Merge ~juliank/autopkgtest/+git/development:blocking-io into ~juliank/autopkgtest/+git/development:master

[Julian Andres Klode]

Unmerged commits

237232c... by Julian Andres Klode on 2021-06-11

runner: Set sys.stderr to blocking

We see BlockingIOError quite a bit these days on Ubuntu's autopkgtest
cloud when trying to write to sys.stderr. Not sure why it's non-blocking,
seems Python sets it up that way sometimes...

    Traceback (most recent call last):
     File "/home/ubuntu/autopkgtest/lib/VirtSubproc.py", line 740, in mainloop
       command()
     File "/home/ubuntu/autopkgtest/lib/VirtSubproc.py", line 669, in command
       r = f(c, ce)
     File "/home/ubuntu/autopkgtest/lib/VirtSubproc.py", line 364, in cmd_reboot
       caller.hook_wait_reboot(**wait_reboot_args)
     File "/home/ubuntu/autopkgtest/virt/autopkgtest-virt-ssh", line 486, in hook_wait_reboot
       wait_for_ssh(sshcmd, timeout=args.timeout_ssh)
     File "/home/ubuntu/autopkgtest/virt/autopkgtest-virt-ssh", line 320, in wait_for_ssh
       execute_setup_script('debug-failure', fail_ok=True)
     File "/home/ubuntu/autopkgtest/virt/autopkgtest-virt-ssh", line 208, in execute_setup_script
       sys.stderr.write(err)
    BlockingIOError: [Errno 11] write could not complete without blocking

ed4023b... by Iain Lane on 2021-04-30

nova: Drop nova network-show, we're all openstack now

f0b6d2b... by Iain Lane on 2021-04-12

ssh-setup/nova: Use `openstack network show` in preference to `nova`

Once we don't care about xenial's `openstack` client tools then we can
drop the fallback and upstream this.

42224fc... by Julian Andres Klode on 2021-04-07

UBUNTU: setup-testbed: Setup Acquire::Retries 10, like debci does

da7d955... by Julian Andres Klode on 2021-04-07

setup-testbed: Also remove needrestart

needrestart installs a dpkg hook that fails and inserts errors,
causing the apt test suite to fail (there's no way to isolate against
system dpkg hooks so far), and is installed in cloud images atm.

d47c7f0... by Iain Lane on 2021-04-06

ssh-setup/nova: Quote arguments to `tr`

Otherwise they can be expanded as globs, which breaks badly if they
match anything in the cwd.

(cherry picked from commit a55a4f342688569f41a2937e942bee0dc8d05be5)

3875f4e... by Iain Lane on 2020-12-16

lxd: Add a hook_prepare_reboot and pass arguments from it to wait_reboot

We've got a race condition currently. When rebooting the testbed, the
flow is like this:

  hook_prepare_reboot
  reboot
  hook_wait_reboot

The idea is that hook_wait_reboot waits for the testbed to come back up,
so we can go on with the tests. For lxd, this means fetch the uptime,
and wait for it to go backwards, indicating the the reboot happened.

We fetch the 'initial' uptime in hook_wait_reboot, though. As this is
after we actually ask the testbed to reboot itself, there's a race
condition. If we managed to go down before we get into hook_wait_reboot,
we will not be able to get the initial uptime.

Instead, add a prepare_reboot hook to autopkgtest-virt-lxd, which
fetches the initial uptime. Then it needs to be able to return a value
back to the caller, so that wait_reboot can know what it needs to
compare to. That needs a bit of adjustment to hook_wait_reboot's
interface, to allow it to accept arguments. We make this generic, so
it's optional across backends.

5d45b3b... by Julian Andres Klode on 2020-08-13

TEMPORARY: RT#127293: install haveged again

rng-tools is not working everywhere, so continue to install haveged
in the meantime.

43c3f26... by Steve Langasek on 2020-01-21

Include cross-arch packages in pinning.

To ensure cross-installability of 'unstable' versions of libraries whose
native versions are also installed in the base system, and to ensure the
'unstable' versions of cross packages are used, our binary package pins must
include both native and cross packages. Some of the values included in the
pin will be nonsense (the cross variant of any Arch: all package), but this
doesn't matter.

57d7040... by Steve Langasek on 2019-12-07

Handle cross-arch test deps for packages which are not Arch: any.

If the package is only built on a subset of archs, the [arch] list is
part of the string in my_packages and needs to be accounted for. Don't
worry about the possibility that our target arch isn't actually in the
architecture list, since in that case it shouldn't be a test dep anyway.

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f28fa86..0601456 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -9,18 +9,18 @@ quicktests:
     - tests/pyflakes
     - tests/testdesc
 
-tests-sid:
-  stage: test
-  image: debian:sid
+.tests: &tests
   script:
     - apt-get update
     - apt-get install -y apt-utils autodep8 build-essential debhelper libdpkg-perl procps python3 python3-debian
     - tests/autopkgtest NullRunner NullRunnerRoot ChrootRunner
 
-tests-stretch:
+tests-sid:
   stage: test
-  image: debian:stretch
-  script:
-    - apt-get update
-    - apt-get install -y apt-utils autodep8 build-essential debhelper libdpkg-perl procps python3 python3-debian
-    - tests/autopkgtest NullRunner NullRunnerRoot ChrootRunner
+  image: debian:sid
+  <<: *tests
+
+tests-stable:
+  stage: test
+  image: debian:stable
+  <<: *tests
diff --git a/Makefile b/Makefile
index 1582c44..6fc99b6 100644
--- a/Makefile
+++ b/Makefile
@@ -53,6 +53,7 @@ programs =	tools/autopkgtest-buildvm-ubuntu-cloud \
 pythonfiles =	lib/VirtSubproc.py \
 		lib/adtlog.py \
 		lib/autopkgtest_args.py \
+		lib/autopkgtest_qemu.py \
 		lib/adt_testbed.py \
 		lib/adt_binaries.py \
 		lib/testdesc.py \
diff --git a/debian/README.source b/debian/README.source
new file mode 100644
index 0000000..a6e9b02
--- /dev/null
+++ b/debian/README.source
@@ -0,0 +1,150 @@
+Testing autopkgtest backends
+============================
+
+This is a cheat-sheet for developers of autopkgtest who do not have any
+particular requirements for the packages under test or the containers in
+which they are tested, and just want to prove that the various backends
+still work.
+
+The current working directory is assumed to be the autopkgtest source
+code. Omit the ./runner/ and ./tools/ prefixes to test the system copy.
+
+All examples refer to testing the 'util-linux' source package on amd64,
+in either Debian 10 or Ubuntu 18.04. Adjust as necessary for the
+distribution, architecture and package you actually want to test.
+util-linux is a convenient example of an Essential package with only
+trivial test coverage and few test-dependencies, hence quick to test.
+
+Commands prefixed with # need to be run as root, commands prefixed with $
+can be run as an ordinary user.
+
+Run all this in a virtual machine if you don't want to run as root on
+the host system (for qemu this requires nested KVM).
+
+null
+----
+
+No setup required, but you are responsible for installing build-
+and/or test-dependencies yourself.
+
+$ ./runner/autopkgtest util-linux -- null
+
+schroot
+-------
+
+# apt install schroot sbuild
+# mkdir /srv/chroot
+# sbuild-createchroot \
+--arch=amd64 \
+buster \
+/srv/chroot/buster-amd64-sbuild
+
+(if you are in the sbuild group)
+$ ./runner/autopkgtest util-linux -- schroot buster-amd64-sbuild
+(or)
+# ./runner/autopkgtest util-linux -- schroot buster-amd64-sbuild
+
+Or for Ubuntu:
+
+# apt install ubuntu-keyring
+# sbuild-createchroot \
+--arch=amd64 \
+bionic \
+/srv/chroot/bionic-amd64-sbuild
+# ./runner/autopkgtest util-linux -- schroot bionic-amd64-sbuild
+
+lxc
+---
+
+This cheat-sheet assumes lxc (>= 3).
+
+# apt install lxc
+# subnet=10.0.3
+# cat > /etc/default/lxc-net <<EOF
+USE_LXC_BRIDGE="true"
+LXC_BRIDGE="lxcbr0"
+LXC_ADDR="${subnet}.1"
+LXC_NETMASK="255.255.255.0"
+LXC_NETWORK="${subnet}.0/24"
+LXC_DHCP_RANGE="${subnet}.2,${subnet}.254"
+LXC_DHCP_MAX="253"
+LXC_DHCP_CONFILE=""
+LXC_DOMAIN=""
+EOF
+# cat > /etc/lxc/default.conf <<EOF
+lxc.net.0.type = veth
+lxc.net.0.link = lxcbr0
+lxc.net.0.flags = up
+lxc.net.0.hwaddr = 00:16:3e:xx:xx:xx
+lxc.apparmor.profile = unconfined
+EOF
+# service lxc restart
+
+# ./tools/autopkgtest-build-lxc debian buster amd64
+
+# ./runner/autopkgtest util-linux -- lxc autopkgtest-buster-amd64
+(or)
+$ ./runner/autopkgtest util-linux -- lxc --sudo autopkgtest-buster-amd64
+
+Or for Ubuntu:
+
+# ./tools/autopkgtest-build-lxc ubuntu bionic amd64
+# ./runner/autopkgtest util-linux -- lxc autopkgtest-bionic-amd64
+
+lxd
+---
+
+lxd is not available in Debian, only from third-party snap repositories.
+
+# apt install snapd
+(log out and back in to add /snap/bin to PATH)
+# snap install lxd
+
+# lxd init
+(for a simple throwaway setup, accept all defaults)
+
+# ./tools/autopkgtest-build-lxd images:debian/buster/amd64
+# lxc image list
+(you will see autopkgtest/debian/buster/amd64 listed)
+# ./runner/autopkgtest util-linux -- lxd autopkgtest/debian/buster/amd64
+
+Or for Ubuntu:
+
+# ./tools/autopkgtest-build-lxd ubuntu:bionic
+# lxc image list
+(you will see autopkgtest/ubuntu/bionic/amd64 listed)
+# ./runner/autopkgtest util-linux -- lxd autopkgtest/ubuntu/bionic/amd64
+
+qemu
+----
+
+This can be done in a VM:
+
+# apt install qemu-utils vmdb2
+# ./tools/autopkgtest-build-qemu buster ./buster.qcow2
+
+This can be done in a VM if you have nested KVM enabled, or on the host
+system. The unprivileged user needs write access to /dev/kvm, but no other
+privileges:
+
+# apt install qemu-system-x86 qemu-utils
+$ ./runner/autopkgtest util-linux -- qemu ./buster.qcow2
+
+autopkgtest-build-qemu doesn't currently work to build Ubuntu images,
+because vmdb2 assumes grub-install supports the --force-extra-removable
+option, but Ubuntu's grub-install doesn't have that option.
+Instead use a cloud image, which can be done unprivileged:
+
+$ ./tools/autopkgtest-buildvm-ubuntu-cloud --release=bionic
+$ ./runner/autopkgtest util-linux -- qemu ./autopkgtest-bionic-amd64.img
+
+(If you're running a VM inside a VM, you might need to pass something
+like --ram-size=512 after the qemu argument to make the inner VM use
+strictly less memory.)
+
+ssh (without a setup script)
+----------------------------
+
+Prepare 'machine' however you want to, then:
+
+$ autopkgtest util-linux -- ssh -H machine
diff --git a/debian/changelog b/debian/changelog
index d503cc7..7c63c27 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,131 @@
+autopkgtest (5.15) unstable; urgency=medium
+
+  [ Sebastien Delafond ]
+  * Remove left over .new containers before trying to generate a new one
+    (Closes: #971749)
+
+  [ Antonio Terceiro ]
+  * virt-lxc: extract common initial argument list for lxc-copy
+  * virt-lxc: add option to limit disk usage by tests
+
+  [ Paul Gevers ]
+  * tests/lxd: mark test skippable and exit 77 in stead of 0 in case of
+    balling-out
+  * Add support for Architecture field (Closes: #970513)
+  * Check for empty Tests field (Closes: #918882)
+  * With --test-name, don't report when other tests are skipped
+    (Closes: #960267)
+
+  [ Simon McVittie ]
+  * Check restrictions with testbed compat, not during initialization
+  * Allow restrictions to be ignored from the command line
+
+  [ Ivo De Decker ]
+  * Assume root-on-testbed with autopkgtest-virt-ssh and improve debugging
+    (Closes: #958727)
+
+ -- Paul Gevers <[e-mail]>  Mon, 26 Oct 2020 21:27:25 +0100
+
+autopkgtest (5.14) unstable; urgency=medium
+
+  [ Christian Kastner ]
+  * autopkgtest-build-qemu: Support for vmdb2->qemu-debootstrap
+    (Closes: #959389)
+
+  [ Antonio Terceiro ]
+  * autopkgtest-build-qemu: make sure VM can resolve its own hostname
+    (Closes: #959713)
+  * autopkgtest: add --validate option
+
+  [ Iain Lane ]
+  * autopkgtest-virt-ssh: Give the wait_port_down socket a timeout
+
+  [ Simon McVittie ]
+  * Avoid using 'l' as a variable name
+  * qemu: Guess format of main disk image (Closes: #968598)
+  * tools: Don't make qemu guess what format the disk image is
+
+  [ Paul Gevers ]
+  * Bump standards
+  * Bump debhelper compat to 13 via debhelper-compat BD
+  * Add Rules-Requires-Root: no
+  * Drop postinst script as all supported releases have higher versions
+
+ -- Paul Gevers <[e-mail]>  Tue, 01 Sep 2020 21:28:29 +0200
+
+autopkgtest (5.13.1) unstable; urgency=medium
+
+  * autopkgtest-build-qemu: revert commit that broke image creation
+    (Closes: #956659)
+
+ -- Antonio Terceiro <[e-mail]>  Fri, 17 Apr 2020 22:02:07 -0300
+
+autopkgtest (5.13) unstable; urgency=medium
+
+  [ Gordon Ball ]
+  * Use pyflakes3 instead of pyflakes (Closes: #956338)
+
+  [ Paul Gevers ]
+  * Add support for needs-internet restriction
+  * Add note about ftp-master ruling (Closes: #954157)
+  * README.package-tests.rst: add documentation about needs-internet
+    restriction
+  * Update 5.12 changelog entry with bug number for qemu on ppc64el item
+
+ -- Paul Gevers <[e-mail]>  Thu, 16 Apr 2020 21:07:58 +0200
+
+autopkgtest (5.12.1) unstable; urgency=medium
+
+  [ Antonio Terceiro ]
+  * adt_testbed: ignore debian/control when checking for dependencies. This
+    fixes a regression observed in the debci test suite.
+
+ -- Antonio Terceiro <[e-mail]>  Sat, 04 Apr 2020 12:20:17 -0300
+
+autopkgtest (5.12) unstable; urgency=medium
+
+  [ Dan Streetman ]
+  * tools/autopkgtest-build-lxd: pass /dev/null on stdin to lxc launch
+    (LP: #1845037)
+  * autopkgtest: When finding src pkg, skip binary pkgs for other archs
+    (LP: #1845157) (Closes: #939790)
+  * autopkgtest: when checking binary pkg arch, allow *-$ARCH-* values also
+
+  [ Antonio Terceiro ]
+  * Drop unpacking of dependencies to temporary dir
+
+  [ Iain Lane ]
+  * setup-testbed: Install rng-tools
+  * lib/adt_testbed.py, runner/autopkgtest: Run --shell-fail in more situations
+  * adt_testbed: Run the debug-fail command in more circumstances
+
+  [ Sébastien Delafond ]
+  * Add kali support
+
+  [ Simon McVittie ]
+  * lxd: Actually exit the awk loop after the first apt source
+  * build-lxd: Quote MIRROR and RELEASE properly
+  * d/README.source: Document how to test various backends
+
+  [ Paul Gevers ]
+  * adt_testbed.py: add date to the start of log so we always have it
+    (Closes: #954366)
+  * Do not ignore distributions that have dashes in their name
+  * lxc/lxd: wait for sysvinit services to finish
+    Thanks to Lars Kruse (Closes: #953655)
+  * lxc: increase timeout around reboot
+  * tests/lxd: add skip-not-installable (Closes: #952594)
+
+  [ Jelmer Vernooij ]
+  * Document that $HOME will exist and will be writeable.
+
+  [ Thierry Fauck ]
+  * autopkgtest-build-qemu: create primary partition of type Prep to
+    support ppc64el with grub2 (Closes: #926945)
+  * Add proper kernel release name for ppc64el
+
+ -- Paul Gevers <[e-mail]>  Thu, 02 Apr 2020 10:36:09 +0200
+
 autopkgtest (5.11) unstable; urgency=medium
 
   [ Dan Streetman ]
diff --git a/debian/compat b/debian/compat
deleted file mode 100644
index ec63514..0000000
--- a/debian/compat
+++ /dev/null
@@ -1 +0,0 @@
-9
diff --git a/debian/control b/debian/control
index 6b347f0..88d2eff 100644
--- a/debian/control
+++ b/debian/control
@@ -1,39 +1,42 @@
 Source: autopkgtest
 Maintainer: Debian CI team <[e-mail]>
-Uploaders: Ian Jackson <[e-mail]>, Martin Pitt <[e-mail]>, Antonio Terceiro <[e-mail]>, Paul Gevers <[e-mail]>
+Uploaders: Ian Jackson <[e-mail]>,
+           Martin Pitt <[e-mail]>,
+           Antonio Terceiro <[e-mail]>,
+           Paul Gevers <[e-mail]>
 Section: devel
 Priority: optional
-Standards-Version: 4.4.0
-Build-Depends: debhelper (>= 9),
- python3 (>= 3.1),
- python3-mock,
- python3-debian,
- python3-docutils,
- pyflakes3 | pyflakes,
- procps,
- pycodestyle | pep8,
+Standards-Version: 4.5.0
+Build-Depends: debhelper-compat (= 13),
+               procps,
+               pycodestyle | pep8,
+               pyflakes3,
+               python3 (>= 3.3),
+               python3-debian,
+               python3-docutils,
+               python3-mock
+Rules-Requires-Root: no
 Vcs-Git: https://salsa.debian.org/ci-team/autopkgtest.git
 Vcs-Browser: https://salsa.debian.org/ci-team/autopkgtest
 
 Package: autopkgtest
 Architecture: all
-Depends: python3,
- python3-debian,
- apt-utils,
- libdpkg-perl,
- procps,
- ${misc:Depends}
+Depends: apt-utils,
+         libdpkg-perl,
+         procps,
+         python3,
+         python3-debian,
+         ${misc:Depends}
 Recommends: autodep8
-Suggests:
- lxc,
- lxd,
- ovmf,
- qemu-efi-aarch64,
- qemu-efi-arm,
- qemu-system,
- qemu-utils,
- schroot,
- vmdb2,
+Suggests: lxc,
+          lxd,
+          ovmf,
+          qemu-efi-aarch64,
+          qemu-efi-arm,
+          qemu-system,
+          qemu-utils,
+          schroot,
+          vmdb2
 Breaks: debci (<< 1.7~)
 Description: automatic as-installed testing for Debian packages
  autopkgtest runs tests on binary packages.  The tests are run on the
diff --git a/debian/copyright b/debian/copyright
index 7b35827..c923c56 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -1,7 +1,17 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 
 Files: *
-Copyright: Copyright (C) 2006-2014 Canonical Ltd.
+Copyright:
+ 2006-2018 Canonical Ltd. and others
+ 2012-2017 Martin Pitt
+ 2016-2020 Simon McVittie
+ 2016-2020 Antonio Terceiro
+ 2017 Jiri Palecek
+ 2017-2020 Collabora Ltd.
+ 2018 Thadeu Lima de Souza Cascardo
+ 2019 Michael Biebl
+ 2019 Raphaël Hertzog
+ 2019 Sébastien Delafond
 License: GPL-2+
  This program is free software; you can redistribute it and/or modify
  it under the terms of the GNU General Public License as published by
diff --git a/debian/postinst b/debian/postinst
deleted file mode 100644
index 3d29059..0000000
--- a/debian/postinst
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/sh
-set -e
-
-if [ "$1" = configure ] && dpkg --compare-versions "$2" lt-nl "3.9.3"; then
-    # If this file exists and its only content is "force-unsafe-io", then it was
-    # generated by #775076 and must be removed.
-    if [ -e /etc/dpkg/dpkg.cfg.d/autopkgtest ]; then
-            if [ "`cat /etc/dpkg/dpkg.cfg.d/autopkgtest`" = "force-unsafe-io" ]; then
-                    echo "Cleaning up erroneous /etc/dpkg/dpkg.cfg.d/autopkgtest..."
-                    rm -f /etc/dpkg/dpkg.cfg.d/autopkgtest
-            fi
-    fi
-fi
-
-#DEBHELPER#
diff --git a/debian/rules b/debian/rules
index 692b235..06867d9 100755
--- a/debian/rules
+++ b/debian/rules
@@ -36,7 +36,9 @@ override_dh_auto_install:
 override_dh_auto_test:
 ifeq (, $(findstring nocheck, $(DEB_BUILD_OPTIONS)))
 	if type pyflakes3 >/dev/null 2>&1; then tests/pyflakes; else echo "pyflakes3 not available, skipping"; fi
+	tests/mypy
 	tests/pycodestyle || true
+	tests/shellcheck
 	tests/testdesc
 	tests/autopkgtest_args
 	env NO_PKG_MANGLE=1 tests/autopkgtest NullRunner
diff --git a/debian/tests/control b/debian/tests/control
index a59b3ef..e95dddb 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -1,13 +1,10 @@
 Tests: autopkgtest
-Depends: autopkgtest,
- autodep8,
- build-essential,
- debhelper (>= 7)
+Depends: autodep8, autopkgtest, build-essential, debhelper (>= 7)
 Restrictions: needs-root
 Tests-Directory: tests
 
 Tests: pyflakes
-Depends: pyflakes
+Depends: pyflakes3
 Tests-Directory: tests
 
 Tests: installed
@@ -15,9 +12,9 @@ Depends: autopkgtest
 
 Tests: lxd
 Depends: autopkgtest,
- lxd,
- build-essential,
- debhelper (>= 7),
- fakeroot,
- iptables
-Restrictions: isolation-machine, needs-root, allow-stderr
+         build-essential,
+         debhelper (>= 7),
+         fakeroot,
+         iptables,
+         lxd
+Restrictions: isolation-machine, needs-root, allow-stderr, skip-not-installable,  skippable
diff --git a/debian/tests/lxd b/debian/tests/lxd
index f60ab03..d026f70 100755
--- a/debian/tests/lxd
+++ b/debian/tests/lxd
@@ -4,12 +4,12 @@ arch=$(dpkg --print-architecture)
 if [ "$arch" != i386 -a "$arch" != amd64 ]; then
     # we don't have LXD images for most non-x86 architectures
     echo "Skipping on non-x86 architecture $arch"
-    exit 0
+    exit 77
 fi
 
 if [ -z "${AUTOPKGTEST_NORMAL_USER-}" ]; then
     echo "Skipping test because it requires an AUTOPKGTEST_NORMAL_USER"
-    exit 0
+    exit 77
 fi
 
 # Detect LXD API extensions
diff --git a/doc/README.package-tests.rst b/doc/README.package-tests.rst
index 6c861f0..a5ed023 100644
--- a/doc/README.package-tests.rst
+++ b/doc/README.package-tests.rst
@@ -40,6 +40,9 @@ During execution of the test, the environment variable
 particular test, which starts empty and will be deleted afterwards (so
 there is no need for the test to clean up files left there).
 
+Tests can expect that the ``$HOME`` environment variable to be set
+to a directory that exists and is writeable by the user running the test.
+
 If tests want to create artifacts which are useful to attach to test
 results, such as additional log files or screenshots, they can put them
 into the directory specified by the ``$AUTOPKGTEST_ARTIFACTS``
@@ -172,6 +175,17 @@ Classes: class-1 [, class-2 ...]
 
     Classes are separated by commas and/or whitespace.
 
+Architecture: dpkg architecture field syntax
+    When package tests are only supported on a limited set of
+    architectures, or are known to not work on a particular (set of)
+    architecture(s), this field can be used to define the supported
+    architectures. The autopkgtest will be skipped when the
+    architecture of the testbed doesn't match the content of this
+    field. The format is the same as in debian/control, with the
+    understanding that ``all`` is not allowed, and ``any`` means that
+    the test will be run on every architecture, which is the default
+    when not specifying this field at all.
+
 Any unknown fields will cause the whole stanza to be skipped.
 
 Defined restrictions
@@ -245,6 +259,12 @@ needs-reboot
     The test wants to reboot the machine using
     ``/tmp/autopkgtest-reboot`` (see below).
 
+needs-internet
+    The test needs unrestricted internet access, e.g. to download test data
+    that's not shipped as a package, or to test a protocol implementation
+    against a test server. Please also see the note about Network access later
+    in this document.
+
 needs-recommends (deprecated)
     Enable installation of recommended packages in apt for the test
     dependencies. This does not affect build dependencies.
@@ -425,16 +445,22 @@ the testbed to use it. (Note that the standard tools like
 autopkgtest-build-lxc or mk-sbuild automatically use the apt proxy from
 the host system.)
 
-In general, tests are also allowed to access the internet. As this
-usually makes tests less reliable, this should be kept to a minimum; but
-for many packages their main purpose is to interact with remote web
-services and thus their testing should actually cover those too, to
-ensure that the distribution package keeps working with their
-corresponding web service.
-
-Debian's production CI infrastructure allows unrestricted network
-access, in Ubuntu's infrastructure access to sites other than
-`*.ubuntu.com` and `*.launchpad.net` happens via a proxy (limited to
-DNS and http/https).
-
-.. vim: ft=rst tw=72
+In general, tests should not access the internet themselves. If a test does use
+the internet outside of the pre-configured apt domain, the test must be marked
+with the needs-internet restriction. Using the internet usually makes tests
+less reliable, so this should be kept to a minimum. But for many packages their
+main purpose is to interact with remote web services and thus their testing
+should actually cover those too, to ensure that the distribution package keeps
+working with their corresponding web service.
+
+Please note that for Debian, the ftp-master have ruled (in their
+`REJECT-FAQ (Non-Main II) <https://ftp-master.debian.org/REJECT-FAQ.html>`_
+that tests must not execute code they download. In particular, tests must not
+use external repositories to depend on software (as opposed to data) that is
+not in Debian. However, currently there is nothing preventing this.
+
+Debian's production CI infrastructure allows unrestricted network access
+on most workers. Tests with needs-internet can be skipped on some to avoid
+flaky behavior. In Ubuntu's infrastructure access to sites other than
+`*.ubuntu.com` and `*.launchpad.net` happens via a proxy (limited to DNS and
+http/https).
diff --git a/lib/VirtSubproc.py b/lib/VirtSubproc.py
index 847eac8..d12e3db 100644
--- a/lib/VirtSubproc.py
+++ b/lib/VirtSubproc.py
@@ -31,9 +31,9 @@ import subprocess
 import traceback
 import errno
 import time
-import pipes
 import socket
 import shutil
+import shlex
 
 import adtlog
 
@@ -333,6 +333,7 @@ def reboot_testbed():
 def cmd_reboot(c, ce):
     global downtmp
     cmdnumargs(c, ce, 0, 1)
+    wait_reboot_args = {}
     if not downtmp:
         bomb("`reboot' when not open")
     if 'reboot' not in caller.hook_capabilities():
@@ -350,7 +351,7 @@ def cmd_reboot(c, ce):
     adtlog.debug('cmd_reboot: saved current downtmp, rebooting')
 
     try:
-        caller.hook_prepare_reboot()
+        wait_reboot_args = caller.hook_prepare_reboot() or {}
     except AttributeError:
         pass
 
@@ -360,7 +361,7 @@ def cmd_reboot(c, ce):
     else:
         reboot_testbed()
 
-    caller.hook_wait_reboot()
+    caller.hook_wait_reboot(**wait_reboot_args)
 
     # restore downtmp
     check_exec(['sh', '-ec', 'for d in %s; do '
@@ -529,7 +530,7 @@ def copyupdown_internal(wh, sd, upp):
 
     deststdout = devnull_read
     srcstdin = devnull_read
-    remfileq = pipes.quote(sd[iremote])
+    remfileq = shlex.quote(sd[iremote])
     if not dirsp:
         rune = 'cat %s%s' % ('><'[upp], remfileq)
         if upp:
@@ -587,8 +588,9 @@ def copyupdown_internal(wh, sd, upp):
             status = subprocs[sdn].wait()
             if not (status == 0 or (sdn == 0 and status == -13)):
                 timeout_stop()
-                bomb("%s %s failed, status %d" %
-                     (wh, ['source', 'destination'][sdn], status))
+                adtlog.info("%s %s failed, status %d" %
+                            (wh, ['source', 'destination'][sdn], status))
+                raise FailedCmd(['copy-failed'])
         timeout_stop()
     except Timeout:
         for sdn in [1, 0]:
diff --git a/lib/adt_binaries.py b/lib/adt_binaries.py
index 3cdaee0..31caef5 100644
--- a/lib/adt_binaries.py
+++ b/lib/adt_binaries.py
@@ -107,10 +107,10 @@ class DebBinaries:
         adtlog.debug('Binaries: publish reinstall checking...')
         pkgs_reinstall = set()
         pkg = None
-        for l in open(aptupdate_out.host, encoding='UTF-8'):
-            if l.startswith('Package: '):
-                pkg = l[9:].rstrip()
-            elif l.startswith('Status: install '):
+        for line in open(aptupdate_out.host, encoding='UTF-8'):
+            if line.startswith('Package: '):
+                pkg = line[9:].rstrip()
+            elif line.startswith('Status: install '):
                 if pkg in self.registered:
                     pkgs_reinstall.add(pkg)
                     adtlog.debug('Binaries: publish reinstall needs ' + pkg)
diff --git a/lib/adt_testbed.py b/lib/adt_testbed.py
index 4fe8874..10c0bd3 100644
--- a/lib/adt_testbed.py
+++ b/lib/adt_testbed.py
@@ -24,17 +24,15 @@ import os
 import sys
 import errno
 import time
-import pipes
 import traceback
 import re
+import shlex
 import signal
 import subprocess
 import tempfile
 import shutil
 import urllib.parse
 
-from debian import debian_support
-
 import adtlog
 import VirtSubproc
 
@@ -48,7 +46,7 @@ class Testbed:
                  setup_commands=[], setup_commands_boot=[], add_apt_pockets=[],
                  copy_files=[], pin_packages=[], add_apt_sources=[],
                  add_apt_releases=[], apt_default_release=None,
-                 enable_apt_fallback=True):
+                 enable_apt_fallback=True, shell_fail=False, needs_internet='run', cross_arch=None):
         self.sp = None
         self.lastsend = None
         self.scratch = None
@@ -56,6 +54,8 @@ class Testbed:
         self._need_reset_apt = False
         self.stop_sent = False
         self.dpkg_arch = None
+        self.cross_arch = cross_arch
+        self.cross_env = []
         self.exec_cmd = None
         self.output_dir = output_dir
         self.shared_downtmp = None  # testbed's downtmp on the host, if supported
@@ -79,6 +79,8 @@ class Testbed:
         self.eatmydata_prefix = []
         self.apt_pin_for_releases = []
         self.enable_apt_fallback = enable_apt_fallback
+        self.needs_internet = needs_internet
+        self.shell_fail = shell_fail
         self.nproc = None
         self.cpu_model = None
         self.cpu_flags = None
@@ -95,6 +97,9 @@ class Testbed:
         return self.user or 'root'
 
     def start(self):
+        # log date at least once; to ease finding it
+        adtlog.info('starting date: %s' % time.strftime('%Y-%m-%d'))
+
         # are we running from a checkout?
         root_dir = os.path.dirname(os.path.dirname(os.path.realpath(__file__)))
         if os.path.exists(os.path.join(root_dir, '.git')):
@@ -110,7 +115,7 @@ class Testbed:
 
         # log command line invocation for the log
         adtlog.info('host %s; command line: %s' % (
-            os.uname()[1], ' '.join([pipes.quote(w) for w in sys.argv])))
+            os.uname()[1], ' '.join([shlex.quote(w) for w in sys.argv])))
 
         self.sp = subprocess.Popen(self.vserver_argv,
                                    stdin=subprocess.PIPE,
@@ -135,6 +140,7 @@ class Testbed:
             self.sp.stdin.close()
             ec = self.sp.wait()
         if ec:
+            self.command('auxverb_debug_fail')
             self.bomb('testbed gave exit status %d after quit' % ec)
         self.sp = None
 
@@ -209,6 +215,8 @@ class Testbed:
             if rc:
                 # setup scripts should exit with 100 if it's the package's
                 # fault, otherwise it's considered a transient testbed failure
+                if self.shell_fail:
+                    self.run_shell()
                 if rc == 100:
                     self.badpkg('testbed boot setup commands failed with status 100')
                 else:
@@ -221,6 +229,8 @@ class Testbed:
         self.recommends_installed = False
         self.exec_cmd = list(map(urllib.parse.unquote, self.command('print-execute-command', (), 1)[0].split(',')))
         self.caps = self.command('capabilities', (), None)
+        if self.needs_internet in ['try', 'run']:
+            self.caps.append('has_internet')
         adtlog.debug('testbed capabilities: %s' % self.caps)
         for c in self.caps:
             if c.startswith('downtmp-host='):
@@ -239,6 +249,23 @@ class Testbed:
         self.dpkg_arch = self.check_exec(['dpkg', '--print-architecture'], True).strip()
         adtlog.info('testbed dpkg architecture: ' + self.dpkg_arch)
 
+        # set up environment for cross-architecture if needed
+        if self.cross_arch:
+            self.cross_env = []
+            argv = ['dpkg-architecture', '-a', self.cross_arch]
+            # ignore stderr
+            (code, vars, err) = self.execute(argv,
+                                             stdout=subprocess.PIPE,
+                                             stderr=subprocess.PIPE)
+            if code != 0:
+                self.bomb('"%s" failed with status %i' % (' '.join(argv), code),
+                          adtlog.AutopkgtestError)
+
+            for var in vars.split('\n'):
+                if var.startswith('DEB_HOST'):
+                    self.cross_env.append(var)
+            adtlog.info('testbed target architecture: ' + self.cross_arch)
+
         # do we have eatmydata?
         (code, out, err) = self.execute(['which', 'eatmydata'], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
         if code == 0:
@@ -331,7 +358,7 @@ class Testbed:
                                                   [self._get_default_release() + '-updates'])
         if self.add_apt_releases:
             get_mirror_and_components = '''
-            sed -rn 's/^(deb|deb-src) +(\\[.*\\] *)?((http|https|file):[^ ]*) +([^ -]+) +(.*)$/\\2\\3 \\6/p' \\
+            sed -rn 's/^(deb|deb-src) +(\\[.*\\] *)?((http|https|file):[^ ]*) +([^ ]+) +(.*)$/\\2\\3 \\6/p' \\
                 /etc/apt/sources.list `ls /etc/apt/sources.list.d/*.list 2>/dev/null|| true` | head -1
             '''
             mirror_and_components = self.check_exec(['sh', '-ec', get_mirror_and_components], stdout=True).split()
@@ -365,6 +392,8 @@ class Testbed:
             if rc:
                 # setup scripts should exit with 100 if it's the package's
                 # fault, otherwise it's considered a transient testbed failure
+                if self.shell_fail:
+                    self.run_shell()
                 if rc == 100:
                     self.badpkg('testbed setup commands failed with status 100')
                 else:
@@ -403,7 +432,23 @@ class Testbed:
         self.recommends_installed = recommends
         if not deps_new:
             return
-        self.satisfy_dependencies_string(', '.join(deps_new), 'install-deps', recommends, shell_on_failure=shell_on_failure, synth_deps=synth_deps)
+        if self.cross_arch:
+            # mock up a .dsc with our dependencies string as our build-deps
+            dsc = TempPath(self, 'autopkgtest-satdep.dsc')
+            with open(dsc.host, 'w', encoding='UTF-8') as f_dsc:
+                f_dsc.write("Source: autopkgtest-satdep\n"
+                            "Binary: autopkgtest-satdep\n"
+                            "Architecture: any all\n"
+                            "Build-Depends: " + ', '.join(deps_new) + "\n")
+            dsc.copydown()
+
+            # feed the result to apt-get build-dep
+            self.satisfy_build_deps(dsc.tb, recommends, shell_on_failure)
+            # Now handle the synthetic deps as well
+            self.install_apt('', recommends, shell_on_failure, synth_deps)
+
+        else:
+            self.satisfy_dependencies_string(', '.join(deps_new), 'install-deps', recommends, shell_on_failure=shell_on_failure, synth_deps=synth_deps)
 
     def needs_reset(self):
         # show what caused a reset
@@ -422,7 +467,7 @@ class Testbed:
         adtlog.debug('%s %s' % (_type.__name__, m))
         raise _type(m)
 
-    def send(self, string):
+    def send(self, string, debug_if_fails=True):
         try:
             adtlog.debug('sending command to testbed: ' + string)
             self.sp.stdin.write(string)
@@ -430,11 +475,16 @@ class Testbed:
             self.sp.stdin.flush()
             self.lastsend = string
         except Exception as e:
+            # command() calls back into send() - avoid potential infinite
+            # recursion
+            if debug_if_fails:
+                self.command('auxverb_debug_fail', debug_if_fails=False)
             self.bomb('cannot send to testbed: %s' % e)
 
     def expect(self, keyword, nresults):
         line = self.sp.stdout.readline()
         if not line:
+            self.command('auxverb_debug_fail')
             self.bomb('unexpected eof from the testbed')
         if not line.endswith('\n'):
             self.bomb('unterminated line from the testbed')
@@ -445,9 +495,11 @@ class Testbed:
             self.bomb('unexpected whitespace-only line from the testbed')
         if ll[0] != keyword:
             if self.lastsend is None:
+                self.command('auxverb_debug_fail')
                 self.bomb("got banner `%s', expected `%s...'" %
                           (line, keyword))
             else:
+                self.command('auxverb_debug_fail')
                 self.bomb("sent `%s', got `%s', expected `%s...'" %
                           (self.lastsend, line, keyword))
         ll = ll[1:]
@@ -457,7 +509,7 @@ class Testbed:
                       (self.lastsend, line, len(ll), nresults))
         return ll
 
-    def command(self, cmd, args=(), nresults=0, unquote=True):
+    def command(self, cmd, args=(), nresults=0, unquote=True, debug_if_fails=True):
         # pass args=[None,...] or =(None,...) to avoid more url quoting
         if type(cmd) is str:
             cmd = [cmd]
@@ -466,7 +518,7 @@ class Testbed:
         else:
             args = list(map(urllib.parse.quote, args))
         al = cmd + args
-        self.send(' '.join(al))
+        self.send(' '.join(al), debug_if_fails=debug_if_fails)
         ll = self.expect('ok', nresults)
         if unquote:
             ll = list(map(urllib.parse.unquote, ll))
@@ -488,6 +540,7 @@ class Testbed:
             env.append('APT_LISTBUGS_FRONTEND=none')
             env.append('APT_LISTCHANGES_FRONTEND=none')
         env += self.install_tmp_env
+        env += self.cross_env
 
         adtlog.debug('testbed command %s, kind %s, sout %s, serr %s, env %s' %
                      (argv, kind, stdout and 'pipe' or 'raw',
@@ -520,6 +573,7 @@ class Testbed:
                 adtlog.error(msg)
                 raise
             else:
+                self.command('auxverb_debug_fail')
                 self.bomb(msg)
 
         adtlog.debug('testbed command exited with code %i' % proc.returncode)
@@ -756,176 +810,6 @@ Description: satisfy autopkgtest test dependencies
 
         self.execute(['dpkg', '--purge', 'autopkgtest-satdep'])
 
-    def install_tmp(self, deps, recommends=False):
-        '''Unpack dependencies into temporary directory
-
-        This is a fallback if the testbed does not have root privileges or a
-        writable file system, and will only work for packages that can be
-        used from a different directory with PATH, LD_LIBRARY_PATH, PYTHONPATH
-        etc. set.
-
-        Sets/updates self.install_tmp_env to necessary variables.
-        '''
-        unsupported = []
-        pkg_constraints = {}  # pkg -> (relation, version)
-
-        # parse deps into pkg_constraints
-        dep_re = re.compile(
-            r'(?P<p>[a-z0-9+-.]+)\s*'
-            r'(\((?P<r><<|<=|>=|=|>>)\s*(?P<v>[^\)]*)\))?$')
-        for dep in deps.split(','):
-            dep = dep.strip()
-            if not dep:
-                continue  # trailing comma
-            m = dep_re.match(dep)
-            if not m:
-                unsupported.append(dep)
-                continue
-            pkg_constraints[m.group('p')] = (m.group('r'), m.group('v'))
-
-        adtlog.debug('install_tmp: "%s" -> %s, unsupported: %s' %
-                     (deps, pkg_constraints, unsupported))
-
-        if unsupported:
-            adtlog.warning('The following dependencies cannot be handled in '
-                           'reduced "unpack to temporary directory" mode: ' +
-                           ', '.join(unsupported))
-
-        # simulate installation, grab packages, and check constraints
-        (rc, out, _) = self.execute(['apt-get', '--quiet', '--simulate', '--no-remove',
-                                     '-o', 'Debug::pkgProblemResolver=true',
-                                     '-o', 'Debug::NoLocking=true',
-                                     '-o', 'APT::Install-Recommends=%s' % recommends,
-                                     '-o', 'APT::Get::Show-User-Simulation-Note=False',
-                                     'install'] + list(pkg_constraints),
-                                    stdout=subprocess.PIPE)
-        if rc != 0:
-            self.badpkg('Test dependencies are unsatisfiable. A common reason is '
-                        'that your testbed is out of date with respect to the '
-                        'archive, and you need to use a current testbed, or '
-                        'try "--setup-commands ro-apt-update".')
-
-        def check_constraint(pkg, ver):
-            constraint = pkg_constraints.get(pkg, (None, None))
-            if constraint[0] is None:
-                return True
-            comp = debian_support.version_compare(ver, constraint[1])
-            if constraint[0] == '<<':
-                return comp < 0
-            if constraint[0] == '<=':
-                return comp <= 0
-            if constraint[0] == '==':
-                return comp == 0
-            if constraint[0] == '>=':
-                return comp >= 0
-            if constraint[0] == '>>':
-                return comp > 0
-            raise ValueError('invalid dependency version relation %s' % constraint[0])
-
-        to_install = []
-        for line in out.splitlines():
-            if not line.startswith('Inst '):
-                continue
-            fields = line.split()
-            pkg = fields[1]
-            if fields[2].startswith('('):
-                ver = fields[2][1:]
-            elif fields[3].startswith('('):
-                ver = fields[3][1:]
-            else:
-                raise ValueError('Cannot parse line: %s' % line)
-            # ignore Python 2 stuff, with PYTHONPATH we can only support one
-            # Python major version (3)
-            if pkg.startswith('python-') or pkg.startswith('libpython-') or \
-               'python2.' in pkg or pkg == 'python':
-                adtlog.warning('Ignoring Python 2.x dependency %s, not '
-                               'supported in unpack only mode' % pkg)
-                continue
-            if not check_constraint(pkg, ver):
-                self.badpkg('test dependency %s (%s %s) is unsatisfiable: available version %s' %
-                            (pkg, pkg_constraints[pkg][0], pkg_constraints[pkg][1], ver))
-            to_install.append(pkg)
-
-        adtlog.debug('install_tmp: packages to install: %s' % ' '.join(to_install))
-
-        if not to_install:
-            # we already have everything, all good
-            return
-
-        adtlog.warning('virtualisation system does not offer root or writable '
-                       'testbed; unpacking dependencies to temporary dir, '
-                       'which will only work for some packages')
-
-        # download and unpack all debs
-        script = r'''d=%(t)s/deps
-mkdir -p $d; cd $d
-apt-get download %(pkgs)s >&2
-for p in *.deb; do dpkg-deb --extract $p .; rm $p; done
-
-# executables
-echo PATH=$d/sbin:$d/bin:$d/usr/sbin:$d/usr/bin:$d/usr/games:$PATH
-
-# shared libraries / Qt plugins
-l=""
-q=""
-for candidate in $(find $d -type d \( -name 'lib' -o -path '*/lib/*-linux-*' \)); do
-    [ -z "$(ls $candidate/*.so $candidate/*.so.* 2>/dev/null)" ] || l="$candidate:$l"
-    [ -z "$(ls $candidate/lib*qt*.so* 2>/dev/null)" ] || q="$candidate:$q"
-done
-[ -z "$l" ] || echo LD_LIBRARY_PATH=$l${LD_LIBRARY_PATH:-}
-[ -z "$q" ] || echo QT_PLUGIN_PATH="$q"
-
-# ImageMagick needs some hacks to make python[3]-wand find its library
-l=""
-for ml in $(ls usr/lib/*-linux-*/libMagick*.so.* 2>/dev/null); do
-    if [ -L $ml ]; then continue; fi
-    l=$(dirname $ml)
-    ln -sf $(basename "$ml") "${ml%%.so.*}.so"
-done
-if [ -n "$l" ]; then
-    [ -d "$l/lib" ] || ln -sf . "$l/lib"
-    echo MAGICK_HOME="$d/$l"
-fi
-
-# Python modules
-p=""
-for candidate in $d/usr/lib/python3*/dist-packages; do
-    [ ! -d $candidate ] || p="$candidate:$p"
-done
-[ -z "$p" ] || echo PYTHONPATH=$p${PYTHONPATH:-}
-
-# Perl modules
-p=""
-for candidate in $d/usr/share/perl* $d/usr/lib/perl5 $d/usr/lib/*/perl5/*; do
-    [ ! -d $candidate ] || p="$candidate:$p"
-done
-[ -z "$p" ] || echo PERL5LIB=$p${PERL5LIB:-}
-
-# gobject-introspection
-l=""
-if [ -d $d/usr/lib/girepository-1.0 ]; then
-    l=$d/usr/lib/girepository-1.0
-fi
-for candidate in $(find $d -type d -path '*/usr/lib/*/girepository-*'); do
-    [ -z "$(ls $candidate/*.typelib 2>/dev/null)" ] || l="$candidate:$l"
-done
-[ -z "$l" ] || echo GI_TYPELIB_PATH="$l:${GI_TYPELIB_PATH:-}"
-
-# udev rules
-if [ -n "$(ls $d/lib/udev/rules.d/*.rules 2>/dev/null)" ] && [ -w /run/udev ]; then
-    mkdir -p /run/udev/rules.d
-    cp $d/lib/udev/rules.d/*.rules /run/udev/rules.d/
-    udevadm control --reload
-    udevadm trigger || true
-fi
-''' % {'t': self.scratch, 'pkgs': ' '.join(to_install)}
-        (rc, out, _) = self.execute(['sh', '-euc', script],
-                                    stdout=subprocess.PIPE, kind='install')
-        if rc != 0:
-            self.bomb('failed to download and unpack test dependencies')
-        self.install_tmp_env = [l.strip() for l in out.splitlines() if l]
-        adtlog.debug('install_tmp: env is now %s' % self.install_tmp_env)
-
     def install_click(self, clickpath):
         # copy click into testbed
         tp = Path(self, clickpath, os.path.join(
@@ -1021,6 +905,105 @@ fi
         if self.execute(['sh', adtlog.verbosity >= 2 and '-exc' or '-ec', script], kind='install')[0] != 0:
             self.bomb('Failed to update click AppArmor rules')
 
+    def _run_apt_build_dep(self, what, prefix, recommends, ignorerc=False):
+        '''actually run apt-get build-dep'''
+
+        # capture status-fd to stderr
+        (rc, _, serr) = self.execute(['/bin/sh', '-ec', '%s apt-get build-dep '
+                                      '--assume-yes %s '
+                                      '-o APT::Status-Fd=3 '
+                                      '-o APT::Install-Recommends=%s '
+                                      '-o Dpkg::Options::=--force-confnew '
+                                      '-o Debug::pkgProblemResolver=true 3>&2 2>&1' %
+                                      (prefix, what, recommends)],
+                                     kind='install', stderr=subprocess.PIPE)
+        if not ignorerc and rc != 0:
+            adtlog.debug('apt-get build-dep %s failed; status-fd:\n%s' % (what, serr))
+            # check if apt failed during package download, which might be a
+            # transient error, so retry
+            if 'dlstatus:' in serr and 'pmstatus:' not in serr:
+                raise adtlog.AptDownloadError
+            else:
+                raise adtlog.AptPermanentError
+
+    def satisfy_build_deps(self, source_pkg, recommends=False,
+                           shell_on_failure=False):
+        '''Install build-dependencies into testbed with apt-get build-dep
+
+        This requires root privileges and a writable file system.
+        '''
+        # check if we can use apt-get
+        can_apt_get = False
+        if 'root-on-testbed' in self.caps:
+            rc = self.execute(['test', '-w', '/var/lib/dpkg/status'])[0]
+            if rc == 0:
+                can_apt_get = True
+        adtlog.debug('can use apt-get on testbed: %s' % can_apt_get)
+
+        if not can_apt_get:
+            self.bomb('no root on testbed, unsupported when specifying target architecture')
+
+        what = source_pkg
+        if self.cross_arch:
+            what += ' -a ' + self.cross_arch
+        # install the build-dependencies for the specified source (which can
+        # be a source package name, or a path); our apt pinning is not
+        # very clever wrt. resolving transitional dependencies in the pocket,
+        # so we might need to retry without pinning
+        download_fail_retries = 3
+        while True:
+            rc = 0
+            try:
+                self._run_apt_build_dep(what, ' '.join(self.eatmydata_prefix), recommends)
+
+            # check if apt failed during package download, which might be a
+            # transient error, so retry
+            except adtlog.AptDownloadError:
+                download_fail_retries -= 1
+                if download_fail_retries > 0:
+                    adtlog.warning('apt failed to download packages, retrying in 10s...')
+                    time.sleep(10)
+                    continue
+                else:
+                    self.bomb('apt repeatedly failed to download packages')
+
+            except adtlog.AptPermanentError:
+                rc = -1
+                if shell_on_failure:
+                    self.run_shell()
+
+            if rc != 0:
+                if self.apt_pin_for_releases and self.enable_apt_fallback:
+                    release = self.apt_pin_for_releases.pop()
+                    adtlog.warning('Test dependencies are unsatisfiable using apt pinning. '
+                                   'Retrying using all packages from %s' % release)
+                    self.check_exec(['/bin/sh', '-ec', 'rm /etc/apt/preferences.d/autopkgtest-' + release])
+                    if not self.apt_pin_for_releases:
+                        self.check_exec(['/bin/sh', '-ec', 'rm -f /etc/apt/preferences.d/autopkgtest-default-release'])
+                    continue
+
+                adtlog.warning('Test dependencies are unsatisfiable - calling '
+                               'apt install on test deps directly for further '
+                               'data about failing dependencies in test logs')
+                self._run_apt_build_dep('--simulate ' + what,
+                                        ' '.join(self.eatmydata_prefix),
+                                        recommends, ignorerc=True)
+
+                if shell_on_failure:
+                    self.run_shell()
+                if self.enable_apt_fallback:
+                    self.badpkg('Test dependencies are unsatisfiable. A common reason is '
+                                'that your testbed is out of date with respect to the '
+                                'archive, and you need to use a current testbed or run '
+                                'apt-get update or use -U.')
+                else:
+                    self.badpkg('Test dependencies are unsatisfiable. A common reason is '
+                                'that the requested apt pinning prevented dependencies '
+                                'from the non-default suite to be installed. In that '
+                                'case you need to add those dependencies to the pinning '
+                                'list.')
+            break
+
     def satisfy_dependencies_string(self, deps, what, recommends=False,
                                     build_dep=False, shell_on_failure=False, synth_deps=[]):
         '''Install dependencies from a string into the testbed'''
@@ -1066,7 +1049,22 @@ fi
         if can_apt_get:
             self.install_apt(deps, recommends, shell_on_failure, synth_deps)
         else:
-            self.install_tmp(deps, recommends)
+            has_dpkg_checkbuilddeps = self.execute(
+                ['which', 'dpkg-checkbuilddeps'],
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL
+            )[0] == 0
+            if has_dpkg_checkbuilddeps:
+                rc, _, err = self.execute(
+                    ['dpkg-checkbuilddeps', '-d', deps, "/dev/null"],
+                    stdout=subprocess.PIPE,
+                    stderr=subprocess.PIPE
+                )
+                if rc != 0:
+                    missing = re.sub('dpkg-checkbuilddeps: error: Unmet build dependencies: ', '', err)
+                    self.badpkg('test dependencies missing: %s' % missing)
+            else:
+                adtlog.warning('test dependencies (%s) are not fully satisfied, but continuing anyway since dpkg-checkbuilddeps it not available to determine which ones are missing.' % deps)
 
     def run_shell(self, cwd=None, extra_env=[]):
         '''Run shell in testbed for debugging tests'''
@@ -1270,7 +1268,10 @@ fi
         elif rc == 77 and 'skippable' in test.restrictions:
             test.set_skipped('exit status 77 and marked as skippable')
         elif rc != 0:
-            test.failed('non-zero exit status %d' % rc)
+            if 'needs-internet' in test.restrictions and self.needs_internet == 'try':
+                test.set_skipped("Failed, but test has needs-internet and that's not guaranteed")
+            else:
+                test.failed('non-zero exit status %d' % rc)
         elif se_size != 0 and 'allow-stderr' not in test.restrictions:
             with open(se.host, encoding='UTF-8', errors='replace') as f:
                 stderr_top = f.readline().rstrip('\n \t\r')
@@ -1354,6 +1355,11 @@ fi
                 '''awk '/^Package-List:/ { show=1; next } (/^ / && show==1) { print $1; next } { show=0 }' |''' \
                 '''sort -u | tr '\\n' ' ')"; ''' % \
                 ' '.join(srcpkgs)
+            if self.cross_arch:
+                script += 'PKGS="$PKGS $(apt-cache showsrc %s | ' \
+                    '''awk '/^Package-List:/ { show=1; next } (/^ / && show==1) { print $1 ":%s"; next } { show=0 }' |''' \
+                    '''sort -u | tr '\\n' ' ')"; ''' % \
+                    (' '.join(srcpkgs), self.cross_arch)
 
         # prefer given packages from series, but make sure that other packages
         # are taken from default release as much as possible
@@ -1374,7 +1380,7 @@ fi
         if self.default_release is None:
 
             script = 'SRCS=$(ls /etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null|| true); '
-            script += r'''sed -rn '/^(deb|deb-src) +(\[.*\] *)?(http|https|file):/ { s/\[.*\] +//; s/^[^ ]+ +[^ ]* +([^ -]+) +.*$/\1/p }' $SRCS | head -n1'''
+            script += r'''sed -rn '/^(deb|deb-src) +(\[.*\] *)?(http|https|file):/ { s/\[.*\] +//; s/^[^ ]+ +[^ ]* +([^ ]+) +.*$/\1/p }' $SRCS | head -n1'''
             self.default_release = self.check_exec(['sh', '-ec', script], stdout=True).strip()
 
         return self.default_release
diff --git a/lib/autopkgtest_args.py b/lib/autopkgtest_args.py
index 7fea2d8..5237c6c 100644
--- a/lib/autopkgtest_args.py
+++ b/lib/autopkgtest_args.py
@@ -162,6 +162,13 @@ class ArgumentParser(argparse.ArgumentParser):
         return [arg_line.strip()]
 
 
+class AppendCommaSeparatedArg(argparse.Action):
+    def __call__(self, parser, args, value, option_string=None):
+        result = getattr(args, self.dest, [])
+        result.extend(value.split(','))
+        setattr(args, self.dest, result)
+
+
 def parse_args(arglist=None):
     '''Parse autopkgtest command line arguments.
 
@@ -210,6 +217,11 @@ for details.'''
                         help='Run tests from already installed click package '
                         '(e. g. "com.example.myapp"), from specified click '
                         'source directory or manifest\'s x-source.')
+    g_test.add_argument('-a', '--architecture', metavar='ARCH',
+                        help='run tests for (and when asked, build binaries '
+                        'for) ARCH instead of the testbed host architecture. '
+                        'Assumes ARCH is available as a foreign architecture '
+                        'on the testbed.')
     g_test.add_argument('packages', nargs='*',
                         help='testsrc source package and testbinary packages as above')
 
@@ -247,7 +259,8 @@ for details.'''
                          '{ [ "${O%404*Not Found*}" = "$O" ] || exit 100; sleep 15; apt-get update; }'''
                          ' || { sleep 60; apt-get update; } || false)'
                          ' && $(which eatmydata || true) apt-get dist-upgrade -y -o '
-                         'Dpkg::Options::="--force-confnew"',
+                         'Dpkg::Options::="--force-confnew"'
+                         ' && $(which eatmydata || true) apt-get --purge autoremove -y',
                          help='Run apt update/dist-upgrade before the tests')
     g_setup.add_argument('--setup-commands-boot', metavar='COMMANDS_OR_PATH',
                          action='append', default=[],
@@ -299,6 +312,11 @@ for details.'''
     g_setup.add_argument('--env', metavar='VAR=value',
                          action='append', default=[],
                          help='Set arbitrary environment variable for builds and test')
+    g_setup.add_argument('--ignore-restrictions', default=[],
+                         metavar='RESTRICTION[,RESTRICTION...]',
+                         action=AppendCommaSeparatedArg,
+                         help='Run tests even if these restrictions would '
+                         'normally prevent it')
 
     # privileges
     g_priv = parser.add_argument_group('user/privilege handling options')
@@ -346,6 +364,18 @@ for details.'''
                         help='Set "parallel=N" DEB_BUILD_OPTION for building '
                         'packages (default: number of available processors)')
     g_misc.add_argument(
+        '--needs-internet', dest='needs_internet',
+        choices=['run', 'try', 'skip'],
+        default='run',
+        help='Define how to handle the needs-internet restriction. With "try" '
+        'tests with needs-internet restrictions will be run, but if they fail '
+        'they will be treated as flaky tests. With "skip" these tests will be '
+        'skipped immediately and will not be run. With "run" the restriction '
+        'is basically ignored.')
+    g_misc.add_argument(
+        '-V', '--validate', action='store_true', default=False,
+        help='validate the test control file and exit')
+    g_misc.add_argument(
         '-h', '--help', action='help', default=argparse.SUPPRESS,
         help='show this help message and exit')
 
diff --git a/lib/autopkgtest_qemu.py b/lib/autopkgtest_qemu.py
new file mode 100644
index 0000000..01a652d
--- /dev/null
+++ b/lib/autopkgtest_qemu.py
@@ -0,0 +1,385 @@
+#!/usr/bin/python3
+#
+# This is not a stable API; for use within autopkgtest only.
+#
+# Part of autopkgtest.
+# autopkgtest is a tool for testing Debian binary packages.
+#
+# Copyright 2006-2016 Canonical Ltd.
+# Copyright 2016-2020 Simon McVittie
+# Copyright 2017 Martin Pitt
+# Copyright 2017 Jiri Palecek
+# Copyright 2017-2018 Collabora Ltd.
+# Copyright 2018 Thadeu Lima de Souza Cascardo
+# Copyright 2019 Michael Biebl
+# Copyright 2019 Raphaël Hertzog
+#
+# autopkgtest-virt-qemu was developed by
+# Martin Pitt <[e-mail]>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+# See the file CREDITS for a full list of credits information (often
+# installed as /usr/share/doc/autopkgtest/CREDITS).
+
+import errno
+import fcntl
+import json
+import os
+import re
+import shutil
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+from typing import (
+    List,
+    Optional,
+    Sequence,
+    Union,
+)
+
+import VirtSubproc
+import adtlog
+
+
+def find_free_port(start: int) -> int:
+    '''Find an unused port in the range [start, start+50)'''
+
+    for p in range(start, start + 50):
+        adtlog.debug('find_free_port: trying %i' % p)
+        try:
+            lockfile = '/tmp/autopkgtest-virt-qemu.port.%i' % p
+            f = None
+            try:
+                f = open(lockfile, 'x')
+                os.unlink(lockfile)
+                fcntl.flock(f, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except (IOError, OSError):
+                adtlog.debug('find_free_port: %i is locked' % p)
+                continue
+            finally:
+                if f:
+                    f.close()
+
+            s = socket.create_connection(('127.0.0.1', p))
+            # if that works, the port is taken
+            s.close()
+            continue
+        except socket.error as e:
+            if e.errno == errno.ECONNREFUSED:
+                adtlog.debug('find_free_port: %i is free' % p)
+                return p
+            else:
+                pass
+
+    adtlog.debug('find_free_port: all ports are taken')
+    return 0
+
+
+def get_cpuflag() -> Sequence[str]:
+    '''Return QEMU cpu option list suitable for host CPU'''
+
+    try:
+        with open('/proc/cpuinfo', 'r') as f:
+            for line in f:
+                if line.startswith('flags'):
+                    words = line.split()
+                    if 'vmx' in words:
+                        adtlog.debug(
+                            'Detected KVM capable Intel host CPU, '
+                            'enabling nested KVM'
+                        )
+                        return ['-cpu', 'kvm64,+vmx,+lahf_lm']
+                    elif 'svm' in words:  # AMD kvm
+                        adtlog.debug(
+                            'Detected KVM capable AMD host CPU, '
+                            'enabling nested KVM'
+                        )
+                        # FIXME: this should really be the one below
+                        # for more reproducible testbeds, but nothing
+                        # except -cpu host works
+                        # return ['-cpu', 'kvm64,+svm,+lahf_lm']
+                        return ['-cpu', 'host']
+    except IOError as e:
+        adtlog.warning(
+            'Cannot read /proc/cpuinfo to detect CPU flags: %s' % e
+        )
+        # fetching CPU flags isn't critical (only used to enable
+        # nested KVM), so don't fail here
+
+    return []
+
+
+class QemuImage:
+    def __init__(
+        self,
+        file: str,
+        format: Optional[str] = None,
+        readonly: bool = False,
+    ) -> None:
+        self.file = file
+        self.overlay = None     # type: Optional[str]
+        self.readonly = readonly
+
+        if format is not None:
+            self.format = format
+        else:
+            info = json.loads(
+                VirtSubproc.check_exec([
+                    'qemu-img', 'info',
+                    '--output=json',
+                    self.file,
+                ], outp=True, timeout=5)
+            )
+
+            if 'format' not in info:
+                VirtSubproc.bomb('Unable to determine format of %s' % self.file)
+
+            self.format = str(info['format'])
+
+    def __str__(self) -> str:
+        bits = []   # type: List[str]
+
+        if self.overlay is None:
+            bits.append('file={}'.format(self.file))
+        else:
+            bits.append('file={}'.format(self.overlay))
+            bits.append('cache=unsafe')
+
+        bits.append('if=virtio')
+        bits.append('discard=unmap')
+        bits.append('format={}'.format(self.format))
+
+        if self.readonly:
+            bits.append('readonly')
+
+        return ','.join(bits)
+
+
+class Qemu:
+    def __init__(
+        self,
+        images: Sequence[Union[QemuImage, str]],
+        qemu_command: str,
+        cpus: int = 1,
+        efi: bool = False,
+        overlay: bool = False,
+        overlay_dir: Optional[str] = None,
+        qemu_options: Sequence[str] = (),
+        ram_size: int = 1024,
+        workdir: Optional[str] = None,
+    ) -> None:
+        """
+        Constructor.
+
+        images: Disk images for the VM. The first image is assumed to be
+            the bootable, writable root filesystem, and we actually boot a
+            snapshot. The remaining images are assumed to be read-only.
+        qemu_command: qemu executable
+
+        cpus: Number of vCPUs
+        efi: If true, boot using OVMF/AAVMF firmware (x86/ARM only)
+        overlay: If true, use a temporary overlay for first image
+        overlay_dir: Store writable overlays here (default: workdir)
+        qemu_options: Space-separated options for qemu
+        ram_size: Amount of RAM in MiB
+        workdir: Directory for temporary files (default: a random
+            subdirectory of $TMPDIR)
+        """
+
+        self.cpus = cpus
+        self.images = []    # type: List[QemuImage]
+        self.overlay_dir = overlay_dir
+        self.qemu_command = qemu_command
+        self.ram_size = ram_size
+        self.ssh_port = find_free_port(10022)
+
+        if workdir is None:
+            workdir = tempfile.mkdtemp(prefix='autopkgtest-qemu.')
+
+        self.workdir = workdir      # type: Optional[str]
+        os.chmod(workdir, 0o755)
+        self.shareddir = os.path.join(workdir, 'shared')
+        os.mkdir(self.shareddir)
+        self.monitor_socket_path = os.path.join(workdir, 'monitor')
+        self.ttys0_socket_path = os.path.join(workdir, 'ttyS0')
+        self.ttys1_socket_path = os.path.join(workdir, 'ttyS1')
+
+        for i, image in enumerate(images):
+            if isinstance(image, QemuImage):
+                self.images.append(image)
+            else:
+                assert isinstance(image, str)
+
+                self.images.append(
+                    QemuImage(
+                        file=image,
+                        format=None,
+                        readonly=(i != 0),
+                    )
+                )
+
+        if overlay:
+            self.images[0].overlay = self.prepare_overlay(self.images[0])
+
+        if self.ssh_port:
+            adtlog.debug(
+                'Forwarding local port %i to VM ssh port 22' % self.ssh_port
+            )
+            nic_opt = ',hostfwd=tcp:127.0.0.1:%i-:22' % self.ssh_port
+        else:
+            nic_opt = ''
+
+        # start QEMU
+        argv = [
+            qemu_command,
+            '-m', str(ram_size),
+            '-smp', str(cpus),
+            '-nographic',
+            '-net', 'nic,model=virtio',
+            '-net', 'user' + nic_opt,
+            '-object', 'rng-random,filename=/dev/urandom,id=rng0',
+            '-device', 'virtio-rng-pci,rng=rng0,id=rng-device0',
+            '-monitor', 'unix:%s,server,nowait' % self.monitor_socket_path,
+            '-serial', 'unix:%s,server,nowait' % self.ttys0_socket_path,
+            '-serial', 'unix:%s,server,nowait' % self.ttys1_socket_path,
+            '-virtfs',
+            (
+                'local,id=autopkgtest,path=%s,security_model=none,'
+                'mount_tag=autopkgtest'
+            ) % self.shareddir,
+        ]
+
+        for i, image in enumerate(self.images):
+            argv.append('-drive')
+            argv.append('index=%d,%s' % (i, image))
+
+        if efi:
+            if 'qemu-system-x86_64' in qemu_command or \
+                    'qemu-system-i386' in qemu_command:
+                code = '/usr/share/OVMF/OVMF_CODE.fd'
+                data = '/usr/share/OVMF/OVMF_VARS.fd'
+            elif 'qemu-system-aarch64' in qemu_command:
+                code = '/usr/share/AAVMF/AAVMF_CODE.fd'
+                data = '/usr/share/AAVMF/AAVMF_VARS.fd'
+            elif 'qemu-system-arm' in qemu_command:
+                code = '/usr/share/AAVMF/AAVMF32_CODE.fd'
+                data = '/usr/share/AAVMF/AAVMF32_VARS.fd'
+            else:
+                VirtSubproc.bomb('Unknown architecture for EFI boot')
+
+            shutil.copy(data, '%s/efivars.fd' % workdir)
+            argv.append('-drive')
+            argv.append('if=pflash,format=raw,read-only,file=' + code)
+            argv.append('-drive')
+            argv.append(
+                'if=pflash,format=raw,file=%s/efivars.fd' % workdir
+            )
+
+        if os.path.exists('/dev/kvm'):
+            argv.append('-enable-kvm')
+            # Enable nested KVM by default on x86_64
+            if (
+                os.uname()[4] == 'x86_64' and
+                self.qemu_command == 'qemu-system-x86_64' and
+                '-cpu' not in qemu_options
+            ):
+                argv += get_cpuflag()
+
+        # pass through option to qemu
+        if qemu_options:
+            argv.extend(qemu_options)
+
+        self.subprocess = subprocess.Popen(
+            argv,
+            stdin=subprocess.DEVNULL,
+            stdout=sys.stderr,
+            stderr=subprocess.STDOUT,
+        )   # type: Optional[subprocess.Popen[bytes]]
+
+    @staticmethod
+    def get_default_qemu_command(
+        uname_m: Optional[str] = None
+    ) -> str:
+        uname_to_qemu_suffix = {'i[3456]86$': 'i386', '^arm': 'arm'}
+
+        if uname_m is None:
+            uname_m = os.uname()[4]
+
+        for pattern, suffix in uname_to_qemu_suffix.items():
+            if re.match(pattern, uname_m):
+                return 'qemu-system-' + suffix
+                break
+        else:
+            return 'qemu-system-' + uname_m
+
+    @property
+    def monitor_socket(self):
+        return VirtSubproc.get_unix_socket(self.monitor_socket_path)
+
+    @property
+    def ttys0_socket(self):
+        return VirtSubproc.get_unix_socket(self.ttys0_socket_path)
+
+    @property
+    def ttys1_socket(self):
+        return VirtSubproc.get_unix_socket(self.ttys1_socket_path)
+
+    def prepare_overlay(
+        self,
+        image: QemuImage,
+    ) -> str:
+        '''Generate a temporary overlay image'''
+
+        # generate a temporary overlay
+        if self.overlay_dir is not None:
+            overlay = os.path.join(
+                self.overlay_dir,
+                os.path.basename(image.file) + '.overlay-%s' % time.time()
+            )
+        else:
+            workdir = self.workdir
+            assert workdir is not None
+            overlay = os.path.join(workdir, 'overlay.img')
+
+        adtlog.debug('Creating temporary overlay image in %s' % overlay)
+        VirtSubproc.check_exec(
+            [
+                'qemu-img', 'create',
+                '-f', 'qcow2',
+                '-F', image.format,
+                '-b', os.path.abspath(image.file),
+                overlay,
+            ],
+            outp=True,
+            timeout=300,
+        )
+        return overlay
+
+    def cleanup(self) -> Optional[int]:
+        ret = None
+
+        if self.subprocess is not None:
+            self.subprocess.terminate()
+            ret = self.subprocess.wait()
+            self.subprocess = None
+
+        if self.workdir is not None:
+            shutil.rmtree(self.workdir)
+            self.workdir = None
+
+        return ret
diff --git a/lib/testdesc.py b/lib/testdesc.py
index 84d24db..c8c9741 100644
--- a/lib/testdesc.py
+++ b/lib/testdesc.py
@@ -44,7 +44,7 @@ known_restrictions = ['rw-build-tree', 'breaks-testbed', 'needs-root',
                       'build-needed', 'allow-stderr', 'isolation-container',
                       'isolation-machine', 'needs-recommends', 'needs-reboot',
                       'flaky', 'skippable', 'superficial',
-                      'skip-not-installable']
+                      'skip-not-installable', 'needs-internet']
 
 
 class Unsupported(Exception):
@@ -99,9 +99,6 @@ class Test:
         '''
         if '/' in name:
             raise Unsupported(name, 'test name may not contain / character')
-        for r in restrictions:
-            if r not in known_restrictions:
-                raise Unsupported(name, 'unknown restriction %s' % r)
 
         if not ((path is None) ^ (command is None)):
             raise InvalidControl(name, 'Test must have either path or command')
@@ -151,42 +148,54 @@ class Test:
         else:
             adtlog.report(self.name, 'FAIL ' + reason)
 
-    def check_testbed_compat(self, caps):
+    def check_testbed_compat(self, caps, ignore_restrictions=()):
         '''Check for restrictions incompatible with test bed capabilities.
 
         Raise Unsupported exception if there are any.
         '''
-        if 'isolation-container' in self.restrictions and \
+        effective = set(self.restrictions) - set(ignore_restrictions)
+
+        for r in effective:
+            if r not in known_restrictions:
+                raise Unsupported(self.name, 'unknown restriction %s' % r)
+
+        if 'isolation-container' in effective and \
            'isolation-container' not in caps and \
            'isolation-machine' not in caps:
             raise Unsupported(self.name,
                               'Test requires container-level isolation but '
                               'testbed does not provide that')
 
-        if 'isolation-machine' in self.restrictions and \
+        if 'isolation-machine' in effective and \
            'isolation-machine' not in caps:
             raise Unsupported(self.name,
                               'Test requires machine-level isolation but '
                               'testbed does not provide that')
 
-        if 'breaks-testbed' in self.restrictions and \
+        if 'breaks-testbed' in effective and \
            'revert-full-system' not in caps:
             raise Unsupported(self.name,
                               'Test breaks testbed but testbed does not '
                               'provide revert-full-system')
 
-        if 'needs-root' in self.restrictions and \
+        if 'needs-root' in effective and \
            'root-on-testbed' not in caps:
             raise Unsupported(self.name,
                               'Test needs root on testbed which is not '
                               'available')
 
-        if 'needs-reboot' in self.restrictions and \
+        if 'needs-reboot' in effective and \
            'reboot' not in caps:
             raise Unsupported(self.name,
                               'Test needs to reboot testbed but testbed does '
                               'not provide reboot capability')
 
+        if 'needs-internet' in self.restrictions and \
+           'has_internet' not in caps:
+            raise Unsupported(self.name,
+                              'Test needs unrestricted internet access but testbed does '
+                              'not provide it')
+
 #
 # Parsing for Debian source packages
 #
@@ -234,12 +243,12 @@ def parse_rfc822(path):
 def _debian_check_unknown_fields(name, record):
     unknown_keys = set(record.keys()).difference(
         {'Tests', 'Test-command', 'Restrictions', 'Features',
-         'Depends', 'Tests-directory', 'Classes'})
+         'Depends', 'Tests-directory', 'Classes', 'Architecture'})
     if unknown_keys:
         raise Unsupported(name, 'unknown field %s' % unknown_keys.pop())
 
 
-def _debian_packages_from_source(srcdir):
+def _debian_packages_from_source(srcdir, cross_arch=None):
     packages = []
     packages_no_arch = []
 
@@ -252,10 +261,17 @@ def _debian_packages_from_source(srcdir):
                 st.get('Package-type', 'deb') != 'deb':
             continue
         arch = st['Architecture']
-        if arch in ('all', 'any'):
+        qual_pkg = st['Package']
+        # take care to emit an arch qualifier only for arch-dependent
+        # packages, not for arch: all ones
+        if cross_arch:
+            qual_pkg += ':' + cross_arch
+        if arch == 'all':
             packages.append(st['Package'])
+        elif arch == 'any':
+            packages.append(qual_pkg)
         else:
-            packages.append('%s [%s]' % (st['Package'], arch))
+            packages.append('%s [%s]' % (qual_pkg, arch))
         packages_no_arch.append(st['Package'])
 
     return (packages, packages_no_arch)
@@ -291,7 +307,7 @@ def _debian_build_deps_from_source(srcdir, testbed_arch):
     deps = [d.strip() for d in deps.split(',')]
 
     # @builddeps@ should always imply build-essential
-    deps.append('build-essential')
+    deps.append('build-essential:native')
     return deps
 
 
@@ -353,7 +369,8 @@ def _synthesize_deps(dep, testbed_arch):
         return None
 
 
-def _parse_debian_depends(testname, dep_str, srcdir, testbed_arch):
+def _parse_debian_depends(testname, dep_str, srcdir, testbed_arch,
+                          cross_arch=None):
     '''Parse Depends: line in a Debian package
 
     Split dependencies (comma separated), validate their syntax, and expand @
@@ -364,7 +381,12 @@ def _parse_debian_depends(testname, dep_str, srcdir, testbed_arch):
     '''
     deps = []
     synthdeps = []
-    (my_packages, my_packages_no_arch) = _debian_packages_from_source(srcdir)
+    (my_packages, my_packages_no_arch) = _debian_packages_from_source(srcdir,
+                                                                      cross_arch=cross_arch)
+    if cross_arch:
+        target_arch = cross_arch
+    else:
+        target_arch = testbed_arch
     for alt_group_str in dep_str.split(','):
         alt_group_str = alt_group_str.strip()
         if not alt_group_str:
@@ -375,13 +397,25 @@ def _parse_debian_depends(testname, dep_str, srcdir, testbed_arch):
             for d in my_packages:
                 adtlog.debug('synthesised dependency %s' % d)
                 deps.append(d)
-                s = _synthesize_deps(d, testbed_arch)
+                s = _synthesize_deps(d, target_arch)
                 if s:
                     synthdeps.append(s)
         elif alt_group_str == '@builddeps@':
             for d in _debian_build_deps_from_source(srcdir, testbed_arch):
                 adtlog.debug('synthesised dependency %s' % d)
                 deps.append(d)
+        elif alt_group_str == 'build-essential':
+            # special case; this is how packages declare they want to build
+            # code during the test (but not necessarily doing a full package
+            # build), but for cross-architecture testing this declaration is
+            # wrong because it tries to pull in build-essential for the wrong
+            # arch.  So we apply the same fix-up here that we do in
+            # runner/autopkgtest.  We can't expect the package maintainer to
+            # do this because they don't know what crossbuild-essential-$arch
+            # to pull in.
+            deps.append('build-essential:native')
+            if cross_arch:
+                deps.append('crossbuild-essential-%s:native' % cross_arch)
         else:
             synthdep_alternatives = []
             for dep in alt_group_str.split('|'):
@@ -389,8 +423,10 @@ def _parse_debian_depends(testname, dep_str, srcdir, testbed_arch):
                 if pkg not in my_packages_no_arch:
                     synthdep_alternatives = []
                     break
-                s = _synthesize_deps(dep, testbed_arch)
+                s = _synthesize_deps(dep, target_arch)
                 if s:
+                    if cross_arch:
+                        s += ':' + cross_arch
                     synthdep_alternatives.append(s)
             if synthdep_alternatives:
                 adtlog.debug('marked alternatives %s as a synthesised dependency' % synthdep_alternatives)
@@ -398,6 +434,13 @@ def _parse_debian_depends(testname, dep_str, srcdir, testbed_arch):
                     synthdeps.append(synthdep_alternatives)
                 else:
                     synthdeps.append(synthdep_alternatives[0])
+            if cross_arch:
+                for mine in my_packages:
+                    # ignore [arch] filters for matching packages
+                    if alt_group_str + ':' + cross_arch == mine.split(' ')[0]:
+                        adtlog.debug('%s is from our source package, adding arch qualifier for cross-testing' % s)
+                        alt_group_str += ':' + cross_arch
+                        break
             deps.append(alt_group_str)
 
     return (deps, synthdeps)
@@ -428,10 +471,74 @@ def _autodep8(srcdir):
     return None
 
 
+def _matches_architecture(host_arch, arch_wildcard):
+    try:
+        subprocess.check_call(['perl', '-mDpkg::Arch', '-e',
+                               'exit(!Dpkg::Arch::debarch_is(shift, shift))',
+                               host_arch, arch_wildcard])
+    except subprocess.CalledProcessError as e:
+        # returns 1 if host_arch is not matching arch_wildcard; other
+        # errors shouldn't be ignored
+        if e.returncode != 1:
+            raise
+        return False
+    return True
+
+
+def _check_architecture(name, testbed_arch, architectures):
+    '''Check if testbed_arch is supported by the architectures
+
+    The architecture list comes in two variants, positive: only this
+    arch is supported (arch may be a wildcard) and negative: this arch
+    is not supported (arch may be a wildcard). If there is any
+    positive arch, every arch not explicitly listed is skipped. Debian
+    Policy 7.1 explains that for (Build-)Depends it's not allowed to
+    mix positive and negative, so let's not do either. The list can
+    also be empty. Empty and ["any"] are the same, "all" isn't
+    allowed.
+    '''
+
+    if "all" in architectures:
+        raise Unsupported(name, "Arch 'all' not allowed in Architecture field")
+
+    if len(architectures) == 0 or architectures == ["any"]:
+        return
+
+    any_negative = False
+    any_positive = False
+    for arch in architectures:
+        if arch[0] == "!":
+            any_negative = True
+            if _matches_architecture(testbed_arch, arch[1:]):
+                raise Unsupported(name, "Test declares architecture as not " +
+                                  "supported: %s" % testbed_arch)
+        if arch[0] != "!":
+            any_positive = True
+
+    if any_positive:
+        if any_negative:
+            raise Unsupported(name, "It is not permitted for some archs to " +
+                              "be prepended by an exclamation mark while " +
+                              "others aren't")
+        arch_matched = False
+        for arch in architectures:
+            if _matches_architecture(testbed_arch, arch):
+                arch_matched = True
+
+        if not arch_matched:
+            raise Unsupported(name, "Test lists explicitly supported " +
+                              "architectures, but the current architecture " +
+                              "%s isn't listed." % testbed_arch)
+
+
 def parse_debian_source(srcdir, testbed_caps, testbed_arch, control_path=None,
-                        auto_control=True):
+                        auto_control=True, cross_arch=None, ignore_restrictions=(),
+                        testname=None):
     '''Parse test descriptions from a Debian DEP-8 source dir
 
+    @ignore_restrictions: If we would skip the test due to these restrictions,
+                          run it anyway
+
     You can specify an alternative path for the control file (default:
     srcdir/debian/tests/control).
 
@@ -496,14 +603,18 @@ def parse_debian_source(srcdir, testbed_caps, testbed_arch, control_path=None,
                         '*', 'only one test-name feature allowed')
                 feature_test_name = details[1]
                 features.append(feature)
+            architectures = record.get('Architecture', '').replace(
+                ',', ' ').split()
 
             if 'Tests' in record:
                 test_names = record['Tests'].replace(',', ' ').split()
+                if len(test_names) == 0:
+                    raise InvalidControl('*', '"Tests" field is empty')
                 (depends, synth_depends) = _parse_debian_depends(
                     test_names[0],
                     record.get('Depends', '@'),
                     srcdir,
-                    testbed_arch)
+                    testbed_arch, cross_arch=cross_arch)
                 if 'Test-command' in record:
                     raise InvalidControl('*', 'Only one of "Tests" or '
                                          '"Test-Command" may be given')
@@ -515,12 +626,15 @@ def parse_debian_source(srcdir, testbed_caps, testbed_arch, control_path=None,
                 for n in test_names:
                     try:
                         _debian_check_unknown_fields(n, record)
+                        _check_architecture(n, testbed_arch, architectures)
+
                         test = Test(n, os.path.join(test_dir, n), None,
                                     restrictions, features, depends, [], [], synth_depends)
-                        test.check_testbed_compat(testbed_caps)
+                        test.check_testbed_compat(testbed_caps, ignore_restrictions)
                     except Unsupported as u:
-                        u.report()
-                        some_skipped = True
+                        if testname is None or n == testname:
+                            u.report()
+                            some_skipped = True
                     else:
                         tests.append(test)
             elif 'Test-command' in record:
@@ -529,23 +643,25 @@ def parse_debian_source(srcdir, testbed_caps, testbed_arch, control_path=None,
                     command,
                     record.get('Depends', '@'),
                     srcdir,
-                    testbed_arch)
+                    testbed_arch, cross_arch=cross_arch)
                 if feature_test_name is None:
                     command_counter += 1
                     name = 'command%i' % command_counter
                 else:
                     name = feature_test_name
                 _debian_check_unknown_fields(name, record)
+                _check_architecture(name, testbed_arch, architectures)
                 test = Test(name, None, command, restrictions, features,
                             depends, [], [], synth_depends)
-                test.check_testbed_compat(testbed_caps)
+                test.check_testbed_compat(testbed_caps, ignore_restrictions)
                 tests.append(test)
             else:
                 raise InvalidControl('*', 'missing "Tests" or "Test-Command"'
                                      ' field')
         except Unsupported as u:
-            u.report()
-            some_skipped = True
+            if testname is None or n == testname:
+                u.report()
+                some_skipped = True
 
     return (tests, some_skipped)
 
@@ -555,7 +671,7 @@ def parse_debian_source(srcdir, testbed_caps, testbed_arch, control_path=None,
 #
 
 def parse_click_manifest(manifest, testbed_caps, clickdeps, use_installed,
-                         srcdir=None):
+                         srcdir=None, ignore_restrictions=(), testname=None):
     '''Parse test descriptions from a click manifest.
 
     @manifest: String with the click manifest
@@ -563,6 +679,9 @@ def parse_click_manifest(manifest, testbed_caps, clickdeps, use_installed,
     @clickdeps: paths of click packages that these tests need
     @use_installed: True if test expects the described click to be installed
                     already
+    @ignore_restrictions: If we would skip the test due to these restrictions,
+                          run it anyway
+    @testname: If we're asked a specific test, don't report on others
 
     Return (source_dir, list of Test objects, some_skipped). If this encounters
     any invalid restrictions, fields, or test restrictions which cannot be met
@@ -628,11 +747,12 @@ def parse_click_manifest(manifest, testbed_caps, clickdeps, use_installed,
             test = Test(name, desc.get('path'), desc.get('command'),
                         desc.get('restrictions', []), desc.get('features', []),
                         desc.get('depends', []), clickdeps, installed_clicks, [])
-            test.check_testbed_compat(testbed_caps)
+            test.check_testbed_compat(testbed_caps, ignore_restrictions)
             tests.append(test)
         except Unsupported as u:
-            u.report()
-            some_skipped = True
+            if testname is None or name == testname:
+                u.report()
+                some_skipped = True
 
     if srcdir is None:
         # do we have an x-source/vcs-bzr link?
@@ -659,7 +779,7 @@ def parse_click_manifest(manifest, testbed_caps, clickdeps, use_installed,
     return (srcdir, tests, some_skipped)
 
 
-def parse_click(clickpath, testbed_caps, srcdir=None):
+def parse_click(clickpath, testbed_caps, srcdir=None, testname=None):
     '''Parse test descriptions from a click package.
 
     Return (source_dir, list of Test objects, some_skipped). If this encounters
@@ -681,4 +801,4 @@ def parse_click(clickpath, testbed_caps, srcdir=None):
         pkg.close()
 
     return parse_click_manifest(manifest, testbed_caps, [clickpath], False,
-                                srcdir)
+                                srcdir, testname=testname)
diff --git a/runner/autopkgtest b/runner/autopkgtest
index 93c6e61..22f796c 100755
--- a/runner/autopkgtest
+++ b/runner/autopkgtest
@@ -31,7 +31,7 @@ import os
 import shutil
 import atexit
 import json
-import pipes
+import shlex
 
 from debian import deb822
 
@@ -159,12 +159,16 @@ def run_tests(tests, tree):
         binaries.publish()
         doTest = True
         try:
-            testbed.install_deps(t.depends, 'needs-recommends' in t.restrictions, opts.shell_fail, t.synth_depends)
+            testbed.install_deps(t.depends,
+                                 'needs-recommends' in t.restrictions,
+                                 opts.shell_fail, t.synth_depends)
         except adtlog.BadPackageError as e:
             if 'skip-not-installable' in t.restrictions:
                 errorcode |= 2
                 adtlog.report(t.name, 'SKIP installation fails and skip-not-installable set')
             else:
+                if opts.shell_fail:
+                    testbed.run_shell()
                 errorcode |= 12
                 adtlog.report(t.name, 'FAIL badpkg')
                 adtlog.preport('blame: ' + ' '.join(blamed))
@@ -200,7 +204,7 @@ def run_tests(tests, tree):
 def create_testinfo(vserver_args):
     global testbed
 
-    info = {'virt_server': ' '.join([pipes.quote(w) for w in vserver_args])}
+    info = {'virt_server': ' '.join([shlex.quote(w) for w in vserver_args])}
 
     if testbed.initial_kernel_version:
         info['kernel_version'] = testbed.initial_kernel_version
@@ -388,6 +392,12 @@ def build_source(kind, arg, built_binaries):
         return tests_tree
 
     elif kind == 'apt-source':
+        # Make sure we are selecting the binaries based on the actual target
+        # architecture, not necessarily the testbed architecture
+        if opts.architecture:
+            arch = opts.architecture
+        else:
+            arch = testbed.dpkg_arch
         # The default is to determine the version for "apt-get source
         # pkg=version" that conforms to the current apt pinning. We only
         # consider binaries which are shipped in all available versions,
@@ -443,7 +453,7 @@ pkgs=$(echo "$pkgs\n" | awk "
     if (foundarch == 0 || archmatch == 1) thissrc[\\$1] = 1;
     next }
   { if (!inlist) next;
-    inlist=0;''' % {'src': arg, 'arch': testbed.dpkg_arch}
+    inlist=0;''' % {'src': arg, 'arch': arch}
 
         create_command_part2_check_all_pkgs = '''
     remaining=0;
@@ -580,24 +590,8 @@ dpkg-source -x %(src)s_*.dsc src >/dev/null''' % {'src': arg}
         if kind not in ['dsc', 'apt-source']:
             testbed.install_deps([], False)
 
-        if kind in ('apt-source', 'git-source'):
-            # we need to get the downloaded debian/control from the testbed, so
-            # that we can avoid calling "apt-get build-dep" and thus
-            # introducing a second mechanism for installing build deps
-            pkg_control = adt_testbed.Path(testbed,
-                                           os.path.join(tmp, 'apt-control'),
-                                           os.path.join(result_pwd, 'debian/control'), False)
-            pkg_control.copyup()
-            dsc = pkg_control.host
-
-        with open(dsc, encoding='UTF-8') as f:
-            d = deb822.Deb822(sequence=f)
-            bd = d.get('Build-Depends', '')
-            bdi = d.get('Build-Depends-Indep', '')
-            bda = d.get('Build-Depends-Arch', '')
-
         # determine build command and build-essential packages
-        build_essential = ['build-essential']
+        build_essential = ['build-essential:native']
         assert testbed.nproc
         dpkg_buildpackage = 'DEB_BUILD_OPTIONS="parallel=%s $DEB_BUILD_OPTIONS" dpkg-buildpackage -us -uc -b' % (
             opts.build_parallel or testbed.nproc)
@@ -607,8 +601,46 @@ dpkg-source -x %(src)s_*.dsc src >/dev/null''' % {'src': arg}
             if testbed.user or 'root-on-testbed' not in testbed.caps:
                 build_essential += ['fakeroot']
 
-        testbed.satisfy_dependencies_string(bd + ', ' + bdi + ', ' + bda + ', ' + ', '.join(build_essential), arg,
-                                            build_dep=True, shell_on_failure=opts.shell_fail)
+        if opts.architecture:
+            dpkg_buildpackage += ' -a' + opts.architecture
+            build_essential += ['crossbuild-essential-%s:native' % opts.architecture]
+            # apt-get build-dep is the best option here, but we don't call
+            # it unconditionally because it doesn't take a path to a source
+            # package as an option in very old releases; so for compatibility
+            # only use it when we need its multiarch build-dep resolution
+            # support.
+            # This is supported in apt 1.1~exp2 and newer, which covers
+            # Debian oldstable (at time of writing) and Ubuntu 16.04 and
+            # newer, so once we can rely on this version of apt everywhere,
+            # the old build-dep resolver code should be deprecated.
+            all_build_deps = ''
+            testbed.satisfy_build_deps(result_pwd,
+                                       shell_on_failure=opts.shell_fail)
+        else:
+            if kind in ('apt-source', 'git-source'):
+                # we need to get the downloaded debian/control from the
+                # testbed, so that we can avoid calling "apt-get build-dep"
+                # and thus introducing a second mechanism for installing
+                # build deps
+                pkg_control = adt_testbed.Path(testbed,
+                                               os.path.join(tmp, 'apt-control'),
+                                               os.path.join(result_pwd, 'debian/control'), False)
+                pkg_control.copyup()
+                dsc = pkg_control.host
+
+            with open(dsc, encoding='UTF-8') as f:
+                d = deb822.Deb822(sequence=f)
+                bd = d.get('Build-Depends', '')
+                bdi = d.get('Build-Depends-Indep', '')
+                bda = d.get('Build-Depends-Arch', '')
+
+            all_build_deps = bd + ', ' + bdi + ', ' + bda + ', '
+
+        testbed.satisfy_dependencies_string(all_build_deps +
+                                            ', '.join(build_essential),
+                                            arg,
+                                            build_dep=True,
+                                            shell_on_failure=opts.shell_fail)
 
         # keep patches applied for tests
         source_rules_command([dpkg_buildpackage, 'dpkg-source --before-build .'], 'build', cwd=result_pwd)
@@ -704,7 +736,8 @@ def process_actions():
                     clicks.append(arg)
                     use_installed = True
                 (srcdir, tests, skipped) = testdesc.parse_click_manifest(
-                    manifest, testbed.caps, clicks, use_installed, pending_click_source)
+                    manifest, testbed.caps, clicks, use_installed, pending_click_source,
+                    opts.ignore_restrictions, testname=testname)
 
             elif os.path.exists(arg):
                 # local .click package file
@@ -718,7 +751,8 @@ def process_actions():
                     u = []
                 manifest = testbed.check_exec(['click', 'info'] + u + [arg], stdout=True)
                 (srcdir, tests, skipped) = testdesc.parse_click_manifest(
-                    manifest, testbed.caps, [], True, pending_click_source)
+                    manifest, testbed.caps, [], True, pending_click_source,
+                    opts.ignore_restrictions, testname=testname)
 
             if not srcdir:
                 adtlog.bomb('No click source available for %s' % arg)
@@ -733,10 +767,17 @@ def process_actions():
                 (tests, skipped) = testdesc.parse_debian_source(
                     tests_tree.host, testbed.caps, testbed.dpkg_arch,
                     control_path=control_override,
-                    auto_control=opts.auto_control)
+                    auto_control=opts.auto_control,
+                    ignore_restrictions=opts.ignore_restrictions,
+                    testname=testname,
+                    cross_arch=opts.architecture)
             except testdesc.InvalidControl as e:
                 adtlog.badpkg(str(e))
 
+        if opts.validate:
+            adtlog.report("*", "Test specification is valid")
+            return
+
         if skipped:
             errorcode |= 2
 
@@ -776,27 +817,35 @@ def main():
     signal.signal(signal.SIGTERM, signal_handler)
     signal.signal(signal.SIGQUIT, signal_handler)
 
+    os.set_blocking(sys.stderr.fileno(), True)
+
     try:
         setup_trace()
         testbed = adt_testbed.Testbed(vserver_argv=vserver_args,
                                       output_dir=tmp,
                                       user=opts.user,
+                                      shell_fail=opts.shell_fail,
                                       setup_commands=opts.setup_commands,
                                       setup_commands_boot=opts.setup_commands_boot,
                                       add_apt_pockets=opts.apt_pocket,
                                       copy_files=opts.copy,
                                       enable_apt_fallback=opts.enable_apt_fallback,
+                                      needs_internet=opts.needs_internet,
                                       add_apt_sources=getattr(opts, 'add_apt_sources', []),
                                       add_apt_releases=getattr(opts, 'add_apt_releases', []),
                                       pin_packages=opts.pin_packages,
-                                      apt_default_release=opts.apt_default_release)
+                                      apt_default_release=opts.apt_default_release,
+                                      cross_arch=opts.architecture)
         testbed.start()
         testbed.open()
         process_actions()
     except Exception:
         errorcode = print_exception(sys.exc_info(), '')
     if tmp:
-        create_testinfo(vserver_args)
+        try:
+            create_testinfo(vserver_args)
+        except Exception:
+            errorcode = print_exception(sys.exc_info(), '')
     cleanup()
     sys.exit(errorcode)
 
diff --git a/runner/autopkgtest.1 b/runner/autopkgtest.1
index ce4a1bf..5395fc5 100644
--- a/runner/autopkgtest.1
+++ b/runner/autopkgtest.1
@@ -136,6 +136,13 @@ autopkgtest --installed-click com.example.myclick -- [...]
 .SH TEST OPTIONS
 
 .TP
+.BR -a " ARCH" " | --architecture=" ARCH
+
+Run tests for the specified architecture, rather than for the host
+architecture as defined by dpkg \-\-print-architecture. When building
+packages from source, cross-build for the target architecture as well.
+
+.TP
 .BR -B " | " --no-built-binaries
 Binaries from unbuilt source packages (see above)
 will not be built or ignored, and dependencies are satisfied with packages from
@@ -335,6 +342,22 @@ Disable the apt-get fallback which is used with \fB\-\-apt-pocket\fR or
 \fB\-\-pin-packages\fR in case installation of dependencies fails due
 to strict pinning.
 
+.TP
+.BI \-\-ignore\-restrictions= RESTRICTION , RESTRICTION...
+If a test would normally be skipped because it has
+.BI "Restrictions: " RESTRICTION\fR,
+run it anyway. Can be specified multiple times.
+
+For example, you might ignore the restriction
+.B isolation\-machine
+when using the
+.B null
+virtualization server if you know that
+.B autopkgtest
+itself is running on an expendable virtual machine. These options also
+work for unknown restrictions, so they can be used when experimenting
+with new restrictions.
+
 .SH USER/PRIVILEGE HANDLING OPTIONS
 
 .TP
@@ -425,6 +448,17 @@ available processors. This is mostly useful in containers where you can
 restrict the available RAM, but not restrict the number of CPUs.
 
 .TP
+.BI "--needs-internet=" run | try | skip
+Define how to handle the needs\-internet restriction. With "try" tests with
+needs-internet restrictions will be run, but if they fail they will be treated
+as flaky tests. With "skip" these tests will skipped immediately and will not
+be run. With "run" the restriction is basically ignored, this is the default.
+
+.TP
+.BR \-V | \-\-validate
+Validate the test control file and exit without running any tests.
+
+.TP
 .BR \-h | \-\-help
 Show command line help and exit.
 
diff --git a/setup-commands/ro-apt b/setup-commands/ro-apt
index 126ffaf..0995a80 100644
--- a/setup-commands/ro-apt
+++ b/setup-commands/ro-apt
@@ -10,10 +10,10 @@
 
 set -e
 M=$(mktemp --directory /run/ro-apt.XXXXX)
-mount -t tmpfs tmpfs $M
-cp -a /var/lib/dpkg/status /var/lib/dpkg/lock $M
-cp -a /var/cache/apt $M/cache_apt
-mount -o remount,ro $M
-mount -o bind,ro $M/status /var/lib/dpkg/status
-mount -o bind,ro $M/lock /var/lib/dpkg/lock
-mount -o bind,ro $M/cache_apt /var/cache/apt
+mount -t tmpfs tmpfs "$M"
+cp -a /var/lib/dpkg/status /var/lib/dpkg/lock "$M"
+cp -a /var/cache/apt "$M/cache_apt"
+mount -o remount,ro "$M"
+mount -o bind,ro "$M/status" /var/lib/dpkg/status
+mount -o bind,ro "$M/lock" /var/lib/dpkg/lock
+mount -o bind,ro "$M/cache_apt" /var/cache/apt
diff --git a/setup-commands/setup-testbed b/setup-commands/setup-testbed
index 835da0a..8b31d53 100755
--- a/setup-commands/setup-testbed
+++ b/setup-commands/setup-testbed
@@ -82,7 +82,7 @@ EOF
 fi
 
 # serial console for upstart
-if [ -e "$root/etc/init/tty2.conf" -a ! -e "$root/etc/init/ttyS0.conf" ]; then
+if [ -e "$root/etc/init/tty2.conf" ] && ! [ -e "$root/etc/init/ttyS0.conf" ]; then
     sed 's/tty2/ttyS0/g; s! *exec.*$!exec /sbin/getty -L ttyS0 115200 vt102!' \
         "$root/etc/init/tty2.conf" > "$root/etc/init/ttyS0.conf"
 fi
@@ -122,13 +122,14 @@ fi
 
 # set up apt sources
 if [ -e "$root/etc/os-release" ]; then
-    DISTRO_ID=`. "$root/etc/os-release" && echo "$ID" || echo INVALID`
+    # shellcheck disable=SC1090
+    DISTRO_ID=$(. "$root/etc/os-release" && echo "$ID" || echo INVALID)
 fi
 if [ -z "${MIRROR:-}" ]; then
-    MIRROR=`awk '/^deb .*'"$DISTRO_ID"'/ { sub(/\[.*\]/, "", $0); print $2; exit }' "$root/etc/apt/sources.list"`
+    MIRROR=$(awk '/^deb .*'"$DISTRO_ID"'/ { sub(/\[.*\]/, "", $0); print $2; exit }' "$root/etc/apt/sources.list")
 fi
 if [ -z "${RELEASE:-}" ]; then
-    RELEASE=`awk '/^deb .*'"$DISTRO_ID"'/ { sub(/\[.*\]/, "", $0); print $3; exit }' "$root/etc/apt/sources.list"`
+    RELEASE=$(awk '/^deb .*'"$DISTRO_ID"'/ { sub(/\[.*\]/, "", $0); print $3; exit }' "$root/etc/apt/sources.list")
 fi
 
 if [ -n "${AUTOPKGTEST_KEEP_APT_SOURCES:-}" ]; then
@@ -143,10 +144,14 @@ else
     echo "$0: Attempting to set up Debian/Ubuntu apt sources automatically" >&2
 
     if [ -z "$RELEASE" ]; then
+        # Deliberately not expanding $RELEASE here
+        # shellcheck disable=SC2016
         echo 'Failed to auto-detect distribution release name; set $RELEASE explicitly' >&2
         exit 1
     fi
     if [ -z "$MIRROR" ]; then
+        # Deliberately not expanding $MIRROR here
+        # shellcheck disable=SC2016
         echo 'Failed to auto-detect apt mirror; set $MIRROR explicitly' >&2
         exit 1
     fi
@@ -207,13 +212,14 @@ if [ -z "${AUTOPKGTEST_IS_SETUP_COMMAND:-}" ] &&
     if [ -n "$IFACE" ] ; then
         mkdir -p "$root/etc/network/interfaces.d"
         if ! grep -h -r "^[[:space:]]*auto.*$IFACE" "$root/etc/network/interfaces" "$root/etc/network/interfaces.d" | grep -qv 'auto[[:space:]]*lo'; then
-            printf "auto $IFACE\niface $IFACE inet dhcp\n" >> "$root/etc/network/interfaces.d/$IFACE"
+            printf 'auto %s\niface %s inet dhcp\n' "$IFACE" "$IFACE" >> "$root/etc/network/interfaces.d/$IFACE"
         fi
     fi
 fi
 
 # go-faster apt/dpkg
 echo "Acquire::Languages \"none\";" > "$root"/etc/apt/apt.conf.d/90nolanguages
+echo "Acquire::Retries \"10\";" > "$root"/etc/apt/apt.conf.d/90retry
 echo 'force-unsafe-io' > "$root"/etc/dpkg/dpkg.cfg.d/autopkgtest
 
 # support backwards compatible env var too
@@ -221,10 +227,12 @@ AUTOPKGTEST_APT_PROXY=${AUTOPKGTEST_APT_PROXY:-${ADT_APT_PROXY:-}}
 
 # detect apt proxy on the host (in chroot mode)
 if [ "$root" != "/" ] && [ -z "$AUTOPKGTEST_APT_PROXY" ]; then
-    RES=`apt-config shell proxy Acquire::http::Proxy`
+    RES=$(apt-config shell proxy Acquire::http::Proxy)
     if [ -n "$RES" ]; then
-        eval $RES
-        if echo "$proxy" | egrep -q '(localhost|127\.0\.0\.[0-9]*)'; then
+        # evaluating $RES will set proxy, but shellcheck can't know that
+        proxy=
+        eval "$RES"
+        if echo "$proxy" | grep -E -q '(localhost|127\.0\.0\.[0-9]*)'; then
             AUTOPKGTEST_APT_PROXY=$(echo "$proxy" | sed -r "s#localhost|127\.0\.0\.[0-9]*#10.0.2.2#")
         elif [ -n "${proxy:-}" ]; then
             AUTOPKGTEST_APT_PROXY="$proxy"
@@ -238,7 +246,7 @@ if [ "$root" != "/" ] && [ -e /etc/resolv.conf ]; then
         mv "$root/etc/resolv.conf" "$root/etc/resolv.conf.vmdebootstrap"
     fi
     cat /etc/resolv.conf > "$root/etc/resolv.conf"
-    trap "if [ -e '$root/etc/resolv.conf.vmdebootstrap' ]; then mv '$root/etc/resolv.conf.vmdebootstrap' '$root/etc/resolv.conf'; fi" EXIT INT QUIT PIPE
+    trap 'if [ -e "$root/etc/resolv.conf.vmdebootstrap" ]; then mv "$root/etc/resolv.conf.vmdebootstrap" "$root/etc/resolv.conf"; fi' EXIT INT QUIT PIPE
 fi
 
 if [ -z "${AUTOPKGTEST_IS_SETUP_COMMAND:-}" ]; then
@@ -262,8 +270,18 @@ if [ ! -e "$root/usr/bin/gpg" ]; then
 fi
 
 if ! systemd-detect-virt --quiet --container; then
+<<<<<<< setup-commands/setup-testbed
     chroot "$root" apt-get install -y haveged </dev/null
 fi
+=======
+    chroot "$root" apt-get install -y rng-tools </dev/null
+fi
+
+if ! systemd-detect-virt --quiet --container; then
+    chroot "$root" apt-get install -y haveged </dev/null
+fi
+
+>>>>>>> setup-commands/setup-testbed
 if [ ! -e "$root/usr/share/doc/libpam-systemd" ] && chroot "$root" apt-cache show libpam-systemd >/dev/null 2>&1; then
     chroot "$root" apt-get install -y libpam-systemd </dev/null
 fi
@@ -285,12 +303,14 @@ if [ -z "${AUTOPKGTEST_IS_SETUP_COMMAND:-}" ]; then
              cgmanager lxc-common lxc lxd lxd-client open-iscsi mdadm dmeventd lvm2 \
              unattended-upgrades update-notifier-common ureadahead debootstrap \
              lxcfs ppp pppconfig pppoeconf snapd snap-confine ubuntu-core-launcher \
-             thermald xdg-user-dirs zerofree xml-core; do
+             thermald xdg-user-dirs zerofree xml-core needrestart; do
         if [ -d "$root/usr/share/doc/$p" ]; then
             purge_list="$purge_list $p"
         fi
     done
     if [ -n "$purge_list" ]; then
+        # Deliberately word-splitting $purge_list:
+        # shellcheck disable=SC2086
         chroot "$root" eatmydata apt-get --auto-remove -y purge $purge_list || true
     fi
 
@@ -310,11 +330,11 @@ else
 fi
 
 if grep -q buntu "$root/etc/os-release" "$root/etc/lsb-release"; then
-    if ls $root/boot/vmlinu* >/dev/null 2>&1; then
+    if ls "$root"/boot/vmlinu* >/dev/null 2>&1; then
         # provides kmods like scsi_debug or mac80211_hwsim on Ubuntu
         chroot "$root" eatmydata apt-get install -y linux-generic < /dev/null
     else
-        if [ "$RELEASE" = precise -a "$ARCH" = armhf ]; then
+        if [ "$RELEASE" = precise ] && [ "$ARCH" = armhf ]; then
             # no linux-image-generic in precise/armhf yet
             chroot "$root" eatmydata apt-get install -y linux-headers-omap < /dev/null
         else
diff --git a/ssh-setup/SKELETON b/ssh-setup/SKELETON
index d643e57..96b8e4d 100644
--- a/ssh-setup/SKELETON
+++ b/ssh-setup/SKELETON
@@ -65,15 +65,15 @@ debug_failure() {
 
 case "$1" in
     open)
-        open $@;;
+        open "$@";;
     cleanup)
-        cleanup $@;;
+        cleanup "$@";;
     revert)
-        revert $@;;
+        revert "$@";;
     wait-reboot)
-        wait_reboot $@;;
+        wait_reboot "$@";;
     debug-failure)
-        debug_failure $@;;
+        debug_failure "$@";;
     '')
         echo "Needs to be called with command as first argument" >&2
         exit 1
diff --git a/ssh-setup/nova b/ssh-setup/nova
index b7b5a59..0b27234 100755
--- a/ssh-setup/nova
+++ b/ssh-setup/nova
@@ -253,7 +253,7 @@ EOF
     EXTRA_OPTS=''
     if [ -n "$NET_ID" ]; then
         # translate a name into a UUID
-        OUT=$(nova network-show $NET_ID)
+        OUT=$(openstack network show $NET_ID 2>/dev/null)
         NET_ID="$(echo "$OUT"| awk -F'|' '/ id / {gsub(" ", "", $3); print $3}')"
         EXTRA_OPTS="$EXTRA_OPTS --nic net-id=$NET_ID"
     fi
@@ -430,7 +430,7 @@ if [ $# -eq 0 ]; then
     error "Invalid number of arguments, command is missing"
     exit 1
 fi
-cmd=$(echo $1|tr [[:upper:]] [[:lower:]])
+cmd=$(echo $1|tr '[[:upper:]]' '[[:lower:]]')
 shift
 parse_args "$@"
 
diff --git a/tests/autopkgtest b/tests/autopkgtest
index 8a6949c..0b13e62 100755
--- a/tests/autopkgtest
+++ b/tests/autopkgtest
@@ -325,6 +325,123 @@ class DebTestsAll:
         self.assertEqual(code, 0, err)
         self.assertRegex(out, r'needs-magic\s+PASS', out)
 
+    def test_needs_internet_success(self):
+        '''A needs-internet test succeeds'''
+        p = self.build_src('Tests: downloads-data\nRestrictions: needs-internet\nDepends: coreutils\n',
+                           {'downloads-data': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', p])
+        self.assertEqual(code, 0, err)
+        self.assertRegex(out, r'downloads-data\s+PASS', out)
+
+    def test_needs_internet_skipped(self):
+        '''A needs-internet test is skipped'''
+        p = self.build_src('Tests: downloads-data\nRestrictions: needs-internet\nDepends: coreutils\n',
+                           {'downloads-data': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', '--needs-internet=skip', p])
+        self.assertEqual(code, 8, err)
+        self.assertRegex(out, r'downloads-data\s+SKIP Test needs unrestricted internet', out)
+
+    def test_needs_internet_tried_success(self):
+        '''A needs-internet test is tried and succeeds'''
+        p = self.build_src('Tests: downloads-data\nRestrictions: needs-internet\nDepends: coreutils\n',
+                           {'downloads-data': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', '--needs-internet=try', p])
+        self.assertEqual(code, 0, err)
+        self.assertRegex(out, r'downloads-data\s+PASS', out)
+
+    def test_needs_internet_tried_skipped(self):
+        '''A needs-internet test is tried and skipped'''
+        p = self.build_src('Tests: downloads-data\nRestrictions: needs-internet\nDepends: coreutils\n',
+                           {'downloads-data': '#!/bin/sh\necho I am sick\nexit 7\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', '--needs-internet=try', p])
+        self.assertEqual(code, 8, err)
+        self.assertRegex(out, r'downloads-data\s+SKIP Failed, but test has needs-internet', out)
+
+    @unittest.skipIf(host_arch != 'amd64', 'needs to run on amd64')
+    def test_arch_in_supported_list(self):
+        '''A test on an explicitly suppported architecture succeeds'''
+        p = self.build_src('Tests: pass\nArchitecture: amd63 amd64\nDepends: coreutils\n',
+                           {'pass': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', p])
+        self.assertEqual(code, 0, err)
+        self.assertRegex(out, r'pass\s+PASS', out)
+
+    def test_arch_not_in_negated_list(self):
+        '''A test on an implicitly supported architecture succeeds'''
+        p = self.build_src('Tests: pass\nArchitecture: !amd63 !amd63\nDepends: coreutils\n',
+                           {'pass': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', p])
+        self.assertEqual(code, 0, err)
+        self.assertRegex(out, r'pass\s+PASS', out)
+
+    @unittest.skipIf(host_arch != 'amd64', 'needs to run on amd64')
+    def test_arch_in_unsupported_list(self):
+        '''A test on an explicitly unsuppported architecture is skipped'''
+        p = self.build_src('Tests: skip-me\nArchitecture: !amd64\nDepends: coreutils\n',
+                           {'skip-me': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', p])
+        self.assertEqual(code, 8, err)
+        self.assertRegex(out, r'skip-me\s+SKIP Test declares architecture as not supported', out)
+
+    @unittest.skipIf(host_arch != 'amd64', 'needs to run on amd64')
+    def test_arch_in_unsupported_wildcard_list(self):
+        '''A test on an explictly unsuppported wildcard architecture is skipped'''
+        p = self.build_src('Tests: skip-me\nArchitecture: !linux-any\nDepends: coreutils\n',
+                           {'skip-me': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', p])
+        self.assertEqual(code, 8, err)
+        self.assertRegex(out, r'skip-me\s+SKIP Test declares architecture as not supported', out)
+
+    def test_arch_not_in_supported_list(self):
+        '''A test on an implicitly unsupported architecture is skipped'''
+        p = self.build_src('Tests: skip-me\nArchitecture: amd63\nDepends: coreutils\n',
+                           {'skip-me': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', p])
+        self.assertEqual(code, 8, err)
+        self.assertRegex(out, r'skip-me\s+SKIP Test lists explicitly supported architectures', out)
+
+    @unittest.skipIf(host_arch == 'hurd', 'needs to run on !hurd')
+    def test_arch_not_in_supported_wildcard_list(self):
+        '''A test on an implicitly unsupported wildcard architecture is skipped'''
+        p = self.build_src('Tests: skip-me\nArchitecture: hurd-any\nDepends: coreutils\n',
+                           {'skip-me': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', p])
+        self.assertEqual(code, 8, err)
+        self.assertRegex(out, r'skip-me\s+SKIP Test lists explicitly supported architectures', out)
+
+    def test_arch_in_mixed_list_skipped_wildcard(self):
+        '''A test in an mixed list on supported architecture succeeds'''
+        p = self.build_src('Tests: skip-me\nArchitecture: !amd63 linux-any\nDepends: coreutils\n',
+                           {'skip-me': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', p])
+        self.assertEqual(code, 8, err)
+        self.assertRegex(out, r'skip-me\s+SKIP It is not', out)
+
+    @unittest.skipIf(host_arch != 'amd64', 'needs to run on amd64')
+    def test_arch_in_mixed_list_skipped_explicit(self):
+        '''A test in an mixed list on unsupported architecture is skipped'''
+        p = self.build_src('Tests: skip-me\nArchitecture: !amd64 linux-any\nDepends: coreutils\n',
+                           {'skip-me': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', p])
+        self.assertEqual(code, 8, err)
+        self.assertRegex(out, r'skip-me\s+SKIP Test declares architecture as not supported', out)
+
+    def test_arch_any(self):
+        '''A test on "any" architecture succeeds'''
+        p = self.build_src('Tests: pass\nArchitecture: any\nDepends: coreutils\n',
+                           {'pass': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', p])
+        self.assertEqual(code, 0, err)
+        self.assertRegex(out, r'pass\s+PASS', out)
+
+    def test_arch_all(self):
+        '''A test on "all" architecture skipped'''
+        p = self.build_src('Tests: skip-me\nArchitecture: all\nDepends: coreutils\n',
+                           {'skip-me': '#!/bin/sh\necho I am fine\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', p])
+        self.assertEqual(code, 8, err)
+        self.assertRegex(out, r"skip-me\s+SKIP Arch 'all' not", out)
+
 
 class DebTestsFailureModes:
     '''Common deb tests for handling various failure modes
@@ -1110,104 +1227,18 @@ bad                  FAIL non-zero exit status 1
         self.assertRegex(out, r'SKIP no tests in this package', out)
 
     @unittest.skipIf(os.getuid() == 0, 'needs to run as user')
-    @unittest.skipIf(os.path.exists('/usr/bin/dotty'),
-                     'needs graphviz uninstalled')
-    @unittest.skipUnless(have_apt, 'needs apt-get download working')
-    def test_tmp_install(self):
-        '''temp dir unpack of test dependencies'''
-
-        p = self.build_src('Tests: t\nDepends: graphviz, gir1.2-json-1.0 (>= 0.14), python3-gi, a|b,',
-                           {'t': '#!/bin/sh\ndotty -V 2>&1 || true\n'
-                                 'python3 -c "import gi; gi.require_version(\'Json\', \'1.0\'); from gi.repository import Json; print(Json)"'})
-
-        (code, out, err) = self.runtest(['-B', p])
-        self.assertEqual(code, 0, err)
-        self.assertRegex(out, r't\s+PASS', out)
-
-        # should show test stdout
-        self.assertIn('dotty version ', out)
-        try:
-            from gi.repository import Json
-            Json  # pyflakes
-            # already installed on the system
-            self.assertRegex(out, r'(Dynamic|Introspection)Module.*Json.* from .*/usr/lib/.*girepository')
-        except ImportError:
-            # should use from local unpack dir
-            self.assertRegex(out, r'(Dynamic|Introspection)Module.*Json.* from .*tmp.*/deps/usr/lib')
-        # no stderr
-        self.assertNotIn(' stderr ', err)
-
-        # downloads dependencies
-        self.assertIn('libcgraph', err)
-        self.assertIn('libcgraph', err)
-
-        # warn about restricted functionality
-        self.assertRegex(err, r'WARNING.*cannot be handled.* a | b')
-        self.assertRegex(err, r'WARNING.*will only work for some packages')
-
-    @unittest.skipIf(os.getuid() == 0, 'needs to run as user')
-    @unittest.skipIf(os.path.exists('/usr/share/perl5/Test/Requires.pm'),
-                     'needs libtest-requires-perl uninstalled')
-    @unittest.skipIf(os.path.exists('/usr/share/doc/libconvert-uulib-perl'),
-                     'needs libconvert-uulib-perl uninstalled')
-    @unittest.skipUnless(have_apt, 'needs apt-get download working')
-    def test_tmp_install_perl(self):
-        '''temp dir unpack of Perl dependencies'''
-
-        # one arch: all, one binary
-        p = self.build_src('Tests: t\nDepends: libtest-requires-perl, libconvert-uulib-perl',
-                           {'t': '#!/usr/bin/perl\nuse Test::Requires;\nuse Convert::UUlib;\n'})
-
-        (code, out, err) = self.runtest(['-B', p])
-        self.assertEqual(code, 0, err)
-        self.assertRegex(out, r't\s+PASS', out)
-
-    @unittest.skipIf(os.getuid() == 0, 'needs to run as user')
-    @unittest.skipIf(os.path.exists('/usr/lib/python3/dist-packages/wand/'),
-                     'needs python3-wand uninstalled')
-    @unittest.skipUnless(have_apt and subprocess.call(['apt-cache', 'show', 'python3-wand'],
-                                                      stdout=subprocess.PIPE,
-                                                      stderr=subprocess.STDOUT) == 0,
-                         'needs python3-wand package')
-    def test_tmp_install_imagemagick(self):
-        '''temp dir unpack of imagemagick dependencies'''
-
-        p = self.build_src('Tests: t\nDepends: python3-wand',
-                           {'t': '#!/usr/bin/env python3\nfrom wand.image import Image\n'})
-
-        (code, out, err) = self.runtest(['-d', '-B', p])
-        self.assertEqual(code, 0, err)
-        self.assertRegex(out, r't\s+PASS', out)
-
-        # no stderr
-        self.assertNotIn(' stderr ', err)
-
-    @unittest.skipIf(os.getuid() == 0, 'needs to run as user')
-    def test_tmp_install_nonexisting_pkg(self):
-        '''temp dir unpack of nonexisting test dependency'''
-
-        p = self.build_src('Tests: t\nDepends: nosuchpackage',
-                           {'t': '#!/bin/sh\nfalse'})
-
-        (code, out, err) = self.runtest(['-B', p])
+    def test_no_apt_install_with_missing_dependency(self):
+        '''package with missing tests dependencies without available apt-get install'''
+        p = self.build_src('Test-Command: /bin/true\nDepends: package-that-does-not-exist\n', {})
+        (code, out, err) = self.runtest(['--no-built-binaries', p])
         self.assertEqual(code, 12, err)
 
-        self.assertRegex(err, r'E: .*nosuchpackage')
-        self.assertIn('Test dependencies are unsatisfiable', err)
-
     @unittest.skipIf(os.getuid() == 0, 'needs to run as user')
-    @unittest.skipIf(os.path.exists('/usr/bin/dotty'),
-                     'needs graphviz uninstalled')
-    def test_tmp_install_no_such_version(self):
-        '''temp dir unpack of test dependency with unsatisfiable version'''
-
-        p = self.build_src('Tests: t\nDepends: graphviz (>= 4:999)',
-                           {'t': '#!/bin/sh\nfalse'})
-
-        (code, out, err) = self.runtest(['-B', p])
-        self.assertEqual(code, 12, err)
-
-        self.assertIn('test dependency graphviz (>= 4:999) is unsatisfiable: available version ', err)
+    def test_no_apt_install_with_dependencies_satisfied(self):
+        '''package with dependencies satisfied while apt-get install is not available'''
+        p = self.build_src('Test-Command: /bin/true\nDepends: coreutils\n', {})
+        (code, out, err) = self.runtest(['--no-built-binaries', p])
+        self.assertEqual(code, 0, err)
 
     def test_test_command(self):
         '''Test-Command: instead of Tests:'''
@@ -1348,6 +1379,25 @@ if ($pid) { # parent
         self.assertNotIn('1_ONE', out)
         self.assertNotIn('3_THREE', out)
 
+    def test_testname_with_others_skipped(self):
+        '''Run only one specified test between skipped tests'''
+
+        p = self.build_src('Tests: one three\nDepends:\nRestrictions: needs-quantum-computer\n\nTests: two\nDepends:',
+                           {'one': '#!/bin/sh\necho 1_ONE',
+                            'two': '#!/bin/sh\necho 2_TWO',
+                            'three': '#!/bin/sh\necho 3_THREE'})
+
+        (code, out, err) = self.runtest(['-B', '--test-name', 'two', p])
+
+        self.assertEqual(code, 0, err)
+        self.assertRegex(out, r'two\s+PASS', out)
+        self.assertNotIn('one', out)
+        self.assertNotIn('three', out)
+
+        self.assertIn('2_TWO', out)
+        self.assertNotIn('1_ONE', out)
+        self.assertNotIn('3_THREE', out)
+
     def test_testname_noexist(self):
         '''Run only one specified test which does not exist'''
 
@@ -1585,6 +1635,7 @@ if ($pid) { # parent
         self.assertRegex(out, r'command1\s+SKIP Test needs to reboot testbed but testbed does not provide reboot capability')
         self.assertRegex(out, r'command2\s+PASS')
 
+    @unittest.skipIf(os.getuid() == 0, 'failure mode for root is different and tested elsewhere')
     def test_broken_test_deps(self):
         '''unsatisfiable test dependencies'''
 
@@ -1593,8 +1644,8 @@ if ($pid) { # parent
 
         (code, out, err) = self.runtest(['--no-built-binaries', p])
         self.assertEqual(code, 12, err)
-        self.assertIn('Test dependencies are unsatisfiable', err)
-        self.assertIn('Test dependencies are unsatisfiable', out)
+        self.assertIn('test dependencies missing', err)
+        self.assertIn('test dependencies missing', out)
 
     def test_continue_with_other_tests(self):
         '''Install failure should continue with next test'''
@@ -1634,6 +1685,40 @@ if ($pid) { # parent
         self.assertRegex(out, r'notinstallable\s+SKIP installation fails', out)
         self.assertRegex(out, r'ok\s+PASS', out)
 
+    def test_validate(self):
+        '''--validate command line options'''
+        p = self.build_src('Tests: hello-world\n'
+                           'Depends: coreutils\n',
+                           {'hello-world': '#!/bin/sh\necho "HELLO WORLD"\n'})
+        (code, out, err) = self.runtest(['-d', '--no-built-binaries', '--validate', p])
+        self.assertEqual(code, 0, err)
+        self.assertIn('Test specification is valid', out)
+        self.assertNotIn('HELLO WORLD', out)
+
+    def test_unknown_restriction(self):
+        '''test with unknown restriction gets skipped'''
+
+        p = self.build_src('Test-Command: true\nDepends:\nRestrictions: needs-reassurance', {})
+        (code, out, err) = self.runtest(['-d', '-B', p])
+        self.assertEqual(code, 8, err)
+        self.assertRegex(out, r'command1\s+SKIP unknown restriction needs-reassurance')
+
+    def test_unknown_derestriction(self):
+        '''--ignore-restrictions is respected for unknown restrictions'''
+
+        p = self.build_src('Test-Command: true\nDepends:\nRestrictions: needs-reassurance', {})
+        (code, out, err) = self.runtest(['-d', '-B', '--ignore-restrictions=needs-reassurance', p])
+        self.assertEqual(code, 0, out + err)
+        self.assertRegex(out, r'command1\s+PASS', out)
+
+    def test_known_derestriction(self):
+        '''--ignore-restrictions is respected for known restrictions'''
+
+        p = self.build_src('Test-Command: true\nDepends:\nRestrictions: needs-reboot', {})
+        (code, out, err) = self.runtest(['-d', '-B', '--ignore-restrictions=needs-reboot', p])
+        self.assertEqual(code, 0, out + err)
+        self.assertRegex(out, r'command1\s+PASS', out)
+
 
 @unittest.skipIf(os.getuid() > 0,
                  'NullRunnerRoot tests need to run as root')
@@ -1641,6 +1726,17 @@ class NullRunnerRoot(AdtTestCase):
     def __init__(self, *args, **kwargs):
         super(NullRunnerRoot, self).__init__(['null'], *args, **kwargs)
 
+    def test_broken_test_deps(self):
+        '''unsatisfiable test dependencies'''
+
+        p = self.build_src('Tests: p\nDepends: unknown, libc6 (>= 99:99)\n',
+                           {'p': '#!/bin/sh -e\ntrue'})
+
+        (code, out, err) = self.runtest(['--no-built-binaries', p])
+        self.assertEqual(code, 12, err)
+        self.assertIn('Test dependencies are unsatisfiable', err)
+        self.assertIn('Test dependencies are unsatisfiable', out)
+
     def test_tmpdir_for_other_users(self):
         '''$TMPDIR is accessible to non-root users'''
 
@@ -1880,7 +1976,7 @@ Restrictions: needs-root
         self.assertIn('synthesised dependency bdep4\n', err)
         self.assertIn('synthesised dependency bdep5\n', err)
         self.assertIn('synthesised dependency bdep6\n', err)
-        self.assertIn('synthesised dependency build-essential\n', err)
+        self.assertIn('synthesised dependency build-essential:native\n', err)
         self.assertIn('processing dependency testdep2\n', err)
 
     def test_build_deps_profiles(self):
@@ -1900,7 +1996,7 @@ Restrictions: needs-root
         self.assertRegex(out, r'pass\s+PASS')
 
         self.assertIn('synthesised dependency bdepyes\n', err)
-        self.assertIn('synthesised dependency build-essential\n', err)
+        self.assertIn('synthesised dependency build-essential:native\n', err)
 
         dpkg_deps_ver = subprocess.check_output(['perl', '-MDpkg::Deps', '-e', 'print $Dpkg::Deps::VERSION'],
                                                 universal_newlines=True)
@@ -2169,10 +2265,10 @@ deb http://foo.ubuntu.com/ fluffy-proposed restricted
         apt_dir = os.path.join(self.chroot, 'etc', 'apt')
         with open(os.path.join(apt_dir, 'sources.list'), 'w') as f:
             f.write('''# comment
-deb http://foo.ubuntu.com/ fluffy-updates main non-free
-deb-src http://foo.ubuntu.com/ fluffy-updates main non-free
 deb http://foo.ubuntu.com/ fluffy main non-free
 deb-src http://foo.ubuntu.com/ fluffy main non-free
+deb http://foo.ubuntu.com/ fluffy-updates main non-free
+deb-src http://foo.ubuntu.com/ fluffy-updates main non-free
 deb [trusted=yes arch=6510] http://foo.ubuntu.com/ fluffy main 6510
 ''')
 
@@ -2424,6 +2520,18 @@ Pin-Priority: 990
         # don't create empty/bogus files
         self.assertNotIn('testbed-packages', os.listdir(outdir))
 
+    @unittest.skip('chroot runner tests fake testbed_arch as powerpc')
+    def test_arch_in_mixed_list_skipped_explicit(self):
+        pass
+
+    @unittest.skip('chroot runner tests fake testbed_arch as powerpc')
+    def test_arch_in_unsupported_list(self):
+        pass
+
+    @unittest.skip('chroot runner tests fake testbed_arch as powerpc')
+    def test_arch_in_supported_list(self):
+        pass
+
 
 class DebTestsVirtFS(DebTestsAll):
     '''Common tests for runners with file system virtualization'''
@@ -2540,7 +2648,7 @@ class DebTestsVirtFS(DebTestsAll):
         self.assertIn('dh build', err)
 
         # test should run as user
-        lines = [l for l in out.splitlines() if l.startswith('XXX')]
+        lines = [line for line in out.splitlines() if line.startswith('XXX')]
         self.assertEqual(len(lines), 1, lines)
         fields = lines[0].split()
         self.assertEqual(len(fields), 4)
@@ -4033,8 +4141,8 @@ class SshRunnerNoScript(AdtTestCase):
             cmd.append('-s')
         cmd += ['open', os.environ.get('AUTOPKGTEST_TEST_LXD')]
         out = subprocess.check_output(cmd, universal_newlines=True)
-        for l in out.splitlines():
-            (k, v) = l.split('=', 1)
+        for line in out.splitlines():
+            (k, v) = line.split('=', 1)
             self.info[k] = v
         self.virt_args = ['ssh', '-d', '-H', self.info['hostname'], '-l', self.info['login'], '-i', self.info['identity']]
 
@@ -4453,5 +4561,7 @@ class SshRunnerWithScript(AdtTestCase, DebTestsAll):
 if __name__ == '__main__':
     # Force encoding to UTF-8 even in non-UTF-8 locales.
     import io
-    sys.stdout = io.TextIOWrapper(sys.stdout.detach(), encoding="UTF-8", line_buffering=True)
+    real_stdout = sys.stdout
+    assert isinstance(real_stdout, io.TextIOBase)
+    sys.stdout = io.TextIOWrapper(real_stdout.detach(), encoding="UTF-8", line_buffering=True)
     unittest.main(testRunner=unittest.TextTestRunner(stream=sys.stdout, verbosity=2))
diff --git a/tests/autopkgtest_args b/tests/autopkgtest_args
index 3871101..0c13625 100755
--- a/tests/autopkgtest_args
+++ b/tests/autopkgtest_args
@@ -13,7 +13,7 @@ try:
     patch  # pyflakes
 except ImportError:
     # fall back to separate package
-    from mock import patch
+    from mock import patch      # type: ignore
 
 test_dir = os.path.dirname(os.path.abspath(__file__))
 sys.path.insert(1, os.path.join(os.path.dirname(test_dir), 'lib'))
@@ -225,17 +225,22 @@ Files:
         self.assertEqual(adt_testbed.timeouts['test'], 10000)
         self.assertEqual(adt_testbed.timeouts['copy'], 300)
         self.assertEqual(args.testname, None)
+        self.assertEqual(args.ignore_restrictions, [])
 
     def test_options(self):
         (args, acts, virt) = self.parse(
             ['-q', '--shell-fail', '--timeout-copy=5', '--set-lang',
-             'en_US.UTF-8', 'mypkg',
+             'en_US.UTF-8',
+             '--ignore-restrictions=a,b',
+             '--ignore-restrictions=c',
+             'mypkg',
              '--', 'foo', '-d', '-s', '--', '-d'])
         self.assertEqual(args.verbosity, 0)
         self.assertEqual(args.shell_fail, True)
         self.assertEqual(adt_testbed.timeouts['copy'], 5)
         self.assertEqual(args.env, ['LANG=en_US.UTF-8'])
         self.assertEqual(args.auto_control, True)
+        self.assertEqual(args.ignore_restrictions, ['a', 'b', 'c'])
 
         self.assertEqual(acts, [('apt-source', 'mypkg', False)])
         self.assertEqual(virt, ['autopkgtest-virt-foo', '-d', '-s', '--', '-d'])
diff --git a/tests/mypy b/tests/mypy
new file mode 100755
index 0000000..b4a8d49
--- /dev/null
+++ b/tests/mypy
@@ -0,0 +1,48 @@
+#!/bin/sh
+# Copyright © 2016-2020 Simon McVittie
+# Copyright © 2018 Collabora Ltd.
+# SPDX-License-Identifier: GPL-2+
+
+set -e
+set -u
+
+testdir="$(dirname "$(readlink -f "$0")")"
+rootdir="$(dirname "$testdir")"
+
+export MYPYPATH="${PYTHONPATH:="${rootdir}/lib"}"
+
+i=0
+for file in \
+    "$rootdir"/lib/*.py \
+    "$rootdir"/runner/autopkgtest \
+    "$rootdir"/tests/*.py \
+    "$rootdir"/tests/autopkgtest \
+    "$rootdir"/tests/autopkgtest_args \
+    "$rootdir"/tests/qemu \
+    "$rootdir"/tests/testdesc \
+    "$rootdir"/tools/autopkgtest-build-qemu \
+    "$rootdir"/tools/autopkgtest-buildvm-ubuntu-cloud \
+    "$rootdir"/virt/autopkgtest-virt-chroot \
+    "$rootdir"/virt/autopkgtest-virt-lxc \
+    "$rootdir"/virt/autopkgtest-virt-lxd \
+    "$rootdir"/virt/autopkgtest-virt-null \
+    "$rootdir"/virt/autopkgtest-virt-qemu \
+    "$rootdir"/virt/autopkgtest-virt-schroot \
+    "$rootdir"/virt/autopkgtest-virt-ssh \
+; do
+    i=$((i + 1))
+    if [ "x${MYPY:="$(command -v mypy || echo false)"}" = xfalse ]; then
+        echo "ok $i - $file # SKIP mypy not found"
+    elif "${MYPY}" \
+            --python-executable="${PYTHON:=python3}" \
+            --follow-imports=skip \
+            --ignore-missing-imports \
+            "$file"; then
+        echo "ok $i - $file"
+    else
+        echo "not ok $i - $file # TODO mypy issues reported"
+    fi
+done
+echo "1..$i"
+
+# vim:set sw=4 sts=4 et:
diff --git a/tests/pycodestyle b/tests/pycodestyle
index d6bef92..f46d712 100755
--- a/tests/pycodestyle
+++ b/tests/pycodestyle
@@ -1,16 +1,26 @@
 #!/bin/sh
 set -e
-testdir="$(dirname $(readlink -f $0))"
-rootdir="$(dirname $testdir)"
-check=$(which pycodestyle || which pep8)
+testdir="$(dirname "$(readlink -f "$0")")"
+rootdir="$(dirname "$testdir")"
+check=$(command -v pycodestyle || command -v pep8)
 status=0
 
-$check --ignore E402,E501,W504 $rootdir/lib/*.py $rootdir/tools/autopkgtest-buildvm-ubuntu-cloud || status=$?
+"$check" --ignore E402,E501,W504 \
+    "$rootdir"/lib/*.py \
+    "$rootdir"/tools/autopkgtest-build-qemu \
+    "$rootdir"/tools/autopkgtest-buildvm-ubuntu-cloud \
+|| status=$?
 
 for v in chroot null schroot lxc lxd qemu ssh; do
-    $check --ignore E501,E402,W504 $rootdir/virt/autopkgtest-virt-$v || status=$?
+    "$check" --ignore E501,E402,W504 "$rootdir/virt/autopkgtest-virt-$v" || status=$?
 done
 
-$check --ignore E501,E402,W504 $rootdir/runner/autopkgtest $testdir/autopkgtest $testdir/testdesc $testdir/autopkgtest_args $testdir/*.py || status=$?
+"$check" --ignore E501,E402,W504 \
+    "$rootdir/runner/autopkgtest" \
+    "$testdir/autopkgtest" \
+    "$testdir/autopkgtest_args" \
+    "$testdir/qemu" \
+    "$testdir/testdesc" \
+    "$testdir"/*.py || status=$?
 
-exit $status
+exit "$status"
diff --git a/tests/pyflakes b/tests/pyflakes
index f4f3a68..e6182f2 100755
--- a/tests/pyflakes
+++ b/tests/pyflakes
@@ -7,18 +7,25 @@
 # Author: Martin Pitt <[e-mail]>
 
 set -e
-testdir="$(dirname $(readlink -f $0))"
-rootdir="$(dirname $testdir)"
+testdir="$(dirname "$(readlink -f "$0")")"
+rootdir="$(dirname "$testdir")"
 
 if ! type pyflakes3 >/dev/null 2>&1; then
     echo "pyflakes3 not available, skipping"
     exit 0
 fi
 
-pyflakes3 $rootdir/lib $rootdir/runner/autopkgtest $testdir/autopkgtest \
-    $testdir/testdesc $testdir/autopkgtest_args $testdir/*.py \
-    $rootdir/tools/autopkgtest-buildvm-ubuntu-cloud
+pyflakes3 \
+    "$rootdir/lib" \
+    "$rootdir/runner/autopkgtest" \
+    "$testdir/autopkgtest" \
+    "$testdir/autopkgtest_args" \
+    "$testdir/qemu" \
+    "$testdir/testdesc" \
+    "$testdir"/*.py \
+    "$rootdir/tools/autopkgtest-build-qemu" \
+    "$rootdir/tools/autopkgtest-buildvm-ubuntu-cloud"
 
 for v in chroot null schroot lxc lxd qemu ssh; do
-    pyflakes3 $rootdir/virt/autopkgtest-virt-$v
+    pyflakes3 "$rootdir/virt/autopkgtest-virt-$v"
 done
diff --git a/tests/qemu b/tests/qemu
new file mode 100755
index 0000000..a8f13dd
--- /dev/null
+++ b/tests/qemu
@@ -0,0 +1,59 @@
+#!/usr/bin/python3
+
+# This testsuite is part of autopkgtest.
+# autopkgtest is a tool for testing Debian binary packages
+#
+# Copyright 2020 Simon McVittie
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+# See the file CREDITS for a full list of credits information (often
+# installed as /usr/share/doc/autopkgtest/CREDITS).
+
+import os
+import sys
+import unittest
+
+test_dir = os.path.dirname(os.path.abspath(__file__))
+root_dir = os.path.dirname(test_dir)
+
+sys.path[:0] = [test_dir, os.path.join(root_dir, 'lib')]
+
+from autopkgtest_qemu import Qemu       # noqa
+
+
+class QemuTestCase(unittest.TestCase):
+    def setUp(self) -> None:
+        super().setUp()
+
+    def tearDown(self) -> None:
+        super().tearDown()
+
+    def test_default_qemu_command(self) -> None:
+        get = Qemu.get_default_qemu_command
+        self.assertEqual(get('aarch64'), 'qemu-system-aarch64')
+        self.assertEqual(get('armv7l'), 'qemu-system-arm')
+        self.assertEqual(get('armv8l'), 'qemu-system-arm')
+        self.assertEqual(get('i686'), 'qemu-system-i386')
+        self.assertEqual(get('x86_64'), 'qemu-system-x86_64')
+
+
+if __name__ == '__main__':
+    # Force encoding to UTF-8 even in non-UTF-8 locales.
+    import io
+    real_stdout = sys.stdout
+    assert isinstance(real_stdout, io.TextIOBase)
+    sys.stdout = io.TextIOWrapper(real_stdout.detach(), encoding="UTF-8", line_buffering=True)
+    unittest.main(testRunner=unittest.TextTestRunner(stream=sys.stdout, verbosity=2))
diff --git a/tests/run-parallel b/tests/run-parallel
index 8b8e081..38fb6b5 100755
--- a/tests/run-parallel
+++ b/tests/run-parallel
@@ -1,21 +1,24 @@
 #!/bin/sh
 # Run tests for different runners in parallel
 
-MYDIR=$(dirname $0)
+MYDIR=$(dirname "$0")
 
 # these are fast, run them first
 set -e
-$MYDIR/pycodestyle
-$MYDIR/pyflakes
-$MYDIR/testdesc
-$MYDIR/autopkgtest_args
+"$MYDIR/mypy"
+"$MYDIR/pycodestyle"
+"$MYDIR/pyflakes"
+"$MYDIR/qemu"
+"$MYDIR/shellcheck"
+"$MYDIR/testdesc"
+"$MYDIR/autopkgtest_args"
 set +e
 
 # get sudo password early, to avoid asking for it in background jobs
-[ `id -u` -eq 0 ] || sudo true
+[ "$(id -u)" -eq 0 ] || sudo true
 
-(OUT=$($MYDIR/autopkgtest QemuRunner 2>&1) || rc=$?; echo "=== $c ==="; echo "$OUT"; exit $rc) &
-(OUT=$($MYDIR/autopkgtest LxcRunner SshRunnerNoScript SshRunnerWithScript 2>&1) || rc=$?; echo "=== $c ==="; echo "$OUT"; exit $rc) &
-(OUT=$($MYDIR/autopkgtest NullRunner SchrootRunner SchrootClickRunner LxdRunner 2>&1) || rc=$?; echo "=== $c ==="; echo "$OUT"; exit $rc) &
-(OUT=$(sudo $MYDIR/autopkgtest NullRunnerRoot ChrootRunner 2>&1) || rc=$?; echo "=== $c ==="; echo "$OUT"; exit $rc) &
-for c in `seq 5`; do wait; done
+(OUT=$("$MYDIR/autopkgtest" QemuRunner 2>&1) || rc=$?; echo "=== $c ==="; echo "$OUT"; exit "$rc") &
+(OUT=$("$MYDIR/autopkgtest" LxcRunner SshRunnerNoScript SshRunnerWithScript 2>&1) || rc=$?; echo "=== $c ==="; echo "$OUT"; exit "$rc") &
+(OUT=$("$MYDIR/autopkgtest" NullRunner SchrootRunner SchrootClickRunner LxdRunner 2>&1) || rc=$?; echo "=== $c ==="; echo "$OUT"; exit "$rc") &
+(OUT=$(sudo "$MYDIR/autopkgtest" NullRunnerRoot ChrootRunner 2>&1) || rc=$?; echo "=== $c ==="; echo "$OUT"; exit "$rc") &
+for c in $(seq 5); do wait; done
diff --git a/tests/shellcheck b/tests/shellcheck
new file mode 100755
index 0000000..3e3f8b7
--- /dev/null
+++ b/tests/shellcheck
@@ -0,0 +1,45 @@
+#!/bin/sh
+# Copyright © 2018-2020 Collabora Ltd
+# SPDX-License-Identifier: GPL-2+
+
+set -e
+set -u
+
+testdir="$(dirname "$(readlink -f "$0")")"
+rootdir="$(dirname "$testdir")"
+
+if ! command -v shellcheck >/dev/null 2>&1; then
+    echo "1..0 # SKIP shellcheck not available"
+    exit 0
+fi
+
+n=0
+for shell_script in \
+    "$rootdir"/setup-commands/* \
+    "$rootdir"/ssh-setup/* \
+    "$rootdir"/tests/mypy \
+    "$rootdir"/tests/pycodestyle \
+    "$rootdir"/tests/pyflakes \
+    "$rootdir"/tests/run-parallel \
+    "$rootdir"/tests/shellcheck \
+    "$rootdir"/tests/ssh-setup-lxd \
+; do
+    n=$((n + 1))
+
+    case "$shell_script" in
+        (*/ssh-setup/adb | */ssh-setup/maas | */ssh-setup/nova)
+            echo "ok $n - $shell_script # SKIP Someone who can test this needs to fix it"
+            continue
+            ;;
+    esac
+
+    if shellcheck --shell=dash "$shell_script"; then
+        echo "ok $n - $shell_script"
+    else
+        echo "not ok $n # TODO - $shell_script"
+    fi
+done
+
+echo "1..$n"
+
+# vim:set sw=4 sts=4 et:
diff --git a/tests/ssh-setup-lxd b/tests/ssh-setup-lxd
index 9b87127..5a106ad 100755
--- a/tests/ssh-setup-lxd
+++ b/tests/ssh-setup-lxd
@@ -27,36 +27,36 @@ ENABLE_SUDO=
 # optional: port, options, capabilities
 open() {
     [ -z "$2" ] || IMAGE="$2"
-    if [ -z "$IMAGE}" ]; then
+    if [ -z "${IMAGE}" ]; then
         echo "ERROR: $0 needs to be called with image name" >&1
         exit 1
     fi
 
-    [ -n "$CONTAINER" ] || CONTAINER=`mktemp -u autopkgtest-test-XXX`
+    [ -n "$CONTAINER" ] || CONTAINER=$(mktemp -u autopkgtest-test-XXX)
 
     lxc launch --ephemeral "$IMAGE" "$CONTAINER" >/dev/null
 
     # wait for and parse IPv4
-    while ! OUT=`lxc info $CONTAINER|grep 'eth0:.*inet[^6]'`; do
+    while ! OUT=$(lxc info "$CONTAINER"|grep 'eth0:.*inet[^6]'); do
         sleep 1
     done
     IP=$(echo "$OUT" | grep -o '10\.[0-9]\+\.[0-9]\+\.[0-9]\+')
 
     # create user
     # password: python3 -c 'from crypt import *; print(crypt("autopkgtest", mksalt(METHOD_CRYPT)))'
-    lxc exec $CONTAINER -- useradd --password FJfXYBhFnX6xA --create-home $USER
+    lxc exec "$CONTAINER" -- useradd --password FJfXYBhFnX6xA --create-home "$USER"
 
     # install SSH
-    lxc exec $CONTAINER -- eatmydata apt-get install -y openssh-server >/dev/null 2>&1
+    lxc exec "$CONTAINER" -- eatmydata apt-get install -y openssh-server >/dev/null 2>&1
 
     if [ -n "$INSTALL_KEY" ]; then
-        key=`cat $HOME/.ssh/id_rsa.pub`
-        lxc exec $CONTAINER -- su -c "mkdir ~/.ssh; echo '$key' > ~/.ssh/authorized_keys" $USER
+        key=$(cat "$HOME/.ssh/id_rsa.pub")
+        lxc exec "$CONTAINER" -- su -c "mkdir ~/.ssh; echo '$key' > ~/.ssh/authorized_keys" "$USER"
         echo "identity=$HOME/.ssh/id_rsa"
     fi
 
     if [ -n "$ENABLE_SUDO" ]; then
-        lxc exec $CONTAINER -- sh -ec "echo '$USER ALL=(ALL) $ENABLE_SUDO' > /etc/sudoers.d/autopkgtest"
+        lxc exec "$CONTAINER" -- sh -ec "echo '$USER ALL=(ALL) $ENABLE_SUDO' > /etc/sudoers.d/autopkgtest"
     fi
 
     cat<<EOF
@@ -82,11 +82,11 @@ cleanup() {
         echo "Needs to be called with -n <container name>" >&2
         exit 1
     fi
-    lxc delete --force $CONTAINER
+    lxc delete --force "$CONTAINER"
 }
 
 # parse options
-eval set -- $(getopt -o "ksSn:I:c" -- "$@")
+eval "set -- $(getopt -o "ksSn:I:c" -- "$@")"
 while true; do
     case "$1" in
         -k)
@@ -109,11 +109,11 @@ done
 
 case "$1" in
     open)
-        open $@;;
+        open "$@";;
     cleanup)
-        cleanup $@;;
+        cleanup "$@";;
     revert)
-        revert $@;;
+        revert "$@";;
     '')
         echo "Needs to be called with command as first argument" >&2
         exit 1
diff --git a/tests/testdesc b/tests/testdesc
index 1751d7b..28a78de 100755
--- a/tests/testdesc
+++ b/tests/testdesc
@@ -14,7 +14,7 @@ try:
     patch  # pyflakes
 except ImportError:
     # fall back to separate package
-    from mock import patch
+    from mock import patch      # type: ignore
 
 test_dir = os.path.dirname(os.path.abspath(__file__))
 sys.path.insert(1, os.path.join(os.path.dirname(test_dir), 'lib'))
@@ -136,10 +136,8 @@ class Test(unittest.TestCase):
     def test_unknown_restriction(self):
         '''Test with unknown restriction'''
 
-        with self.assertRaises(testdesc.Unsupported) as cm:
-            testdesc.Test('foo', 'tests/do_foo', None, ['needs-red'], [], [],
-                          [], [], [])
-        self.assertIn('unknown restriction needs-red', str(cm.exception))
+        testdesc.Test('foo', 'tests/do_foo', None, ['needs-red'], [], [],
+                      [], [], [])
 
     def test_neither_path_nor_command(self):
         '''Test without path nor command'''
@@ -166,6 +164,11 @@ class Test(unittest.TestCase):
         self.assertRaises(testdesc.Unsupported,
                           t.check_testbed_compat, ['root-on-testbed'])
         t.check_testbed_compat(['isolation-container', 'root-on-testbed'])
+        self.assertRaises(testdesc.Unsupported,
+                          t.check_testbed_compat, ['needs-quantum-computer'])
+        t.check_testbed_compat([],
+                               ignore_restrictions=['needs-root',
+                                                    'isolation-container'])
 
 
 class Debian(unittest.TestCase):
@@ -355,6 +358,14 @@ class Debian(unittest.TestCase):
             self.call_parse('Depends:')
         self.assertIn('missing "Tests"', str(cm.exception))
 
+    def test_invalid_control_empty_test(self):
+        '''another invalid control file'''
+
+        # empty tests field
+        with self.assertRaises(testdesc.InvalidControl) as cm:
+            self.call_parse('Tests:')
+        self.assertIn('"Tests" field is empty', str(cm.exception))
+
     def test_tests_dir(self):
         '''non-standard Tests-Directory'''
 
@@ -380,7 +391,7 @@ class Debian(unittest.TestCase):
             'Package: one\nArchitecture: any')
         self.assertEqual(ts[0].depends, ['one', 'bd1', 'bd3:native (>= 7) | bd4',
                                          'bdi1', 'bdi2', 'bda1', 'bda2',
-                                         'build-essential', 'foo (>= 7)'])
+                                         'build-essential:native', 'foo (>= 7)'])
         self.assertFalse(skipped)
 
     @unittest.skipUnless(have_dpkg_build_profiles,
@@ -393,7 +404,7 @@ class Debian(unittest.TestCase):
             'Source: nums\nBuild-Depends: bd1, bd2 <!check>, bd3 <!cross>, bdnotme <stage1> <cross>\n'
             '\n'
             'Package: one\nArchitecture: any')
-        self.assertEqual(ts[0].depends, ['one', 'bd1', 'bd2', 'bd3', 'build-essential'])
+        self.assertEqual(ts[0].depends, ['one', 'bd1', 'bd2', 'bd3', 'build-essential:native'])
         self.assertFalse(skipped)
 
     def test_complex_deps(self):
@@ -442,7 +453,7 @@ class Debian(unittest.TestCase):
             ' , bd2\n'
             '\n'
             'Package: one\nArchitecture: any')
-        self.assertEqual(ts[0].depends, ['one', 'bd1', 'bd2', 'build-essential'])
+        self.assertEqual(ts[0].depends, ['one', 'bd1', 'bd2', 'build-essential:native'])
         self.assertFalse(skipped)
 
     @patch('adtlog.report')
@@ -924,5 +935,7 @@ fi''' % kls.click_src)
 
 if __name__ == '__main__':
     # Force encoding to UTF-8 even in non-UTF-8 locales.
-    sys.stdout = io.TextIOWrapper(sys.stdout.detach(), encoding="UTF-8", line_buffering=True)
+    real_stdout = sys.stdout
+    assert isinstance(real_stdout, io.TextIOBase)
+    sys.stdout = io.TextIOWrapper(real_stdout.detach(), encoding="UTF-8", line_buffering=True)
     unittest.main(testRunner=unittest.TextTestRunner(stream=sys.stdout, verbosity=2))
diff --git a/tools/autopkgtest-build-lxc b/tools/autopkgtest-build-lxc
index f453bf6..84d53f8 100755
--- a/tools/autopkgtest-build-lxc
+++ b/tools/autopkgtest-build-lxc
@@ -27,7 +27,7 @@ set -e
 DISTRO="$1"
 RELEASE="$2"
 if [ -z "$1" ] || [ -z "$2" ]; then
-    echo "Usage: $0 debian|ubuntu <release> [arch] [script]" >&2
+    echo "Usage: $0 debian|ubuntu|kali <release> [arch] [script]" >&2
     exit 1
 fi
 
@@ -164,8 +164,8 @@ proxy_detect
 # lxc templates for debian and ubuntu differ; ubuntu uses
 # $RELEASE/rootfs-$ARCH, while debian uses debian/rootfs-$RELEASE-$ARCH
 CACHE="$RELEASE"
-if [ "$DISTRO" = debian ]; then
-    CACHE=debian
+if [ "$DISTRO" = debian ] || [ "$DISTRO" = kali ] ; then
+    CACHE=$DISTRO
 fi
 
 if [ ! -e $LXCDIR/$NAME ]; then
@@ -176,6 +176,10 @@ else
     # remove LXC rootfs caches; on btrfs this might be a subvolume, otherwise
     # rm it
     btrfs subvolume delete /var/cache/lxc/$CACHE/rootfs-* 2>/dev/null || rm -rf /var/cache/lxc/$CACHE/rootfs-*
+    # remove leftover .new container if present
+    if lxc-ls | grep -q ${NAME}.new ; then
+      lxc-destroy --force --name=${NAME}.new
+    fi
     # create a new rootfs in a temp container
     $LXC_CREATE_PREFIX lxc-create -B best --name=${NAME}.new $LXC_ARGS
     setup ${NAME}.new
diff --git a/tools/autopkgtest-build-lxd b/tools/autopkgtest-build-lxd
index 60b9fc1..40c92c5 100755
--- a/tools/autopkgtest-build-lxd
+++ b/tools/autopkgtest-build-lxd
@@ -94,7 +94,7 @@ setup() {
 
     ARCH=$(lxc exec "$CONTAINER" -- dpkg --print-architecture </dev/null)
     DISTRO=$(lxc exec "$CONTAINER" -- sh -ec 'lsb_release -si 2>/dev/null || . /etc/os-release; echo "${NAME% *}"' </dev/null)
-    CRELEASE=$(lxc exec "$CONTAINER" -- sh -ec 'lsb_release -sc 2>/dev/null || awk "/^deb/ {sub(/\\[.*\\]/, \"\", \$0); print \$3; quit}" /etc/apt/sources.list' </dev/null)
+    CRELEASE=$(lxc exec "$CONTAINER" -- sh -ec 'lsb_release -sc 2>/dev/null || awk "/^deb/ {sub(/\\[.*\\]/, \"\", \$0); print \$3; exit}" /etc/apt/sources.list' </dev/null)
     echo "Container finished booting. Distribution $DISTRO, release $CRELEASE, architecture $ARCH"
     RELEASE=${RELEASE:-${CRELEASE}}
 
@@ -112,8 +112,8 @@ setup() {
             lxc exec "$CONTAINER" -- env \
                 AUTOPKGTEST_KEEP_APT_SOURCES="${AUTOPKGTEST_KEEP_APT_SOURCES:-}" \
                 AUTOPKGTEST_APT_SOURCES="${AUTOPKGTEST_APT_SOURCES:-}" \
-                MIRROR=${MIRROR:-} \
-                RELEASE=${RELEASE} \
+                MIRROR="${MIRROR:-}" \
+                RELEASE="${RELEASE}" \
                 sh < "$script"
             break
         fi
diff --git a/tools/autopkgtest-build-qemu b/tools/autopkgtest-build-qemu
index 16fdc2a..a2bccc9 100755
--- a/tools/autopkgtest-build-qemu
+++ b/tools/autopkgtest-build-qemu
@@ -1,9 +1,12 @@
-#!/bin/sh
+#!/usr/bin/python3
 
 # autopkgtest-build-qemu is part of autopkgtest
 # autopkgtest is a tool for testing Debian binary packages
 #
-# Copyright (C) Antonio Terceiro <[e-mail]>.
+# Copyright (C) 2016-2020 Antonio Terceiro <[e-mail]>.
+# Copyright (C) 2019 Sébastien Delafond
+# Copyright (C) 2019-2020 Simon McVittie
+# Copyright (C) 2020 Christian Kastner
 #
 # Build a QEMU image for using with autopkgtest
 #
@@ -24,283 +27,385 @@
 # See the file CREDITS for a full list of credits information (often
 # installed as /usr/share/doc/autopkgtest/CREDITS).
 
-set -eu
-
-apt_proxy=
-architecture=
-mirror=
-user_script=
-size=
-
-usage () {
-  echo "usage: $0 [<options...>] <release> <image> [<mirror>] [<architecture>] [<script>] [<size>]"
-  echo ""
-  echo "--apt-proxy=http://PROXY:PORT     Set apt proxy [default: auto]"
-  echo "--arch=ARCH, --architecture=ARCH  Set architecture, e.g. i386"
-  echo "                                  [default: $(dpkg --print-architecture)]"
-  echo "--mirror=URL                      Set apt mirror [default:"
-  echo "                                  http://deb.debian.org/debian]"
-  echo "--script=SCRIPT                   Run an extra customization script"
-  echo "--size=SIZE                       Set image size [default: 25G]"
-  exit "${1-1}"
-}
-
-if getopt_temp="$(
-  getopt -o '' \
-  --long 'apt-proxy:,arch:,architecture:,help,mirror:,script:,size:' \
-  -n "$0" -- "$@"
-)"; then
-  eval set -- "$getopt_temp"
-else
-  echo ""
-  usage $?
-fi
-
-while true; do
-  case "$1" in
-    (--arch|--architecture)
-      architecture="$2"
-      shift 2
-      ;;
-
-    (--apt-proxy)
-      apt_proxy="$2"
-      shift 2
-      ;;
-
-    (--help)
-      usage 0
-      ;;
-
-    (--mirror)
-      mirror="$2"
-      shift 2
-      ;;
-
-    (--script)
-      user_script="$2"
-      shift 2
-      ;;
-
-    (--size)
-      size="$2"
-      shift 2
-      ;;
-
-    (--)
-      shift
-      break
-      ;;
-
-    (-*)
-      echo "E: Option '$1' not understood"
-      exit 2
-      ;;
-
-    (*)
-      break
-      ;;
-  esac
-done
-
-if [ $# -lt 2 -o $# -gt 6 ]; then
-    usage 1
-fi
-
-if ! which vmdb2 > /dev/null; then
-  echo "E: vmdb2 not found. This script requires vmdb2 to be installed"
-  exit 2
-fi
-
-release="$1"
-image="$2"
-
-if [ $# -ge 3 ]; then
-  if [ -n "$mirror" ]; then
-    echo "E: --mirror and 3rd positional argument cannot both be specified"
-    usage 2
-  fi
-  mirror="$3"
-elif [ -z "$mirror" ]; then
-  mirror="http://deb.debian.org/debian"
-fi
-
-if [ $# -ge 4 ]; then
-  if [ -n "$architecture" ]; then
-    echo "E: --arch and 4th positional argument cannot both be specified"
-    usage 2
-  fi
-  architecture="$4"
-elif [ -z "$architecture" ]; then
-  architecture=$(dpkg --print-architecture)
-fi
-
-if [ $# -ge 5 ]; then
-  if [ -n "$user_script" ]; then
-    echo "E: --script and 5th positional argument cannot both be specified"
-    usage 2
-  fi
-  user_script="$5"
-elif [ -z "$user_script" ]; then
-  user_script="/bin/true"
-fi
-
-if [ $# -ge 6 ]; then
-  if [ -n "$size" ]; then
-    echo "E: --size and 6th positional argument cannot both be specified"
-    usage 2
-  fi
-  size="$6"
-elif [ -z "$size" ]; then
-  size="25G"
-fi
-
-# detect apt proxy
-# support backwards compatible env var too
-AUTOPKGTEST_APT_PROXY=${apt_proxy:-${AUTOPKGTEST_APT_PROXY:-${ADT_APT_PROXY:-}}}
-if [ -z "$AUTOPKGTEST_APT_PROXY" ]; then
-    RES=`apt-config shell proxy Acquire::http::Proxy`
-    if [ -n "$RES" ]; then
-        eval $RES
-    else
-        RES=`apt-config shell proxy_cmd Acquire::http::Proxy-Auto-Detect`
-        eval $RES
-        if [ -n "${proxy_cmd:-}" ]; then
-            proxy=`$proxy_cmd`
-        fi
-    fi
-    if echo "${proxy:-}" | egrep -q '(localhost|127\.0\.0\.[0-9]*)'; then
-        # set http_proxy for the initial debootstrap
-        export http_proxy="$proxy"
-
-        # translate proxy address to one that can be accessed from the
-        # running VM
-        AUTOPKGTEST_APT_PROXY=$(echo "$proxy" | sed -r "s#localhost|127\.0\.0\.[0-9]*#10.0.2.2#")
-        if [ -n "$AUTOPKGTEST_APT_PROXY" ]; then
-            echo "Detected local apt proxy, using $AUTOPKGTEST_APT_PROXY as virtual machine proxy"
-        fi
-    elif [ -n "${proxy:-}" ]; then
-        AUTOPKGTEST_APT_PROXY="$proxy"
-        echo "Using $AUTOPKGTEST_APT_PROXY as container proxy"
-        # set http_proxy for the initial debootstrap
-        export http_proxy="$proxy"
-    fi
-fi
-export AUTOPKGTEST_APT_PROXY
-
-
-script=/bin/true
-for s in $(dirname $(dirname "$0"))/setup-commands/setup-testbed \
-              /usr/share/autopkgtest/setup-commands/setup-testbed; do
-    if [ -r "$s" ]; then
-        script="$s"
-        break
-    fi
-done
-
-if [ "$user_script" != "/bin/true" ]; then
-  echo "Using customization script $user_script ..."
-fi
-
-
-case "$mirror" in
-  *ubuntu*)
-    kernel=linux-image-virtual
-    ;;
-  *)
-    case "$architecture" in
-      (armhf)
-        kernel=linux-image-armmp
-        ;;
-      (hppa)
-        kernel=linux-image-parisc
-        ;;
-      (i386)
-        case "$release" in
-          (jessie)
-            kernel=linux-image-586
-            ;;
-          (*)
-            kernel=linux-image-686
-            ;;
-        esac
-        ;;
-      (ppc64)
-        kernel=linux-image-powerpc64
-        ;;
-      (*)
-        kernel="linux-image-$architecture"
-        ;;
-    esac
-    ;;
-esac
-
-vmdb2_config=$(mktemp)
-trap "rm -rf $vmdb2_config" INT TERM EXIT
-cat > "$vmdb2_config" <<EOF
-steps:
-  - mkimg: "{{ image }}"
-    size: $size
-
-  - mklabel: msdos
-    device: "{{ image }}"
-
-  - mkpart: primary
-    device: "{{ image }}"
-    start: 0%
-    end: 100%
-    tag: root
-
-  - kpartx: "{{ image }}"
-
-  - mkfs: ext4
-    partition: root
-
-  - mount: root
-
-  - debootstrap: $release
-    mirror: $mirror
-    target: root
-
-  - apt: install
-    packages:
-      - $kernel
-      - ifupdown
-    tag: root
-
-  - grub: bios
-    tag: root
-    console: serial
-
-  - chroot: root
-    shell: |
-      passwd --delete root
-      useradd --home-dir /home/user --create-home user
-      passwd --delete user
-      echo host > /etc/hostname
-
-  - shell: |
-      rootdev=\$(ls -1 /dev/mapper/loop* | sort | tail -1)
-      uuid=\$(blkid -c /dev/null -o value -s UUID \$rootdev)
-      echo "UUID=\$uuid / ext4 errors=remount-ro 0 1" > \$ROOT/etc/fstab
-    root-fs: root
-
-  - shell: '$script \$ROOT'
-    root-fs: root
-
-  - shell: '$user_script \$ROOT'
-    root-fs: root
-
-EOF
-
-vmdb2 \
-    --verbose \
-    --image="$image".raw \
-    "$vmdb2_config"
-
-qemu-img convert -O qcow2 "$image".raw  "$image".new
-
-rm -f "$image".raw
-
-# replace a potentially existing image as atomically as possible
-mv "$image".new "$image"
+import argparse
+import json
+import logging
+import os
+import re
+import shlex
+import shutil
+import subprocess
+import sys
+from contextlib import (suppress)
+from tempfile import (TemporaryDirectory)
+from typing import (Any, Dict, List, Optional)
+
+
+logger = logging.getLogger('autopkgtest-build-qemu')
+
+DATA_PATHS = (
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    '/usr/share/autopkgtest',
+)
+
+for p in DATA_PATHS:
+    sys.path.insert(0, os.path.join(p, 'lib'))
+
+DEBIAN_KERNELS = dict(
+    armhf='linux-image-armmp-lpae',
+    hppa='linux-image-parisc',
+    i386='linux-image-686-pae',
+    ppc64='linux-image-powerpc64',
+)
+
+
+class UsageError(Exception):
+    pass
+
+
+class BuildQemu:
+    def __init__(self) -> None:
+        pass
+
+    def run(self) -> None:
+        default_arch = subprocess.check_output(
+            ['dpkg', '--print-architecture'],
+            universal_newlines=True
+        ).strip()
+        default_mirror = 'http://deb.debian.org/debian'
+
+        parser = argparse.ArgumentParser()
+
+        parser.add_argument(
+            '--architecture', '--arch',
+            default='',
+            help='dpkg architecture name [default: %s]' % default_arch,
+        )
+        parser.add_argument(
+            '--apt-proxy',
+            default='',
+            metavar='http://PROXY:PORT',
+            help='Set apt proxy [default: auto]',
+        )
+        parser.add_argument(
+            '--mirror',
+            default='',
+            metavar='URL',
+            help=(
+                'Debian or Debian derivative mirror ' +
+                '[default: %s]' % default_mirror
+            ),
+        )
+        parser.add_argument(
+            '--script',
+            default='',
+            dest='user_script',
+            help='Run an extra customization script',
+        )
+        parser.add_argument(
+            '--size',
+            default='',
+            help='Set image size [default: 25G]',
+        )
+        parser.add_argument(
+            'release',
+            metavar='RELEASE',
+            help='An apt suite or codename available from MIRROR',
+        )
+        parser.add_argument(
+            'image',
+            metavar='IMAGE',
+            help='Filename of qcow2 image to create',
+        )
+        parser.add_argument(
+            '_mirror',
+            default=None,
+            metavar='MIRROR',
+            nargs='?',
+            help='Deprecated, use --mirror instead',
+        )
+        parser.add_argument(
+            '_architecture',
+            default=None,
+            metavar='ARCHITECTURE',
+            nargs='?',
+            help='Deprecated, use --architecture instead',
+        )
+        parser.add_argument(
+            '_user_script',
+            default=None,
+            metavar='SCRIPT',
+            nargs='?',
+            help='Deprecated, use --script instead',
+        )
+        parser.add_argument(
+            '_size',
+            default=None,
+            metavar='SIZE',
+            nargs='?',
+            help='Deprecated, use --size instead',
+        )
+
+        args = parser.parse_args()
+
+        if args._mirror is not None:
+            if args.mirror:
+                parser.error(
+                    "--mirror and 3rd positional argument cannot both be "
+                    "specified"
+                )
+            else:
+                args.mirror = args._mirror
+
+        if args._architecture is not None:
+            if args.architecture:
+                parser.error(
+                    "--architecture and 4th positional argument cannot both "
+                    "be specified"
+                )
+            else:
+                args.architecture = args._architecture
+
+        if args._user_script is not None:
+            if args.user_script:
+                parser.error(
+                    "--script and 5th positional argument cannot both "
+                    "be specified"
+                )
+            else:
+                args.user_script = args._user_script
+
+        if args._size is not None:
+            if args.size:
+                parser.error(
+                    "--size and 6th positional argument cannot both "
+                    "be specified"
+                )
+            else:
+                args.size = args._size
+
+        vmdb2 = shutil.which('vmdb2')
+
+        if vmdb2 is None:
+            raise UsageError(
+                'vmdb2 not found. This script requires vmdb2 to be installed'
+            )
+
+        if not args.mirror:
+            args.mirror = default_mirror
+
+        if not args.architecture:
+            args.architecture = default_arch
+
+        if not args.size:
+            args.size = '25G'
+
+        if not args.apt_proxy:
+            args.apt_proxy = os.getenv(
+                'AUTOPKGTEST_APT_PROXY',
+                os.getenv('ADT_APT_PROXY', ''),
+            )
+
+        if not args.apt_proxy:
+            args.apt_proxy = subprocess.check_output(
+                'eval "$(apt-config shell p Acquire::http::Proxy)"; echo "$p"',
+                shell=True,
+                universal_newlines=True,
+            ).strip()
+
+        if not args.apt_proxy:
+            proxy_command = subprocess.check_output(
+                'eval "$(apt-config shell p Acquire::http::Proxy-Auto-Detect)"; echo "$p"',
+                shell=True,
+                universal_newlines=True,
+            ).strip()
+
+            if proxy_command:
+                args.apt_proxy = subprocess.check_output(
+                    proxy_command,
+                    shell=True,
+                    universal_newlines=True,
+                ).strip()
+
+        if args.apt_proxy:
+            # Set http_proxy for the initial debootstrap
+            os.environ['http_proxy'] = args.apt_proxy
+            # Translate proxy address on localhost to one that can be
+            # accessed from the running VM
+            os.environ['AUTOPKGTEST_APT_PROXY'] = re.sub(
+                r'localhost|127\.0\.0\.[0-9]*',
+                '10.0.2.2',
+                args.apt_proxy,
+            )
+
+        script = ''
+
+        for d in DATA_PATHS:
+            s = os.path.join(d, 'setup-commands', 'setup-testbed')
+
+            if os.access(s, os.R_OK):
+                script = s
+                break
+
+        if args.user_script:
+            logger.info('Using customization script %s...', args.user_script)
+
+        if args.architecture == default_arch:
+            override_arch = None
+        else:
+            override_arch = args.architecture
+
+        with TemporaryDirectory() as temp:
+            vmdb2_config = os.path.join(temp, 'vmdb2.yaml')
+
+            self.write_vmdb2_config(
+                vmdb2_config,
+                kernel=self.choose_kernel(args.mirror, args.architecture),
+                mirror=args.mirror,
+                override_arch=override_arch,
+                release=args.release,
+                script=script,
+                size=args.size,
+                user_script=args.user_script,
+            )
+
+            try:
+                subprocess.check_call([
+                    vmdb2,
+                    '--verbose',
+                    '--image=' + args.image + '.raw',
+                    vmdb2_config,
+                ])
+                subprocess.check_call([
+                    'qemu-img',
+                    'convert',
+                    '-f', 'raw',
+                    '-O', 'qcow2',
+                    args.image + '.raw',
+                    args.image + '.new',
+                ])
+                # Replace a potentially existing image as atomically as
+                # possible
+                os.rename(args.image + '.new', args.image)
+            finally:
+                with suppress(FileNotFoundError):
+                    os.unlink(args.image + '.new')
+
+                with suppress(FileNotFoundError):
+                    os.unlink(args.image + '.raw')
+
+    def write_vmdb2_config(
+        self,
+        path: str,
+        *,
+        kernel: str,
+        mirror: str,
+        override_arch: Optional[str],
+        release: str,
+        script: str,
+        size: str,
+        user_script: str,
+    ):
+        steps = []          # type: List[Dict[str, Any]]
+        steps.append(dict(mkimg='{{ image }}', size=size))
+        steps.append(dict(mklabel='msdos', device='{{ image }}'))
+
+        steps.append(
+            dict(
+                mkpart='primary',
+                device='{{ image }}',
+                start='0%',
+                end='100%',
+                tag='root',
+            ),
+        )
+
+        steps.append(dict(kpartx='{{ image }}'))
+        steps.append(dict(mkfs='ext4', partition='root'))
+        steps.append(dict(mount='root'))
+
+        debootstrap = {}    # type: Dict[str, Any]
+
+        if override_arch is None:
+            debootstrap['debootstrap'] = release
+        else:
+            debootstrap['qemu-debootstrap'] = release
+            debootstrap['arch'] = override_arch
+
+        debootstrap['mirror'] = mirror
+        debootstrap['target'] = 'root'
+
+        steps.append(debootstrap)
+
+        steps.append(
+            dict(
+                apt='install',
+                packages=[kernel, 'ifupdown'],
+                tag='root',
+            ),
+        )
+
+        steps.append(
+            dict(
+                grub='bios',
+                tag='root',
+                console='serial',
+            ),
+        )
+
+        steps.append(
+            dict(
+                chroot='root',
+                shell='\n'.join([
+                    'passwd --delete root',
+                    'useradd --home-dir /home/user --create-home user',
+                    'passwd --delete user',
+                    'echo host > /etc/hostname',
+                    "echo '127.0.1.1\thost' >> /etc/hosts",
+                ]),
+            ),
+        )
+
+        steps.append({
+            'shell': '\n'.join([
+                'rootdev=$(ls -1 /dev/mapper/loop* | sort | tail -1)',
+                'uuid=$(blkid -c /dev/null -o value -s UUID "$rootdev")',
+                ('echo "UUID=$uuid / ext4 errors=remount-ro 0 1" '
+                 '> "$ROOT/etc/fstab"'),
+            ]),
+            'root-fs': 'root',
+        })
+
+        for s in (script, user_script):
+            if s:
+                steps.append({
+                    'shell': shlex.quote(s) + ' "$ROOT"',
+                    'root-fs': 'root',
+                })
+
+        with open(path, 'w') as writer:
+            # It's really YAML, but YAML is a superset of JSON (except in
+            # pathological cases), so writing it out as JSON avoids a
+            # dependency on a non-stdlib YAML library.
+            json.dump(dict(steps=steps), writer)
+
+    def choose_kernel(
+        self,
+        mirror: str,
+        architecture: str,
+    ) -> str:
+        if 'ubuntu' in mirror:
+            return 'linux-image-virtual'
+
+        return DEBIAN_KERNELS.get(architecture, 'linux-image-' + architecture)
+
+
+if __name__ == '__main__':
+    try:
+        BuildQemu().run()
+    except UsageError as e:
+        logger.error('%s', e)
+        sys.exit(2)
+    except subprocess.CalledProcessError as e:
+        logger.error('%s', e)
+        sys.exit(e.returncode or 1)
diff --git a/tools/autopkgtest-buildvm-ubuntu-cloud b/tools/autopkgtest-buildvm-ubuntu-cloud
index 5b61d86..95f3da1 100755
--- a/tools/autopkgtest-buildvm-ubuntu-cloud
+++ b/tools/autopkgtest-buildvm-ubuntu-cloud
@@ -42,6 +42,7 @@ sys.path.insert(0, os.path.join(os.path.dirname(os.path.dirname(
     os.path.abspath(__file__))), 'lib'))
 
 import VirtSubproc
+from autopkgtest_qemu import Qemu, QemuImage
 
 workdir = tempfile.mkdtemp(prefix='autopkgtest-buildvm-ubuntu-cloud')
 atexit.register(shutil.rmtree, workdir)
@@ -62,10 +63,12 @@ def get_default_release():
         sys.stderr.write('WARNING: python-distro-info not installed, falling '
                          'back to determining default release from currently '
                          'installed release\n')
-    if subprocess.call(['which', 'lsb_release'], stdout=subprocess.PIPE) == 0:
+    if shutil.which('lsb_release') is not None:
         return subprocess.check_output(['lsb_release', '-cs'],
                                        universal_newlines=True).strip()
 
+    return None
+
 
 def parse_args():
     '''Parse CLI args'''
@@ -133,13 +136,11 @@ def parse_args():
     args = parser.parse_args()
 
     # check our dependencies
-    if subprocess.call(['which', args.qemu_command], stdout=subprocess.PIPE,
-                       stderr=subprocess.STDOUT) != 0:
+    if shutil.which(args.qemu_command) is None:
         sys.stderr.write('ERROR: QEMU command %s not found\n' %
                          args.qemu_command)
         sys.exit(1)
-    if subprocess.call(['which', 'genisoimage'], stdout=subprocess.PIPE,
-                       stderr=subprocess.STDOUT) != 0:
+    if shutil.which('genisoimage') is None:
         sys.stderr.write('ERROR: genisoimage not found\n')
         sys.exit(1)
     if os.path.exists('/dev/kvm') and not os.access('/dev/kvm', os.W_OK):
@@ -202,7 +203,7 @@ def download_image(cloud_img_url, release, arch):
 
 def resize_image(image, size):
     print('Resizing image, adding %s...' % size)
-    subprocess.check_call(['qemu-img', 'resize', image, '+' + size])
+    subprocess.check_call(['qemu-img', 'resize', '-f', 'qcow2', image, '+' + size])
 
 
 DEFAULT_METADATA = 'instance-id: nocloud\nlocal-hostname: autopkgtest\n'
@@ -217,6 +218,8 @@ ssh_pwauth: True
 manage_etc_hosts: True
 apt_proxy: %(proxy)s
 apt_mirror: %(mirror)s
+bootcmd:
+ - dpkg --add-architecture i386
 runcmd:
  - sed -i 's/deb-systemd-invoke/true/' /var/lib/dpkg/info/cloud-init.prerm
  - mount -r /dev/vdb /mnt
@@ -331,37 +334,33 @@ def host_tz():
 def boot_image(image, seed, qemu_command, verbose, timeout):
     print('Booting image to run cloud-init...')
 
-    tty_sock = os.path.join(workdir, 'ttyS0')
-
-    argv = [qemu_command, '-m', '512',
-            '-nographic',
-            '-monitor', 'null',
-            '-net', 'user',
-            '-net', 'nic,model=virtio',
-            '-serial', 'unix:%s,server,nowait' % tty_sock,
-            '-drive', 'file=%s,if=virtio' % image,
-            '-drive', 'file=%s,if=virtio,readonly' % seed]
-
-    if os.path.exists('/dev/kvm'):
-        argv.append('-enable-kvm')
+    qemu = Qemu(
+        cpus=1,
+        images=[
+            QemuImage(file=image, format='qcow2'),
+            QemuImage(file=seed, format='raw', readonly=True),
+        ],
+        overlay=False,
+        qemu_command=qemu_command,
+        ram_size=512,
+    )
 
-    qemu = subprocess.Popen(argv)
     try:
         if verbose:
-            tty = VirtSubproc.get_unix_socket(tty_sock)
+            tty = VirtSubproc.get_unix_socket(qemu.ttys0_socket_path)
 
         # wait for cloud-init to finish and VM to shutdown
         with VirtSubproc.timeout(timeout, 'timed out on cloud-init'):
-            while qemu.poll() is None:
+            while qemu.subprocess.poll() is None:
                 if verbose:
                     sys.stdout.buffer.raw.write(tty.recv(4096))
                 else:
                     time.sleep(1)
     finally:
-        if qemu.poll() is None:
-            qemu.terminate()
-        if qemu.wait() != 0:
-            sys.stderr.write('qemu failed with status %i\n' % qemu.returncode)
+        ret = qemu.cleanup()
+        assert ret is not None
+        if ret != 0:
+            sys.stderr.write('qemu failed with status %i\n' % ret)
             sys.exit(1)
 
 
@@ -381,6 +380,11 @@ def install_image(src, dest):
 #
 
 args = parse_args()
+
+if args.release is None:
+    sys.stderr.write('Unable to determine default Ubuntu release\n')
+    sys.exit(1)
+
 image = download_image(args.cloud_image_url, args.release, args.arch)
 resize_image(image, args.disk_size)
 seed = build_seed(args.mirror, args.proxy, args.no_apt_upgrade,
diff --git a/virt/autopkgtest-virt-lxc b/virt/autopkgtest-virt-lxc
index afa1069..50da67b 100755
--- a/virt/autopkgtest-virt-lxc
+++ b/virt/autopkgtest-virt-lxc
@@ -66,6 +66,9 @@ def parse_args():
                         help='Run lxc-* commands with sudo; use if you run '
                         'autopkgtest as normal user')
     parser.add_argument('--name', help='container name (autopkgtest-lxc-XXXXXX by default)')
+    parser.add_argument('--disk-limit',
+                        help='limit amount of disk space that can be used by the container.'
+                        'Causes the container to be backed by a loop device of that size.')
     parser.add_argument('template', help='LXC container name that will be '
                         'used as a template')
     parser.add_argument('lxcargs', nargs=argparse.REMAINDER,
@@ -112,12 +115,12 @@ def wait_booted(lxc_name):
     Do this by checking that the runlevel is someting numeric, i. e. not
     "unknown" or "S".
     '''
-    timeout = 60
+    timeout = 120
     while timeout > 0:
         timeout -= 1
         time.sleep(1)
         (rc, out, _) = VirtSubproc.execute_timeout(
-            None, 10, sudoify(['lxc-attach', '--name', lxc_name, 'runlevel']),
+            None, 20, sudoify(['lxc-attach', '--name', lxc_name, 'runlevel']),
             stdout=subprocess.PIPE)
         if rc != 0:
             adtlog.debug('wait_booted: lxc-attach failed, retrying...')
@@ -125,7 +128,7 @@ def wait_booted(lxc_name):
         out = out.strip()
         if out.split()[-1].isdigit():
             adtlog.debug('waiting for network')
-            VirtSubproc.check_exec(sudoify(['lxc-attach', '--name', lxc_name, '--', 'sh', '-ec', '[ ! -d /run/systemd/system ] || systemctl start network-online.target']), timeout=60)
+            VirtSubproc.check_exec(sudoify(['lxc-attach', '--name', lxc_name, '--', 'sh', '-ec', r'if [ -d /run/systemd/system ]; then systemctl start network-online.target; else while ps -ef | grep -q "/etc/init\.d/rc"; do sleep 1; done; fi']), timeout=60)
             return
 
         adtlog.debug('wait_booted: runlevel "%s", retrying...' % out)
@@ -188,8 +191,11 @@ def start_lxc1():
 
 
 def start_lxc_copy():
+    argv = ['lxc-copy', '--name', args.template, '--newname', lxc_container_name]
+    if args.disk_limit:
+        argv += ['--backingstorage', 'loop', '--fssize', args.disk_limit]
     if args.ephemeral:
-        argv = ['lxc-copy', '--name', args.template, '--newname', lxc_container_name, '--ephemeral']
+        argv += ['--ephemeral']
         if shared_dir:
             argv += ['--mount', 'bind=%s:%s' % (shared_dir, shared_dir)]
         argv += args.lxcargs
@@ -198,7 +204,6 @@ def start_lxc_copy():
         if rc != 0:
             VirtSubproc.bomb('lxc-copy with exit status %i' % rc)
     else:
-        argv = ['lxc-copy', '--name', args.template, '--newname', lxc_container_name]
         rc = VirtSubproc.execute_timeout(None, 310, sudoify(argv, 300),
                                          stdout=subprocess.DEVNULL)[0]
         if rc != 0:
@@ -297,7 +302,7 @@ def hook_revert():
     hook_open()
 
 
-def hook_wait_reboot():
+def hook_wait_reboot(*args, **kwargs):
     adtlog.debug('hook_wait_reboot: waiting for container to shut down...')
     VirtSubproc.execute_timeout(None, 65, sudoify(
         ['lxc-wait', '-n', lxc_container_name, '-s', 'STOPPED', '-t', '60']))
diff --git a/virt/autopkgtest-virt-lxc.1 b/virt/autopkgtest-virt-lxc.1
index 042d1a9..864d9d4 100644
--- a/virt/autopkgtest-virt-lxc.1
+++ b/virt/autopkgtest-virt-lxc.1
@@ -63,6 +63,13 @@ generate more expressive unique names you can use that to make it easier to map
 containers to running tests.
 
 .TP
+.BI " \-\-disk\-limit" " SIZE
+Limits the amount of disk space that the test container is allowed to use for
+its root filesystem. When this option is used, then the test container will be
+backed by a loop device of the given \fISIZE\fR, and it won't be possible for
+the container to consume all of the disk space in the host machine.
+
+.TP
 .BR \-d " | " \-\-debug
 Enables debugging output.
 
diff --git a/virt/autopkgtest-virt-lxd b/virt/autopkgtest-virt-lxd
index cce0931..fe057fd 100755
--- a/virt/autopkgtest-virt-lxd
+++ b/virt/autopkgtest-virt-lxd
@@ -101,7 +101,7 @@ def wait_booted():
         out = out.strip()
         if out.split()[-1].isdigit():
             adtlog.debug('waiting for network')
-            VirtSubproc.check_exec(['lxc', 'exec', container_name, '--', 'sh', '-ec', '[ ! -d /run/systemd/system ] || systemctl start network-online.target'], timeout=60)
+            VirtSubproc.check_exec(['lxc', 'exec', container_name, '--', 'sh', '-ec', r'if [ -d /run/systemd/system ]; then systemctl start network-online.target; else while ps -ef | grep -q "/etc/init\.d/rc"; do sleep 1; done; fi'], timeout=60)
             return
 
         adtlog.debug('wait_booted: runlevel "%s", retrying...' % out)
@@ -201,11 +201,18 @@ def get_uptime():
         return
 
 
-def hook_wait_reboot():
+def hook_prepare_reboot():
+    initial_uptime = get_uptime()
+    adtlog.debug('hook_prepare_reboot: fetching uptime before reboot: %s' % initial_uptime)
+
+    return {'initial_uptime': initial_uptime}
+
+
+def hook_wait_reboot(*func_args, **kwargs):
     adtlog.debug('hook_wait_reboot: waiting for container to shut down...')
     # "lxc exec" exits with 0 when the container stops, so just wait longer
     # than our timeout
-    initial_uptime = get_uptime()
+    initial_uptime = kwargs['initial_uptime']
 
     adtlog.debug('hook_wait_reboot: container up for %s, waiting for reboot' % initial_uptime)
 
diff --git a/virt/autopkgtest-virt-qemu b/virt/autopkgtest-virt-qemu
index e8073cf..ec66f80 100755
--- a/virt/autopkgtest-virt-qemu
+++ b/virt/autopkgtest-virt-qemu
@@ -27,14 +27,7 @@
 
 import sys
 import os
-import subprocess
-import tempfile
-import shutil
 import time
-import socket
-import errno
-import fcntl
-import re
 import argparse
 
 sys.path.insert(0, '/usr/share/autopkgtest/lib')
@@ -43,27 +36,17 @@ sys.path.insert(0, os.path.join(os.path.dirname(os.path.dirname(
 
 import VirtSubproc
 import adtlog
+from autopkgtest_qemu import Qemu
 
 
 args = None
-workdir = None
-p_qemu = None
-ssh_port = None
+qemu = None
 normal_user = None
-qemu_cmd_default = None
 
 
 def parse_args():
-    global args, qemu_cmd_default
-
-    uname_to_qemu_suffix = {'i[3456]86$': 'i386'}
-    arch = os.uname()[4]
-    for pattern, suffix in uname_to_qemu_suffix.items():
-        if re.match(pattern, arch):
-            qemu_cmd_default = 'qemu-system-' + suffix
-            break
-    else:
-        qemu_cmd_default = 'qemu-system-' + arch
+    global args
+    qemu_cmd_default = Qemu.get_default_qemu_command()
 
     parser = argparse.ArgumentParser()
 
@@ -86,13 +69,13 @@ def parse_args():
                         help='Show boot messages from serial console')
     parser.add_argument('-d', '--debug', action='store_true',
                         help='Enable debugging output')
-    parser.add_argument('--qemu-options',
-                        help='Pass through arguments to QEMU command.')
+    parser.add_argument('--qemu-options', default='',
+                        help='Pass through (whitespace-separated) arguments to QEMU command.')
     parser.add_argument('--baseimage', action='store_true', default=False,
                         help='Provide a read-only copy of the base image at /dev/baseimage')
     parser.add_argument('--efi', action='store_true', default=False,
                         help='Use OVMF or AAVMF to boot virtual machine using EFI (default: BIOS)')
-    parser.add_argument('image', nargs='+',
+    parser.add_argument('images', nargs='+',
                         help='disk image to add to the VM (in order)')
 
     args = parser.parse_args()
@@ -101,24 +84,8 @@ def parse_args():
         adtlog.verbosity = 2
 
 
-def prepare_overlay():
-    '''Generate a temporary overlay image'''
-
-    # generate a temporary overlay
-    if args.overlay_dir:
-        overlay = os.path.join(args.overlay_dir, os.path.basename(
-            args.image[0]) + '.overlay-%s' % time.time())
-    else:
-        overlay = os.path.join(workdir, 'overlay.img')
-    adtlog.debug('Creating temporary overlay image in %s' % overlay)
-    VirtSubproc.check_exec(['qemu-img', 'create', '-f', 'qcow2', '-b',
-                            os.path.abspath(args.image[0]), overlay],
-                           outp=True, timeout=300)
-    return overlay
-
-
 def wait_boot():
-    term = VirtSubproc.get_unix_socket(os.path.join(workdir, 'ttyS0'))
+    term = qemu.ttys0_socket
     VirtSubproc.expect(term, b' login: ', args.timeout_reboot, 'login prompt on ttyS0',
                        echo=args.show_boot)
     # this is really ugly, but runlevel, "service status hwclock" etc. all
@@ -131,7 +98,7 @@ def wait_boot():
 def check_ttyS1_shell():
     '''Check if there is a shell running on ttyS1'''
 
-    term = VirtSubproc.get_unix_socket(os.path.join(workdir, 'ttyS1'))
+    term = qemu.ttys1_socket
     term.sendall(b'echo -n o; echo k\n')
     try:
         VirtSubproc.expect(term, b'ok', 1)
@@ -168,7 +135,7 @@ def setup_shell():
 def login_tty_and_setup_shell():
     '''login on ttyS0 and start a root shell on ttyS1 from there'''
 
-    term = VirtSubproc.get_unix_socket(os.path.join(workdir, 'ttyS0'))
+    term = qemu.ttys0_socket
 
     # send user name
     term.sendall(args.user.encode('UTF-8') + b'\n')
@@ -199,7 +166,7 @@ def login_tty_and_setup_shell():
 def setup_baseimage():
     '''setup /dev/baseimage in VM'''
 
-    term = VirtSubproc.get_unix_socket(os.path.join(workdir, 'ttyS1'))
+    term = qemu.ttys1_socket
 
     # Setup udev rules for /dev/baseimage; set link_priority to -1024 so
     # that the duplicate UUIDs of the partitions will have no effect.
@@ -211,8 +178,8 @@ def setup_baseimage():
     VirtSubproc.expect(term, b'#', 10)
 
     # Add the base image as an additional drive
-    monitor = VirtSubproc.get_unix_socket(os.path.join(workdir, 'monitor'))
-    monitor.sendall(('drive_add 0 file=%s,if=none,readonly=on,serial=BASEIMAGE,id=drive-baseimage\n' % args.image[0]).encode())
+    monitor = qemu.monitor_socket
+    monitor.sendall(('drive_add 0 file=%s,if=none,readonly=on,serial=BASEIMAGE,id=drive-baseimage,format=%s\n' % (qemu.images[0].file, qemu.images[0].format)).encode())
     VirtSubproc.expect(monitor, b'(qemu)', 10)
     monitor.sendall(b'device_add virtio-blk-pci,drive=drive-baseimage,id=virtio-baseimage\n')
     VirtSubproc.expect(monitor, b'(qemu)', 10)
@@ -226,7 +193,7 @@ def setup_baseimage():
 def setup_shared(shared_dir):
     '''Set up shared dir'''
 
-    term = VirtSubproc.get_unix_socket(os.path.join(workdir, 'ttyS1'))
+    term = qemu.ttys1_socket
 
     term.sendall(b'''mkdir -p -m 1777 /run/autopkgtest/shared
 mount -t 9p -o trans=virtio,access=any autopkgtest /run/autopkgtest/shared
@@ -287,7 +254,7 @@ EOF
 def setup_config(shared_dir):
     '''Set up configuration files'''
 
-    term = VirtSubproc.get_unix_socket(os.path.join(workdir, 'ttyS1'))
+    term = qemu.ttys1_socket
 
     # copy our timezone, to avoid time skews with the host
     if os.path.exists('/etc/timezone'):
@@ -311,7 +278,7 @@ def setup_config(shared_dir):
     # ensure that we have Python for our the auxverb helpers
     term.sendall(b'type python3 2>/dev/null || type python 2>/dev/null\n')
     try:
-        out = VirtSubproc.expect(term, b'/python', 5)
+        out = VirtSubproc.expect(term, b'/python', 30)
     except VirtSubproc.Timeout:
         VirtSubproc.bomb('Neither python3 nor python is installed in the VM, '
                          'one of them is required by autopkgtest')
@@ -324,11 +291,15 @@ def setup_config(shared_dir):
 def make_auxverb(shared_dir):
     '''Create auxverb script'''
 
-    auxverb = os.path.join(workdir, 'runcmd')
+    auxverb = os.path.join(qemu.workdir, 'runcmd')
     with open(auxverb, 'w') as f:
         f.write('''#!%(py)s
-import sys, os, tempfile, threading, time, atexit, shutil, fcntl, errno, pipes
+import sys, os, tempfile, threading, time, atexit, shutil, fcntl, errno
 import socket
+try:
+    from shlex import quote
+except ImportError:
+    from pipes import quote
 
 dir_host = '%(dir)s'
 job_host = tempfile.mkdtemp(prefix='job.', dir=dir_host)
@@ -394,7 +365,7 @@ s.connect('%(tty)s')
 cmd = 'PYTHONHASHSEED=0 /tmp/eofcat %%(d)s/stdin_eof %%(d)s/exit.tmp < %%(d)s/stdin | ' \\
       '(%%(c)s >> %%(d)s/stdout 2>> %%(d)s/stderr; echo $? > %%(d)s/exit.tmp);' \\
       'mv %%(d)s/exit.tmp %%(d)s/exit\\n' %% \\
-       {'d': job_guest, 'c': ' '.join(map(pipes.quote, sys.argv[1:]))}
+       {'d': job_guest, 'c': ' '.join(map(quote, sys.argv[1:]))}
 s.sendall(cmd.encode())
 
 # wait until command has exited
@@ -422,7 +393,7 @@ t_stdout.join()
 t_stderr.join()
 # code 255 means that the auxverb itself failed, so translate
 sys.exit(rc == 255 and 253 or rc)
-''' % {'py': sys.executable, 'tty': os.path.join(workdir, 'ttyS1'), 'dir': shared_dir})
+''' % {'py': sys.executable, 'tty': os.path.join(qemu.workdir, 'ttyS1'), 'dir': shared_dir})
 
     os.chmod(auxverb, 0o755)
 
@@ -436,66 +407,6 @@ sys.exit(rc == 255 and 253 or rc)
         VirtSubproc.bomb('failed to connect to VM')
 
 
-def get_cpuflag():
-    '''Return QEMU cpu option list suitable for host CPU'''
-
-    try:
-        with open('/proc/cpuinfo', 'r') as f:
-            for line in f:
-                if line.startswith('flags'):
-                    words = line.split()
-                    if 'vmx' in words:
-                        adtlog.debug('Detected KVM capable Intel host CPU, enabling nested KVM')
-                        return ['-cpu', 'kvm64,+vmx,+lahf_lm']
-                    elif 'svm' in words:  # AMD kvm
-                        adtlog.debug('Detected KVM capable AMD host CPU, enabling nested KVM')
-                        # FIXME: this should really be the one below for more
-                        # reproducible testbeds, but nothing except -cpu host works
-                        # return ['-cpu', 'kvm64,+svm,+lahf_lm']
-                        return ['-cpu', 'host']
-    except IOError as e:
-        adtlog.warning('Cannot read /proc/cpuinfo to detect CPU flags: %s' % e)
-        # fetching CPU flags isn't critical (only used to enable nested KVM),
-        # so don't fail here
-        pass
-
-    return []
-
-
-def find_free_port(start):
-    '''Find an unused port in the range [start, start+50)'''
-
-    for p in range(start, start + 50):
-        adtlog.debug('find_free_port: trying %i' % p)
-        try:
-            lockfile = '/tmp/autopkgtest-virt-qemu.port.%i' % p
-            f = None
-            try:
-                f = open(lockfile, 'x')
-                os.unlink(lockfile)
-                fcntl.flock(f, fcntl.LOCK_EX | fcntl.LOCK_NB)
-            except (IOError, OSError):
-                adtlog.debug('find_free_port: %i is locked' % p)
-                continue
-            finally:
-                if f:
-                    f.close()
-
-            s = socket.create_connection(('127.0.0.1', p))
-            # if that works, the port is taken
-            s.close()
-            continue
-        except socket.error as e:
-            if e.errno == errno.ECONNREFUSED:
-                adtlog.debug('find_free_port: %i is free' % p)
-                return p
-            else:
-                pass
-
-    adtlog.debug('find_free_port: all ports are taken')
-    return None
-
-
 def determine_normal_user(shared_dir):
     '''Check for a normal user to run tests as.'''
 
@@ -507,7 +418,7 @@ def determine_normal_user(shared_dir):
 
     # get the first UID in the Debian Policy §9.2.2 "dynamically allocated
     # user account" range
-    term = VirtSubproc.get_unix_socket(os.path.join(workdir, 'ttyS1'))
+    term = qemu.ttys1_socket
     term.sendall(b"getent passwd | sort -t: -nk3 | "
                  b"awk -F: '{if ($3 >= 1000 && $3 <= 59999) { print $1; exit } }'"
                  b"> /run/autopkgtest/shared/normal_user\n")
@@ -526,6 +437,7 @@ def determine_normal_user(shared_dir):
 
 
 def hook_open():
+<<<<<<< virt/autopkgtest-virt-qemu
     global workdir, p_qemu, ssh_port
 
     workdir = tempfile.mkdtemp(prefix='autopkgtest-qemu.')
@@ -597,6 +509,20 @@ def hook_open():
         argv.extend(args.qemu_options.split())
 
     p_qemu = subprocess.Popen(argv)
+=======
+    global qemu
+
+    qemu = Qemu(
+        cpus=args.cpus,
+        efi=args.efi,
+        images=args.images,
+        overlay=True,
+        overlay_dir=args.overlay_dir,
+        qemu_command=args.qemu_command,
+        qemu_options=args.qemu_options.split(),
+        ram_size=args.ram_size,
+    )
+>>>>>>> virt/autopkgtest-virt-qemu
 
     try:
         try:
@@ -604,14 +530,16 @@ def hook_open():
         finally:
             # remove overlay as early as possible, to avoid leaking large
             # files; let QEMU run with the deleted inode
+            overlay = qemu.images[0].overlay
+            assert overlay is not None
             os.unlink(overlay)
         setup_shell()
         if args.baseimage:
             setup_baseimage()
-        setup_shared(shareddir)
-        setup_config(shareddir)
-        make_auxverb(shareddir)
-        determine_normal_user(shareddir)
+        setup_shared(qemu.shareddir)
+        setup_config(qemu.shareddir)
+        make_auxverb(qemu.shareddir)
+        determine_normal_user(qemu.shareddir)
     except Exception:
         # Clean up on failure
         hook_cleanup()
@@ -633,35 +561,27 @@ def hook_revert():
 
 
 def hook_cleanup():
-    global p_qemu, workdir
-
-    if p_qemu:
-        p_qemu.terminate()
-        p_qemu.wait()
-        p_qemu = None
+    global qemu
 
-    if workdir:
-        shutil.rmtree(workdir)
-        workdir = None
+    qemu.cleanup()
+    qemu = None
 
 
 def hook_prepare_reboot():
     if args.baseimage:
         # Remove baseimage drive again, so that it does not break the subsequent
         # boot due to the duplicate UUID
-        monitor = VirtSubproc.get_unix_socket(os.path.join(workdir, 'monitor'))
+        monitor = qemu.monitor_socket
         monitor.sendall(b'device_del virtio-baseimage\n')
         VirtSubproc.expect(monitor, b'(qemu)', 10)
         monitor.close()
 
 
-def hook_wait_reboot():
-    global workdir
-    shareddir = os.path.join(workdir, 'shared')
-    os.unlink(os.path.join(shareddir, 'done_shared'))
+def hook_wait_reboot(*func_args, **kwargs):
+    os.unlink(os.path.join(qemu.shareddir, 'done_shared'))
     wait_boot()
     setup_shell()
-    setup_shared(shareddir)
+    setup_shared(qemu.shareddir)
     if args.baseimage:
         setup_baseimage()
 
@@ -671,19 +591,17 @@ def hook_capabilities():
     caps = ['revert', 'revert-full-system', 'root-on-testbed',
             'isolation-machine', 'reboot']
     # disabled, see hook_downtmp()
-    # caps.append('downtmp-host=%s' % os.path.join(workdir, 'shared', 'tmp'))
+    # caps.append('downtmp-host=%s' % os.path.join(qemu.workdir, 'shared', 'tmp'))
     if normal_user:
         caps.append('suggested-normal-user=' + normal_user)
     return caps
 
 
 def hook_shell(dir, *extra_env):
-    global ssh_port, normal_user
-
-    if ssh_port:
+    if qemu.ssh_port:
         user = normal_user or '<user>'
         ssh = '    ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p %i %s@localhost\n' % (
-            ssh_port, user)
+            qemu.ssh_port, user)
     else:
         ssh = ''
 
@@ -698,7 +616,7 @@ Depending on which terminal program you have installed, you can use one of
 The tested source package is in %(dir)s
 
 Press Enter to resume running tests.
-''' % {'tty0': os.path.join(workdir, 'ttyS0'), 'dir': dir, 'ssh': ssh})
+''' % {'tty0': os.path.join(qemu.workdir, 'ttyS0'), 'dir': dir, 'ssh': ssh})
     with open('/dev/tty', 'r') as f:
         f.readline()
 
diff --git a/virt/autopkgtest-virt-ssh b/virt/autopkgtest-virt-ssh
index 861460f..186ebe6 100755
--- a/virt/autopkgtest-virt-ssh
+++ b/virt/autopkgtest-virt-ssh
@@ -30,8 +30,8 @@ import sys
 import os
 import argparse
 import tempfile
+import shlex
 import shutil
-import pipes
 import time
 import subprocess
 import socket
@@ -326,16 +326,18 @@ def build_auxverb():
 
     global sshconfig, sshcmd, capabilities, workdir
 
-    if sshconfig['login'] != 'root':
-        (sudocmd, askpass) = can_sudo(sshcmd)
-    else:
+    if sshconfig['login'] == 'root':
         (sudocmd, askpass) = (None, None)
-    if sudocmd:
-        if 'root-on-testbed' not in capabilities:
-            capabilities.append('root-on-testbed')
+        capabilities.append('root-on-testbed')
     else:
-        if 'root-on-testbed' in capabilities:
-            capabilities.remove('root-on-testbed')
+        (sudocmd, askpass) = can_sudo(sshcmd)
+        if sudocmd:
+            if 'root-on-testbed' not in capabilities:
+                capabilities.append('root-on-testbed')
+        else:
+            if 'root-on-testbed' in capabilities:
+                adtlog.warning('sudo command failed: removing root-on-testbed capability')
+                capabilities.remove('root-on-testbed')
 
     extra_cmd = ''
     if askpass:
@@ -375,7 +377,7 @@ def can_sudo(ssh_cmd):
               '/bin/echo -e "#!/bin/sh\necho \'%s\'" > $F;' \
               'chmod u+x $F; sync; echo $F' % args.password
         askpass = VirtSubproc.check_exec(
-            ssh_cmd + ['/bin/sh', '-ec', pipes.quote(cmd)],
+            ssh_cmd + ['/bin/sh', '-ec', shlex.quote(cmd)],
             outp=True, timeout=30).strip()
         adtlog.debug('created SUDO_ASKPASS from specified password')
         cleanup_paths.append(askpass)
@@ -436,6 +438,7 @@ def wait_port_down(host, port, timeout):
     VirtSubproc.timeout_start(timeout)
     while True:
         s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        s.settimeout(1)
         try:
             res = s.connect_ex((host, port))
             adtlog.debug('wait_port_down() connect: %s' % os.strerror(res))
@@ -455,7 +458,7 @@ def wait_port_down(host, port, timeout):
     VirtSubproc.timeout_stop()
 
 
-def hook_wait_reboot():
+def hook_wait_reboot(*func_args, **kwargs):
     global sshcmd
 
     if args.setup_script: