I can't replicate it outside of testenv, but in testenv, the ca-certificates post_install scriptlet (which just runs usr/bin/update-ca-certificates --fresh) fails:

[luke@thinkpenguin-par test]$  testsudo strace -ff -tt -o strace.out librechroot -n test2 make
[sudo] password for luke: 
==> Creating 'root' copy for chroot [test2]
Create subvolume '/var/lib/archbuild/test2/root'
==> Creating install root at /var/lib/archbuild/test2/root
==> Installing packages to /var/lib/archbuild/test2/root
:: Synchronizing package databases...
...
(30/91) installing libcap                                [##############################] 100%
(31/91) installing coreutils                             [##############################] 100%
(32/91) installing sed                                   [##############################] 100%
(33/91) installing ca-certificates                       [##############################] 100%
error: command failed to execute correctly
(34/91) installing shadow                                [##############################] 100%
...

It looks like the first call to mktemp is failing:

$ grep -l 'execve("usr/bin/update-ca-certificates",' strace.out.*|xargs grep clone|sed 's/.* /strace.out./'|xargs grep execve
strace.out.29621:14:14:23.487806 execve("/usr/bin/mktemp", ["mktemp", "-t", "ca-certificates.crt.tmp.XXXXXX"], [/* 27 vars */]) = 0
strace.out.29622:14:14:23.492452 execve("/usr/bin/rm", ["rm", "-f", ""], [/* 27 vars */]) = 0
strace.out.29623:14:14:23.495894 execve("/usr/bin/rm", ["rm", "-f", ""], [/* 27 vars */]) = 0
strace.out.29624:14:14:23.499166 execve("/usr/bin/rm", ["rm", "-f", ""], [/* 27 vars */]) = 0

My first thought when I saw that is that ca-certificates was being installed before coreutils, but looking at stdout, I verified that that's not the case. Perhaps it is something to do with testsudo+TMPDIR?