aptly repo CLI fails when run with su aptly -c: ERROR: mkdir $HOME: permission denied

[timblaktu]

Originally discovered when running manala.aptly ansible role on a fresh Debian Buster server (issue link), I get permission denied error creating $HOME dir. Details:

1. the system is a Debian Buster (10.5)
2. aptly was installed using debian apt, package version is: 1.3.0+ds1-2.2~deb10u1
3. ansible user is a normal user but is passwordless sudoer
4. aptly user exists and home dir /home/aptly exists (see other user env below)

ansible@aptly:~$ su aptly -c "aptly repo list --raw"
Password:
ERROR: mkdir $HOME: permission denied
ansible@aptly:~$

Also, it appears that a dir named "$HOME" was created in /home/aptly:

ansible@aptly:~$ ls -la ~aptly
total 36
drwxr-xr-x 5 aptly users 4096 Nov  4 13:43  .
drwxr-xr-x 4 root  root  4096 Nov  3 13:25  ..
drwxr-xr-x 3 aptly users 4096 Nov  4 13:43 '$HOME'
-rw------- 1 aptly users  717 Nov  9 09:59  .bash_history
-rw-r--r-- 1 aptly users  220 Apr 17  2019  .bash_logout
-rw-r--r-- 1 aptly users 3526 Apr 17  2019  .bashrc
drwx------ 3 aptly users 4096 Nov  9 10:00  .gnupg
-rw-r--r-- 1 aptly users  807 Apr 17  2019  .profile
drwx------ 2 aptly users 4096 Nov  3 13:31  .ssh

which appears to contain the expected contents in aptly user's home dir, i.e.

ansible@aptly:~$ tree -a ~aptly/\$HOME/
/home/aptly/$HOME/
└── .aptly
    ├── db
    │   ├── 000006.ldb
    │   ├── 000009.log
    │   ├── CURRENT
    │   ├── LOCK
    │   ├── LOG
    │   └── MANIFEST-000010
    └── public
        ├── dists
        │   └── stretch
        │       ├── main
        │       │   └── binary-amd64
        │       │       ├── Packages
        │       │       ├── Packages.bz2
        │       │       ├── Packages.gz
        │       │       └── Release
        │       └── Release
        └── pool

8 directories, 11 files

The same error occurs when I substitute and other aptly repo command. Note I can successfully run su aptly -c "aptly help" with no error.

When logged in as aptly user, I can run ALL of the above commands successfully:

aptly@aptly:~$ aptly repo list --raw
b-stretch
aptly@aptly:~$

Expected outcome is that aptly repo commands would work when run using su aptly -c.

Aptly user env:

ansible@aptly:~$ su aptly -c "env"
Password:
SHELL=/bin/bash
PWD=/home/ansible
LOGNAME=aptly
XDG_SESSION_TYPE=tty
_=/usr/bin/env
HOME=/home/aptly
LANG=en_US.UTF-8
LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:
SSH_CONNECTION=172.16.15.107 58270 172.16.22.24 22
XDG_SESSION_CLASS=user
TERM=screen-256color
USER=aptly
SHLVL=1
XDG_SESSION_ID=136
XDG_RUNTIME_DIR=/run/user/1000
SSH_CLIENT=172.16.15.107 58270 22
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
MAIL=/var/mail/aptly
SSH_TTY=/dev/pts/0