The repository is unsigned, causing apt-get to fail and interrupt the image build in yet not well understood situations.

Good build (CI):

+ chroot /tmp/tmpBtT0y2 apt-get -y update
Hit:1 http://deb.debian.org/debian buster InRelease
Get:2 http://deb.debian.org/debian buster-updates InRelease [47.6 kB]
Get:3 http://security.debian.org/debian-security buster/updates InRelease [38.3 kB]
Get:4 http://ci.puri.sm scratch InRelease [11.1 kB]
Get:5 http://deb.debian.org/debian buster/main Sources [7625 kB]
Get:6 http://deb.debian.org/debian buster/contrib Sources [38.7 kB]
Get:7 http://deb.debian.org/debian buster/non-free Sources [83.6 kB]
Get:8 http://deb.debian.org/debian buster/main Translation-en [5761 kB]
Get:9 http://deb.debian.org/debian buster/contrib armhf Packages [39.3 kB]
Get:10 http://deb.debian.org/debian buster/contrib Translation-en [41.1 kB]
Get:11 http://deb.debian.org/debian buster/non-free armhf Packages [63.2 kB]
Get:12 http://deb.debian.org/debian buster/non-free Translation-en [80.3 kB]
Err:3 http://security.debian.org/debian-security buster/updates InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553
Get:13 http://ci.puri.sm scratch/librem5 armhf Packages [116 kB]
Get:14 http://ci.puri.sm scratch/librem5 all Packages [7924 B]
Reading package lists...
W: GPG error: http://security.debian.org/debian-security buster/updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553
E: The repository 'http://security.debian.org/debian-security buster/updates InRelease' is not signed.
+ cleanup_chroot
+ chroot /tmp/tmpBtT0y2 apt-get clean
+ rm /tmp/tmpBtT0y2/etc/resolv.conf
+ mv /tmp/tmpBtT0y2/etc/resolv.conf.bak /tmp/tmpBtT0y2/etc/resolv.conf
+ rm /tmp/tmpBtT0y2/usr/sbin/policy-rc.d
+ umount /tmp/tmpBtT0y2/dev/pts
+ umount /tmp/tmpBtT0y2/dev
+ umount /tmp/tmpBtT0y2/sys
+ umount /tmp/tmpBtT0y2/proc
+ '[' -f /tmp/tmpBtT0y2/var/log/gitrev.log ']'
Creating disk image

Bad build on host system

root@4106c660f0b7:/# cat /etc/debian_version 
buster/sid

is:

+ chroot /tmp/tmpoXXj_u apt-get -y update
Hit:1 http://deb.debian.org/debian buster InRelease
Get:2 http://security.debian.org/debian-security buster/updates InRelease [38.3 kB]
Get:3 http://deb.debian.org/debian buster-updates InRelease [47.6 kB]       
Get:4 http://deb.debian.org/debian buster/contrib Sources [39.0 kB]         
Get:5 http://deb.debian.org/debian buster/main Sources [7629 kB]            
Err:2 http://security.debian.org/debian-security buster/updates InRelease   
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553
Get:6 http://ci.puri.sm scratch InRelease [11.1 kB]                         
Get:7 http://ci.puri.sm scratch/librem5 all Packages [7924 B]               
Get:8 http://ci.puri.sm scratch/librem5 amd64 Packages [107 kB]             
Get:9 http://deb.debian.org/debian buster/non-free Sources [83.5 kB]
Get:10 http://deb.debian.org/debian buster/main Translation-en [5765 kB]
Get:11 http://deb.debian.org/debian buster/contrib amd64 Packages [45.7 kB]
Get:12 http://deb.debian.org/debian buster/contrib Translation-en [41.4 kB]
Get:13 http://deb.debian.org/debian buster/non-free amd64 Packages [79.9 kB]
Get:14 http://deb.debian.org/debian buster/non-free Translation-en [80.1 kB]
Reading package lists... Done                                       
W: GPG error: http://security.debian.org/debian-security buster/updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553
E: The repository 'http://security.debian.org/debian-security buster/updates InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
+ cleanup_chroot
+ chroot /tmp/tmpoXXj_u apt-get clean
+ rm /tmp/tmpoXXj_u/etc/resolv.conf
+ mv /tmp/tmpoXXj_u/etc/resolv.conf.bak /tmp/tmpoXXj_u/etc/resolv.conf
+ rm /tmp/tmpoXXj_u/usr/sbin/policy-rc.d
+ umount /tmp/tmpoXXj_u/dev/pts
+ umount /tmp/tmpoXXj_u/dev
+ umount /tmp/tmpoXXj_u/sys
+ umount /tmp/tmpoXXj_u/proc
+ '[' -f /tmp/tmpoXXj_u/var/log/gitrev.log ']'
EEEK! Something bad happened...
Command failed: /mnt/work/image-builder/root.sh /tmp/tmpoXXj_u qemu-x86_64.img

Note that while the bad build log is amd64, the armhf failure is identical.