then add a (eg) dev1mirrors.list in /etc/apt/sources.list.d with the following :

and `apt update`. if it's working you can comment out/remove other devuan entries sources.list .

Thus, by using br.deb.devuan.org you don't take advantage of any mirroring, and always get packages served by pkgmaster.devuan.org.

Whilst that is fine for any individual case, it's something we generally want people to avoid doing, since it accumulates into a reduced service for everyone. Therefore the advice is that you should really use deb.devuan.org.

If you do want to use some particular server, or a subset of the round-robin servers, then the way to go is to edit your /etc/hosts to resolve deb.devuan.org to that server/subset. For example, you might add these lines to /etc/hosts:

# My preferred package sources
192.80.24.194           deb.devuan.org  devuan.dcc.uchile.cl
200.236.31.1            deb.devuan.org  devuan.c3sl.ufpr.br
2801:82:80ff:8000::2    deb.devuan.org  devuan.c3sl.ufpr.br

Those particular lines would make apt use only the two servers devuan.dcc.uchile.cl and devuan.c3sl.ufpr.br as package sources (for ipv6, only the latter). (see man hosts for details about /etc/hosts)

Note: you may refer to https://pkgmaster.devuan.org/mirror_list.txt to find out which servers are in the round-robin, and you may use the host or dig commands to determine their IP addresses.

Devuan has a system in place to monitor round-robin servers with respect to their Devuan package service. You find graphs detailing status e.g. at http://veritas.devuan.org/apt-panoptico … pticon_cgp.

gu_1 wrote:

I did not change the mirror,  I just selected the br mirror.
My question is: is there any security risk?

No.  The mirrors are just rsync copies of pkgmaster.devuan.org

OK, thanks

I did not change the mirror,  I just selected the br mirror.
My question is: is there any security risk?

No.  The mirrors are just rsync copies of pkgmaster.devuan.org

. . . a specific mirror from the list can be accessed using the corresponding BaseURL

This from the mirror list:

I think this BaseURL needs to be in sources.list not the country code (which devuan is not set up to understand):  devuan.c3sl.ufpr.br

Country codes are not available in Devuan.

Looks like the OP's mirror should still work:

~$ nslookup br.deb.devuan.org
Server:         9.9.9.9
Address:        9.9.9.9#53

Non-authoritative answer:
br.deb.devuan.org       canonical name = pkgmaster.devuan.org.
Name:   pkgmaster.devuan.org
Address: 54.36.142.183
Name:   pkgmaster.devuan.org
Address: 2001:41d0:2:1f68::3624:8eb7

~$

I think it's using the DNS Round-Robin for deb.devuan.org but that's just an uneducated guess

The problem is that I just installed Devuan ASCII this week selecting the brazillian mirror, everything was OK, apt install was working, but today apt install found a error that I fixed with apt update.
My fear is that something happened to somewhere between my computer and the mirror because that happened, and yesterday and before the apt install was downloading from some "ippact" server that started with "58.XX", but today is not.
Am I being paraniod or my computer can be infected because of this? (Like modified packages that cointain malware)

cat /etc/apt/sources.list
# deb cdrom:[Devuan GNU/Linux 2.1 (ascii) amd64 NETINSTALL - 2019-12-21 08:19:46 UTC]/ ascii main non-free

#deb cdrom:[Devuan GNU/Linux 2.1 (ascii) amd64 NETINSTALL - 2019-12-21 08:19:46 UTC]/ ascii main non-free

deb http://br.deb.devuan.org/merged ascii main
deb-src http://br.deb.devuan.org/merged ascii main

deb http://br.deb.devuan.org/merged ascii-security main
deb-src http://br.deb.devuan.org/merged ascii-security main

deb [arch=amd64] https://download.virtualbox.org/virtualbox/debian stretch contrib

Today apt install failure and apt update: https://drive.google.com/file/d/1aHxgLf … sp=sharing