomaticRemove=true",
65         "-o", "APT::Get::Allow-Change-Held-Packages=true",
66         "-o", "APT::Get::Allow-Remove-Essential=true",
67         "-o", "APT::Sandbox::User=root",
68         "-o", "Dir::Cache=/var/cache/apt",
69         "-o", "Dir::State=/var/lib/apt",
70         "-o", f"Dir::State::Status={context.root / 'var/lib/dpkg/status'}",
71         "-o", f"Dir::Log={context.workspace}",
72         "-o", f"Dir::Bin::DPkg={find_binary('dpkg', root=context.config.tools())}",
73         "-o", "Debug::NoLocking=true",
74         "-o", f"DPkg::Options::=--root={context.root}",
75         "-o", "DPkg::Options::=--force-unsafe-io",
76         "-o", "DPkg::Options::=--force-architecture",
77         "-o", "DPkg::Options::=--force-depends",
78         "-o", "DPkg::Options::=--no-debsig",
79         "-o", "DPkg::Use-Pty=false",
80         "-o", "DPkg::Install::Recursive::Minimum=1000",
81         "-o", "pkgCacheGen::ForceEssential=,",
82     ]
83 
84     if not context.config.with_docs:
85         cmdline += [
86             "-o", "DPkg::Options::=--path-exclude=/usr/share/doc/*",
87             "-o", "DPkg::Options::=--path-include=/usr/share/doc/*/copyright",
88             "-o", "DPkg::Options::=--path-exclude=/usr/share/man/*",
89             "-o", "DPkg::Options::=--path-exclude=/usr/share/groff/*",
90             "-o", "DPkg::Options::=--path-exclude=/usr/share/info/*",
91         ]
92 
93     return cmdline
94 
95 
96 def invoke_apt(
97     context: Context,
98     command: str,
99     operation: str,
100     packages: Sequence[str] = (),
101     *,
102     apivfs: bool = True,
103     mounts: Sequence[PathString] = (),
104 ) -> None:
105     with finalize_ephemeral_source_mounts(context.config) as sources:
106         run(
107             apt_cmd(context, command) + [operation, *sort_packages(packages)],
108             sandbox=(
109                 context.sandbox(
110                     network=True,
111                     options=[
112                         "--bind", context.root, context.root,
113                         *finalize_package_manager_mounts(context),
114                         *sources,
115                         *mounts,
116                         "--chdir", "/work/src",
117                     ],
118                 ) + (apivfs_cmd(context.root) if apivfs else [])
119             ),
120             env=context.config.environment,
121         )
122 
123 
124 def createrepo_apt(context: Context) -> None:
125     with (context.packages / "Packages").open("wb") as f:
126         run(["dpkg-scanpackages", context.packages],
127             stdout=f, sandbox=context.sandbox(options=["--ro-bind", context.packages, context.packages]))
128 
129     (context.pkgmngr / "etc/apt/sources.list.d").mkdir(parents=True, exist_ok=True)
130     (context.pkgmngr / "etc/apt/sources.list.d/mkosi-packages.sources").write_text(
131         f"""\
132         Enabled: yes
133         Types: deb
134         URIs: file:///work/packages
135         Suites: {context.config.release}
136         Components: main
137         Trusted: yes
138         """
139     )
140
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/mkosi/installer/apt.py b/mkosi/installer/apt.py
--- a/mkosi/installer/apt.py
+++ b/mkosi/installer/apt.py
@@ -81,6 +81,13 @@
         "-o", "pkgCacheGen::ForceEssential=,",
     ]
 
+    if not context.config.repository_key_check:
+        cmdline += [
+            "-o", "Acquire::AllowInsecureRepositories=true",
+            "-o", "Acquire::AllowDowngradeToInsecureRepositories=true",
+            "-o", "APT::Get::AllowUnauthenticated=true",
+        ]
+
     if not context.config.with_docs:
         cmdline += [
             "-o", "DPkg::Options::=--path-exclude=/usr/share/doc/*",

{"golden_diff": "diff --git a/mkosi/installer/apt.py b/mkosi/installer/apt.py\n--- a/mkosi/installer/apt.py\n+++ b/mkosi/installer/apt.py\n@@ -81,6 +81,13 @@\n         \"-o\", \"pkgCacheGen::ForceEssential=,\",\n     ]\n \n+    if not context.config.repository_key_check:\n+        cmdline += [\n+            \"-o\", \"Acquire::AllowInsecureRepositories=true\",\n+            \"-o\", \"Acquire::AllowDowngradeToInsecureRepositories=true\",\n+            \"-o\", \"APT::Get::AllowUnauthenticated=true\",\n+        ]\n+\n     if not context.config.with_docs:\n         cmdline += [\n             \"-o\", \"DPkg::Options::=--path-exclude=/usr/share/doc/*\",\n", "issue": "`RepositoryKeyCheck` is not respected for Deb-based distros\nHey there!\r\n\r\nThe man page suggests that the `Distribution.RepositoryKeyCheck` configuration option is not used for DNF-based distros yet (which would imply to me that it is used for other distributions). When looking at the code, however, it seems that it is only used for `pacman`, `zypper`, and `dnf` (i.e. DNF-based distros, too). Furthermore, it seems that the input is not respected for Deb-based distros. When trying to build an Ubuntu image without making the public key available to the build environment and with setting the `RepositoryKeyCheck` option to `false`, I receive the following error:\r\n\r\n```console\r\n\u2023  Installing Ubuntu\r\nGet:1 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]\r\nGet:2 http://security.ubuntu.com/ubuntu jammy-security InRelease [110 kB]\r\nErr:2 http://security.ubuntu.com/ubuntu jammy-security InRelease   \r\n  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C\r\nGet:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [119 kB]\r\nErr:1 http://archive.ubuntu.com/ubuntu jammy InRelease\r\n  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C\r\nErr:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease\r\n  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C\r\nReading package lists... Done\r\nW: GPG error: http://security.ubuntu.com/ubuntu jammy-security InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C\r\nE: The repository 'http://security.ubuntu.com/ubuntu jammy-security InRelease' is not signed.\r\nN: Updating from such a repository can't be done securely, and is therefore disabled by default.\r\nN: See apt-secure(8) manpage for repository creation and user configuration details.\r\nW: GPG error: http://archive.ubuntu.com/ubuntu jammy InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C\r\nE: The repository 'http://archive.ubuntu.com/ubuntu jammy InRelease' is not signed.\r\nN: Updating from such a repository can't be done securely, and is therefore disabled by default.\r\nN: See apt-secure(8) manpage for repository creation and user configuration details.\r\nW: GPG error: http://archive.ubuntu.com/ubuntu jammy-updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C\r\nE: The repository 'http://archive.ubuntu.com/ubuntu jammy-updates InRelease' is not signed.\r\nN: Updating from such a repository can't be done securely, and is therefore disabled by default.\r\nN: See apt-secure(8) manpage for repository creation and user configuration details.\r\n```\r\n\r\nWhen the public key is supplied via `mkosi.skeleton`, the build succeeds.\n", "before_files": [{"content": "# SPDX-License-Identifier: LGPL-2.1+\nimport textwrap\nfrom collections.abc import Sequence\n\nfrom mkosi.context import Context\nfrom mkosi.installer import finalize_package_manager_mounts\nfrom mkosi.mounts import finalize_ephemeral_source_mounts\nfrom mkosi.run import find_binary, run\nfrom mkosi.sandbox import apivfs_cmd\nfrom mkosi.types import PathString\nfrom mkosi.util import sort_packages, umask\n\n\ndef setup_apt(context: Context, repos: Sequence[str]) -> None:\n    (context.pkgmngr / \"etc/apt\").mkdir(exist_ok=True, parents=True)\n    (context.pkgmngr / \"etc/apt/apt.conf.d\").mkdir(exist_ok=True, parents=True)\n    (context.pkgmngr / \"etc/apt/preferences.d\").mkdir(exist_ok=True, parents=True)\n    (context.pkgmngr / \"etc/apt/sources.list.d\").mkdir(exist_ok=True, parents=True)\n\n    # TODO: Drop once apt 2.5.4 is widely available.\n    with umask(~0o755):\n        (context.root / \"var/lib/dpkg\").mkdir(parents=True, exist_ok=True)\n        (context.root / \"var/lib/dpkg/status\").touch()\n\n    (context.cache_dir / \"lib/apt\").mkdir(exist_ok=True, parents=True)\n    (context.cache_dir / \"cache/apt\").mkdir(exist_ok=True, parents=True)\n\n    # We have a special apt.conf outside of pkgmngr dir that only configures \"Dir::Etc\" that we pass to APT_CONFIG to\n    # tell apt it should read config files from /etc/apt in case this is overridden by distributions. This is required\n    # because apt parses CLI configuration options after parsing its configuration files and as such we can't use CLI\n    # options to tell apt where to look for configuration files.\n    config = context.workspace / \"apt.conf\"\n    if not config.exists():\n        config.write_text(\n            textwrap.dedent(\n                \"\"\"\\\n                Dir::Etc \"etc/apt\";\n                \"\"\"\n            )\n        )\n\n    sources = context.pkgmngr / \"etc/apt/sources.list\"\n    if not sources.exists():\n        with sources.open(\"w\") as f:\n            for repo in repos:\n                f.write(f\"{repo}\\n\")\n\n\ndef apt_cmd(context: Context, command: str) -> list[PathString]:\n    debarch = context.config.distribution.architecture(context.config.architecture)\n\n    cmdline: list[PathString] = [\n        \"env\",\n        f\"APT_CONFIG={context.workspace / 'apt.conf'}\",\n        \"DEBIAN_FRONTEND=noninteractive\",\n        \"DEBCONF_INTERACTIVE_SEEN=true\",\n        \"INITRD=No\",\n        command,\n        \"-o\", f\"APT::Architecture={debarch}\",\n        \"-o\", f\"APT::Architectures={debarch}\",\n        \"-o\", f\"APT::Install-Recommends={str(context.config.with_recommends).lower()}\",\n        \"-o\", \"APT::Immediate-Configure=off\",\n        \"-o\", \"APT::Get::Assume-Yes=true\",\n        \"-o\", \"APT::Get::AutomaticRemove=true\",\n        \"-o\", \"APT::Get::Allow-Change-Held-Packages=true\",\n        \"-o\", \"APT::Get::Allow-Remove-Essential=true\",\n        \"-o\", \"APT::Sandbox::User=root\",\n        \"-o\", \"Dir::Cache=/var/cache/apt\",\n        \"-o\", \"Dir::State=/var/lib/apt\",\n        \"-o\", f\"Dir::State::Status={context.root / 'var/lib/dpkg/status'}\",\n        \"-o\", f\"Dir::Log={context.workspace}\",\n        \"-o\", f\"Dir::Bin::DPkg={find_binary('dpkg', root=context.config.tools())}\",\n        \"-o\", \"Debug::NoLocking=true\",\n        \"-o\", f\"DPkg::Options::=--root={context.root}\",\n        \"-o\", \"DPkg::Options::=--force-unsafe-io\",\n        \"-o\", \"DPkg::Options::=--force-architecture\",\n        \"-o\", \"DPkg::Options::=--force-depends\",\n        \"-o\", \"DPkg::Options::=--no-debsig\",\n        \"-o\", \"DPkg::Use-Pty=false\",\n        \"-o\", \"DPkg::Install::Recursive::Minimum=1000\",\n        \"-o\", \"pkgCacheGen::ForceEssential=,\",\n    ]\n\n    if not context.config.with_docs:\n        cmdline += [\n            \"-o\", \"DPkg::Options::=--path-exclude=/usr/share/doc/*\",\n            \"-o\", \"DPkg::Options::=--path-include=/usr/share/doc/*/copyright\",\n            \"-o\", \"DPkg::Options::=--path-exclude=/usr/share/man/*\",\n            \"-o\", \"DPkg::Options::=--path-exclude=/usr/share/groff/*\",\n            \"-o\", \"DPkg::Options::=--path-exclude=/usr/share/info/*\",\n        ]\n\n    return cmdline\n\n\ndef invoke_apt(\n    context: Context,\n    command: str,\n    operation: str,\n    packages: Sequence[str] = (),\n    *,\n    apivfs: bool = True,\n    mounts: Sequence[PathString] = (),\n) -> None:\n    with finalize_ephemeral_source_mounts(context.config) as sources:\n        run(\n            apt_cmd(context, command) + [operation, *sort_packages(packages)],\n            sandbox=(\n                context.sandbox(\n                    network=True,\n                    options=[\n                        \"--bind\", context.root, context.root,\n                        *finalize_package_manager_mounts(context),\n                        *sources,\n                        *mounts,\n                        \"--chdir\", \"/work/src\",\n                    ],\n                ) + (apivfs_cmd(context.root) if apivfs else [])\n            ),\n            env=context.config.environment,\n        )\n\n\ndef createrepo_apt(context: Context) -> None:\n    with (context.packages / \"Packages\").open(\"wb\") as f:\n        run([\"dpkg-scanpackages\", context.packages],\n            stdout=f, sandbox=context.sandbox(options=[\"--ro-bind\", context.packages, context.packages]))\n\n    (context.pkgmngr / \"etc/apt/sources.list.d\").mkdir(parents=True, exist_ok=True)\n    (context.pkgmngr / \"etc/apt/sources.list.d/mkosi-packages.sources\").write_text(\n        f\"\"\"\\\n        Enabled: yes\n        Types: deb\n        URIs: file:///work/packages\n        Suites: {context.config.release}\n        Components: main\n        Trusted: yes\n        \"\"\"\n    )\n", "path": "mkosi/installer/apt.py"}], "after_files": [{"content": "# SPDX-License-Identifier: LGPL-2.1+\nimport textwrap\nfrom collections.abc import Sequence\n\nfrom mkosi.context import Context\nfrom mkosi.installer import finalize_package_manager_mounts\nfrom mkosi.mounts import finalize_ephemeral_source_mounts\nfrom mkosi.run import find_binary, run\nfrom mkosi.sandbox import apivfs_cmd\nfrom mkosi.types import PathString\nfrom mkosi.util import sort_packages, umask\n\n\ndef setup_apt(context: Context, repos: Sequence[str]) -> None:\n    (context.pkgmngr / \"etc/apt\").mkdir(exist_ok=True, parents=True)\n    (context.pkgmngr / \"etc/apt/apt.conf.d\").mkdir(exist_ok=True, parents=True)\n    (context.pkgmngr / \"etc/apt/preferences.d\").mkdir(exist_ok=True, parents=True)\n    (context.pkgmngr / \"etc/apt/sources.list.d\").mkdir(exist_ok=True, parents=True)\n\n    # TODO: Drop once apt 2.5.4 is widely available.\n    with umask(~0o755):\n        (context.root / \"var/lib/dpkg\").mkdir(parents=True, exist_ok=True)\n        (context.root / \"var/lib/dpkg/status\").touch()\n\n    (context.cache_dir / \"lib/apt\").mkdir(exist_ok=True, parents=True)\n    (context.cache_dir / \"cache/apt\").mkdir(exist_ok=True, parents=True)\n\n    # We have a special apt.conf outside of pkgmngr dir that only configures \"Dir::Etc\" that we pass to APT_CONFIG to\n    # tell apt it should read config files from /etc/apt in case this is overridden by distributions. This is required\n    # because apt parses CLI configuration options after parsing its configuration files and as such we can't use CLI\n    # options to tell apt where to look for configuration files.\n    config = context.workspace / \"apt.conf\"\n    if not config.exists():\n        config.write_text(\n            textwrap.dedent(\n                \"\"\"\\\n                Dir::Etc \"etc/apt\";\n                \"\"\"\n            )\n        )\n\n    sources = context.pkgmngr / \"etc/apt/sources.list\"\n    if not sources.exists():\n        with sources.open(\"w\") as f:\n            for repo in repos:\n                f.write(f\"{repo}\\n\")\n\n\ndef apt_cmd(context: Context, command: str) -> list[PathString]:\n    debarch = context.config.distribution.architecture(context.config.architecture)\n\n    cmdline: list[PathString] = [\n        \"env\",\n        f\"APT_CONFIG={context.workspace / 'apt.conf'}\",\n        \"DEBIAN_FRONTEND=noninteractive\",\n        \"DEBCONF_INTERACTIVE_SEEN=true\",\n        \"INITRD=No\",\n        command,\n        \"-o\", f\"APT::Architecture={debarch}\",\n        \"-o\", f\"APT::Architectures={debarch}\",\n        \"-o\", f\"APT::Install-Recommends={str(context.config.with_recommends).lower()}\",\n        \"-o\", \"APT::Immediate-Configure=off\",\n        \"-o\", \"APT::Get::Assume-Yes=true\",\n        \"-o\", \"APT::Get::AutomaticRemove=true\",\n        \"-o\", \"APT::Get::Allow-Change-Held-Packages=true\",\n        \"-o\", \"APT::Get::Allow-Remove-Essential=true\",\n        \"-o\", \"APT::Sandbox::User=root\",\n        \"-o\", \"Dir::Cache=/var/cache/apt\",\n        \"-o\", \"Dir::State=/var/lib/apt\",\n        \"-o\", f\"Dir::State::Status={context.root / 'var/lib/dpkg/status'}\",\n        \"-o\", f\"Dir::Log={context.workspace}\",\n        \"-o\", f\"Dir::Bin::DPkg={find_binary('dpkg', root=context.config.tools())}\",\n        \"-o\", \"Debug::NoLocking=true\",\n        \"-o\", f\"DPkg::Options::=--root={context.root}\",\n        \"-o\", \"DPkg::Options::=--force-unsafe-io\",\n        \"-o\", \"DPkg::Options::=--force-architecture\",\n        \"-o\", \"DPkg::Options::=--force-depends\",\n        \"-o\", \"DPkg::Options::=--no-debsig\",\n        \"-o\", \"DPkg::Use-Pty=false\",\n        \"-o\", \"DPkg::Install::Recursive::Minimum=1000\",\n        \"-o\", \"pkgCacheGen::ForceEssential=,\",\n    ]\n\n    if not context.config.repository_key_check:\n        cmdline += [\n            \"-o\", \"Acquire::AllowInsecureRepositories=true\",\n            \"-o\", \"Acquire::AllowDowngradeToInsecureRepositories=true\",\n            \"-o\", \"APT::Get::AllowUnauthenticated=true\",\n        ]\n\n    if not context.config.with_docs:\n        cmdline += [\n            \"-o\", \"DPkg::Options::=--path-exclude=/usr/share/doc/*\",\n            \"-o\", \"DPkg::Options::=--path-include=/usr/share/doc/*/copyright\",\n            \"-o\", \"DPkg::Options::=--path-exclude=/usr/share/man/*\",\n            \"-o\", \"DPkg::Options::=--path-exclude=/usr/share/groff/*\",\n            \"-o\", \"DPkg::Options::=--path-exclude=/usr/share/info/*\",\n        ]\n\n    return cmdline\n\n\ndef invoke_apt(\n    context: Context,\n    command: str,\n    operation: str,\n    packages: Sequence[str] = (),\n    *,\n    apivfs: bool = True,\n    mounts: Sequence[PathString] = (),\n) -> None:\n    with finalize_ephemeral_source_mounts(context.config) as sources:\n        run(\n            apt_cmd(context, command) + [operation, *sort_packages(packages)],\n            sandbox=(\n                context.sandbox(\n                    network=True,\n                    options=[\n                        \"--bind\", context.root, context.root,\n                        *finalize_package_manager_mounts(context),\n                        *sources,\n                        *mounts,\n                        \"--chdir\", \"/work/src\",\n                    ],\n                ) + (apivfs_cmd(context.root) if apivfs else [])\n            ),\n            env=context.config.environment,\n        )\n\n\ndef createrepo_apt(context: Context) -> None:\n    with (context.packages / \"Packages\").open(\"wb\") as f:\n        run([\"dpkg-scanpackages\", context.packages],\n            stdout=f, sandbox=context.sandbox(options=[\"--ro-bind\", context.packages, context.packages]))\n\n    (context.pkgmngr / \"etc/apt/sources.list.d\").mkdir(parents=True, exist_ok=True)\n    (context.pkgmngr / \"etc/apt/sources.list.d/mkosi-packages.sources\").write_text(\n        f\"\"\"\\\n        Enabled: yes\n        Types: deb\n        URIs: file:///work/packages\n        Suites: {context.config.release}\n        Components: main\n        Trusted: yes\n        \"\"\"\n    )\n", "path": "mkosi/installer/apt.py"}]}