I've been thinking about the topic a bit, and I've come to a few conclusions:
* There's no reason not to use apt for dependency resolution. As I understand, debootstrap only doesn't so it doesn't depend on Debian-specific things.
* You want to be able to unpack every package in isolation so you can commit them into OSTree individually.
* You probably can't run any preinst scripts. This is because you need either a (partial) filesystem tree (if it's a shell script) or binary emulation (if it's compiled, as is e.g. the case for the dash package). In general, it seems to me that running package code during the unpack phase is probably out of the question.
* If you don't want to run preinst, you can't use "dpkg --unpack" because that's not a valid package state. Installing a package manually isn't actually that difficult (I have a prototype that simply copies what multistrap does) but you have to tie yourself to the dpkg database format.
I don't see a way to cleanly deal with the preinst thing. "Not running preinst" has been working fine for multistrap, but I suspect it'll break packages that do fancy diverting in their preinst. I've been going on the assumption that that's ok, but if it's not, things get messier.
