--- a/coverage.sh
+++ b/coverage.sh
@@ -12,7 +12,10 @@ rm -f shared/cover_db.img
 # prepare image for cover_db
 guestfish -N shared/cover_db.img=disk:100M -- mkfs vfat /dev/sda
 
-cp mmdebstrap shared
+# only copy if necessary
+if [ ! -e shared/mmdebstrap ] || [ mmdebstrap -nt shared/mmdebstrap ]; then
+	cp -a mmdebstrap shared
+fi
 
 starttime=
 total=54
@@ -594,15 +597,17 @@ done
 guestfish add-ro shared/cover_db.img : run : mount /dev/sda / : tar-out / - \
        | tar -C shared/cover_db --extract
 
-cover -nogcov -report html_basic shared/cover_db
-mkdir -p report
-for f in common.js coverage.html cover.css css.js mmdebstrap--branch.html mmdebstrap--condition.html mmdebstrap.html mmdebstrap--subroutine.html standardista-table-sorting.js; do
-	cp -a shared/cover_db/$f report
-done
-cover -delete shared/cover_db
+if [ -e shared/cover_db/runs ]; then
+	cover -nogcov -report html_basic shared/cover_db
+	mkdir -p report
+	for f in common.js coverage.html cover.css css.js mmdebstrap--branch.html mmdebstrap--condition.html mmdebstrap.html mmdebstrap--subroutine.html standardista-table-sorting.js; do
+		cp -a shared/cover_db/$f report
+	done
+	cover -delete shared/cover_db
 
-echo
-echo open file://$(pwd)/report/coverage.html in a browser
-echo
+	echo
+	echo open file://$(pwd)/report/coverage.html in a browser
+	echo
+fi
 
 rm shared/tar1.txt shared/tar2.txt
--- a/mmdebstrap
+++ b/mmdebstrap
@@ -747,7 +747,11 @@ sub setup {
     }
 
     # setting PATH for chroot, ldconfig, start-stop-daemon...
-    $ENV{"PATH"} = "/usr/sbin:/usr/bin:/sbin:/bin";
+    if (defined $ENV{PATH} && $ENV{PATH} ne "") {
+	$ENV{PATH} = "$ENV{PATH}:/usr/sbin:/usr/bin:/sbin:/bin";
+    } else {
+	$ENV{PATH} = "/usr/sbin:/usr/bin:/sbin:/bin";
+    }
 
     my %pkgs_to_install;
     if (defined $options->{include}) {
--- a/make_mirror.sh
+++ b/make_mirror.sh
@@ -160,11 +160,15 @@ mkdir -p "$cachedir"
 # We do not use our own package cache here because
 #   - it doesn't (and shouldn't) contain the extra packages
 #   - it doesn't matter if the base system is from a different mirror timestamp
+# Write tarfile via redirection because in the Debian package autopkgtest
+# ./mmdebstrap is a suid binary and we do not want the tarfile being owned
+# by root.
+tmpdir="$(mktemp -d)"
 ./mmdebstrap --variant=apt --architectures=amd64,armhf --mode=unshare \
 	--include=linux-image-amd64,systemd-sysv,perl,arch-test,fakechroot,fakeroot,mount,uidmap,proot,qemu-user-static,binfmt-support,qemu-user,dpkg-dev,mini-httpd,libdevel-cover-perl,debootstrap,libfakechroot:armhf,libfakeroot:armhf \
-	unstable debian-unstable.tar
+	unstable > "$tmpdir/debian-unstable.tar"
 
-cat << END > extlinux.conf
+cat << END > "$tmpdir/extlinux.conf"
 default linux
 timeout 0
 
@@ -173,7 +177,7 @@ kernel /vmlinuz
 append initrd=/initrd.img root=/dev/sda1 rw console=ttyS0,115200
 serial 0 115200
 END
-cat << END > mmdebstrap.service
+cat << END > "$tmpdir/mmdebstrap.service"
 [Unit]
 Description=mmdebstrap worker script
 
@@ -192,47 +196,54 @@ END
 # filesystem that doesn't support ownership information at all and a umask that
 # gives read/write access to everybody.
 # https://github.com/pjcj/Devel--Cover/issues/223
-cat << 'END' > worker.sh
+cat << 'END' > "$tmpdir/worker.sh"
 #!/bin/sh
 mount -t 9p -o trans=virtio,access=any mmdebstrap /mnt
 (
 	cd /mnt;
-	mkdir -p cover_db
-	mount -o loop,umask=000 cover_db.img cover_db
+	if [ -e cover_db.img ]; then
+		mkdir -p cover_db
+		mount -o loop,umask=000 cover_db.img cover_db
+	fi
 	sh ./test.sh
 	ret=$?
-	df -h cover_db
-	umount cover_db
+	if [ -e cover_db.img ]; then
+		df -h cover_db
+		umount cover_db
+	fi
 	echo $ret
 ) > /mnt/result.txt 2>&1
 umount /mnt
 systemctl poweroff
 END
-chmod +x worker.sh
-cat << 'END' > mini-httpd
+chmod +x "$tmpdir/worker.sh"
+cat << 'END' > "$tmpdir/mini-httpd"
 START=1
 DAEMON_OPTS="-h 127.0.0.1 -p 80 -u nobody -dd /mnt -i /var/run/mini-httpd.pid -T UTF-8"
 END
-cat << 'END' > hosts
+cat << 'END' > "$tmpdir/hosts"
 127.0.0.1 localhost
 END
-guestfish -N debian-unstable.img=disk:2G -- \
+#libguestfs-test-tool
+#export LIBGUESTFS_DEBUG=1 LIBGUESTFS_TRACE=1
+guestfish -N "$tmpdir/debian-unstable.img"=disk:2G -- \
 	part-disk /dev/sda mbr : \
 	part-set-bootable /dev/sda 1 true : \
 	mkfs ext2 /dev/sda1 : \
 	mount /dev/sda1 / : \
-	tar-in debian-unstable.tar / : \
+	tar-in "$tmpdir/debian-unstable.tar" / : \
 	extlinux / : \
-	copy-in extlinux.conf / : \
+	copy-in "$tmpdir/extlinux.conf" / : \
 	mkdir-p /etc/systemd/system/multi-user.target.wants : \
 	ln-s ../mmdebstrap.service /etc/systemd/system/multi-user.target.wants/mmdebstrap.service : \
-	copy-in mmdebstrap.service /etc/systemd/system/ : \
-	copy-in worker.sh / : \
-	copy-in mini-httpd /etc/default : \
-	copy-in hosts /etc/ :
-rm extlinux.conf worker.sh mini-httpd hosts debian-unstable.tar mmdebstrap.service
-qemu-img convert -O qcow2 debian-unstable.img "$cachedir/debian-unstable.qcow"
-rm debian-unstable.img
+	copy-in "$tmpdir/mmdebstrap.service" /etc/systemd/system/ : \
+	copy-in "$tmpdir/worker.sh" / : \
+	copy-in "$tmpdir/mini-httpd" /etc/default : \
+	copy-in "$tmpdir/hosts" /etc/ :
+rm "$tmpdir/extlinux.conf" "$tmpdir/worker.sh" "$tmpdir/mini-httpd" "$tmpdir/hosts" "$tmpdir/debian-unstable.tar" "$tmpdir/mmdebstrap.service"
+qemu-img convert -O qcow2 "$tmpdir/debian-unstable.img" "$cachedir/debian-unstable.qcow"
+rm "$tmpdir/debian-unstable.img"
+rmdir "$tmpdir"
 
 mirror="http://127.0.0.1/debian"
 SOURCE_DATE_EPOCH=$(date --date="$(grep-dctrl -s Date -n '' "$mirrordir/dists/unstable/Release")" +%s)
--- a/run_qemu.sh
+++ b/run_qemu.sh
@@ -1,17 +1,23 @@
 #!/bin/sh
 
+set -eu
+
 cachedir="./shared/cache"
+tmpdir="$(mktemp -d)"
 
-qemu-img create -f qcow2 -b "$cachedir/debian-unstable.qcow" debian-unstable-overlay.qcow
+# the path to debian-unstable.qcow must be absolute or otherwise qemu will
+# look for the path relative to debian-unstable-overlay.qcow
+qemu-img create -f qcow2 -b "$(realpath $cachedir)/debian-unstable.qcow" "$tmpdir/debian-unstable-overlay.qcow"
 qemu-system-x86_64 -enable-kvm -m 512M -nographic \
 	-monitor unix:/tmp/monitor,server,nowait \
 	-serial unix:/tmp/ttyS0,server,nowait \
 	-serial unix:/tmp/ttyS1,server,nowait \
 	-virtfs local,id=mmdebstrap,path="$(pwd)/shared",security_model=none,mount_tag=mmdebstrap \
-	-drive file=debian-unstable-overlay.qcow,cache=unsafe,index=0
+	-drive file="$tmpdir/debian-unstable-overlay.qcow",cache=unsafe,index=0
 head --lines=-1 shared/result.txt
 if [ "$(tail --lines=1 shared/result.txt)" -ne 0 ]; then
 	echo "test.sh failed"
 	exit 1
 fi
-rm debian-unstable-overlay.qcow shared/result.txt
+rm "$tmpdir/debian-unstable-overlay.qcow" shared/result.txt
+rmdir "$tmpdir"
