MiyoLinux wrote:

I may be wrong, but I don't remember being advised to change jessie repositories over to deb.devuan.org. I thought they were supposed to stay as auto.mirror.devuan.org. Seems like deb.devuan.org was introduced with ASCII.

I just looked at the Devuan website, and it's still showing jessie as using auto.mirror.devuan.org.

auto.mirror.devuan.org is still the default repository because there has never been a point release for jessie and that is the repository used on the isos.

This note is also on the website (in several places):

IMPORTANT NOTE: auto.mirror is now deprecated and will be decommissioned. Please make sure you have the latest devuan-keyring package with apt-get install devuan-keyring and then point your /etc/apt/sources.list to deb.devuan.org.

Oh.

I may be wrong, but I don't remember being advised to change jessie repositories over to deb.devuan.org. I thought they were supposed to stay as auto.mirror.devuan.org. Seems like deb.devuan.org was introduced with ASCII.

I just looked at the Devuan website, and it's still showing jessie as using auto.mirror.devuan.org.

auto.mirror.devuan.org is still the default repository because there has never been a point release for jessie and that is the repository used on the isos.

This note is also on the website (in several places):

I just looked at the Devuan website, and it's still showing jessie as using auto.mirror.devuan.org.

However, when I change the url in the sources.list file to "auto.mirror.devuan.org", it shows updates available:

So, the old "auto.mirror.devuan.org" address is showing updates available, while the newer "deb.devuan.org" is showing no updates available.  "https" in the url is not even involved here.

As an example using the program wget, which is shown as one of the programs that could be upgraded - with deb.devuan.org no upgrade is showing:

root@Am-VPN:/etc/apt# apt-cache policy wget
wget:
  Installed: 1.16-1+deb8u5
  Candidate: 1.16-1+deb8u5
  Version table:
 *** 1.16-1+deb8u5 0
        500 http://deb.devuan.org/merged/ jessie/main amd64 Packages
        100 /var/lib/dpkg/status

However, using "auto.mirror.devuan.org", it does pick up the upgradeable program:

root@Am-VPN:/etc/apt# apt-cache policy wget
wget:
  Installed: 1.16-1+deb8u5
  Candidate: 1.16-1+deb8u6
  Version table:
     1.16-1+deb8u6 0
        500 http://auto.mirror.devuan.org/merged/ jessie-security/main amd64 Packages
 *** 1.16-1+deb8u5 0
        500 http://auto.mirror.devuan.org/merged/ jessie/main amd64 Packages
        100 /var/lib/dpkg/status

It appears that deb.devuan.org is not picking up the jessie-security updates section of the repo.  This is my sources.list.  I alternated between the two url addresses, of course.

deb http://deb.devuan.org/merged/ jessie main contrib non-free
#deb http://auto.mirror.devuan.org/merged/ jessie main contrib non-free

deb http://deb.devuan.org/merged/ jessie-security main contrib non-free
#deb http://auto.mirror.devuan.org/merged/ jessie-security main contrib non-free

deb http://deb.devuan.org/merged/ jessie-updates main contrib non-free
#deb http://auto.mirror.devuan.org/merged/ jessie-updates main contrib non-free

Geoff

haary wrote:

All packages are up to date.

That is working.  There are no updates because everything is already up to date,

See? sources.list is correct, but still no updates. Please note that I am using Jessie. Ascii is working fine with deb.devuan.org.

Jessie is old stable.  It will probably only get security patches.  I just ran update and there are no packages for me to install either on jessie i386.

Please read the title and the first post. With auto.mirror.devuan.org updates are there, the last line says

62 packages can be upgraded. Run 'apt list --upgradable' to see 

with deb.devuan.org they aren't. It should be easy to reproduce.

Then, about HTTPS.

The current mirroring technique uses DNS to make deb.devuan.org resolve to some mirror's IP for each "request". Then the problem with using HTTPS is that it requires the sharing of credentials, where recipient organisations need to take on the responsibility of taking due care of them. This is part of the 'trust aspect' of using HTTPS more than the transport encryption aspect, and to have a commercial organisation (which is applicable for many mirrors) take on a responsibility is asking for more than the mere mirroring functionality. Many mirrors do serve via HTTPS, but they do so with their own domain names rather than named as deb.devuan.org.

The alternative solutions would involve handling all requests, either proxying them or bouncing temporary redirects, by a layer of deb.devuan.org hosts physically distributed over the world. This would attract a significant ongoing effort and cost.

Thus, if HTTPS is my thing, then I need to set up my sources.list to use the accredited name(s) of my chosen server(s) directly.

All packages are up to date.

That is working.  There are no updates because everything is already up to date,

Jessie is old stable.  It will probably only get security patches.  I just ran update and there are no packages for me to install either on jessie i386.

https://superuser.com/questions/1417617 … -in-debian

Yes, you should use deb.devuan.org, and the URLs should also end with /merged. Please check and try again.

Here we go again:

ahu:~# cat /etc/apt/sources.list        
deb http://deb.devuan.org/merged jessie main
deb http://deb.devuan.org/merged jessie-updates main
deb http://deb.devuan.org/merged jessie-security main

root@ahu:~# apt update                       
Hit http://deb.devuan.org jessie InRelease
Hit http://deb.devuan.org jessie-updates InRelease
Hit http://deb.devuan.org jessie-security InRelease
Hit http://deb.devuan.org jessie/main i386 Packages
Hit http://deb.devuan.org jessie-updates/main i386 Packages
Hit http://deb.devuan.org jessie-security/main i386 Packages
Ign http://deb.devuan.org jessie/main Translation-en_US
Ign http://deb.devuan.org jessie/main Translation-en
Ign http://deb.devuan.org jessie-updates/main Translation-en_US
Ign http://deb.devuan.org jessie-updates/main Translation-en
Ign http://deb.devuan.org jessie-security/main Translation-en_US
Ign http://deb.devuan.org jessie-security/main Translation-en
Reading package lists... Done
Building dependency tree
Reading state information... Done
All packages are up to date.

See? sources.list is correct, but still no updates. Please note that I am using Jessie. Ascii is working fine with deb.devuan.org.

I do wonder, though, whether https is a good security thing or an unnecessary overhead.

Geoff

Do you have any comments on the use of http as opposed to the use of https?

I think I started to use https following mailing list discussion, as it seemed to have been put forward as a good idea!

Geoff

@admins: I would like to support this request.

Thanks you, Rolf