Please note: non-free-firmware is relevant from Bookworm/Daedalus onward.

Seems correct as I received

(component misspelt in sources.list?)

in Chimaera.

PS.What does non-free-firmware add? Anything described in these proposals?

Firmware is hardware drivers. Some hardware requires non-free firmware in order to function, but Debian is a Free Software only distro.

Previously, Debian had three repos - main, contrib, non-free, and every Debian installer came in "official" and "unofficial" versions, the latter including the non-free repo so that non-free firmware could be installed when hardware required it.

The non-free repo didn't contain just firmware, but also other software, and whilst some people require the non-free firmware for their computer to function, they still do not want to install other non-free software; having both firmware and software in the same repo was not ideal.

So now there's a fourth repo, non-free-firmware, which contains just the non-free firmware and which is now part of the official installers, removing the need for the "unofficial" installers. (It is still possible to block the installation of non-free firmware for those that wish to do so.)

The linked General Resolution is how the Debian project decided on the above course of action.

PS.What does non-free-firmware add? Anything described in these proposals?

There used to be a repo for non free firmware, now it's within the 'framework', not separate.

Just one thing, I get errors from apt-key... Which I have not seen before this week... says it's (apt-key) depreciated and superseded by another device/app.

Anyhow, it seems to work.

deb [trusted=yes] file:/mnt/dvn-dvd-only/ chimaera contrib main non-free 
deb [trusted=yes] file:/mnt/dvn-pool1-only/ chimaera main 

deb http://deb.devuan.org/merged/ chimaera main contrib non-free 
deb-src http://deb.devuan.org/merged/ chimaera main contrib non-free 

deb http://deb.devuan.org/merged/ chimaera-updates main contrib non-free 
deb-src http://deb.devuan.org/merged/ chimaera-updates main contrib non-free 

deb http://deb.devuan.org/merged/ chimaera-security main contrib non-free 
deb-src http://deb.devuan.org/merged/ chimaera-security main contrib non-free 

No apt pinning was required from my POV as this order automagically prefers file: type sources even though all of the sources above are considered as 500 priority (apt-cache policy to verify). Of course I mounted as CD-ROMs both iso files to make this setting work permanently so I dropped them in my users-disk-space, made two additional directories (under /mnt) and added to /etc/fstab:

/home/myusername/apt/devuan_chimaera_4.0.0_amd64_desktop.iso /mnt/dvn-dvd-only udf,iso9660 loop 0 0
/home/myusername/apt/devuan_chimaera_4.1_0_amd64_pool1.iso /mnt/dvn-pool1-only udf,iso9660 loop 0 0

and installed devuan-keyring.

deb [trusted=yes] file:/mnt/dev-dvd-only chimaera contrib main non-free non-free-firmware

Perfect! This one removed all the warnings.

PS.What does non-free-firmware add? Anything described in these proposals?

It might be possible to do that by pinning online sources to lower priority than the file or dvd source. Then you would need to specify the online source with the -t option to get packages from there.

Great, I will try to read and use Always_prefer_packages_from_a_repository.

Right, the whole concept in this topic seems quite short-term. But may be useful initially.

deb [trusted=yes] file:/mnt/dev-dvd-only chimaera contrib main non-free non-free-firmware

The cdrom: source line will probably need an /etc/fstab declaration as well, but I've never had any luck with it so I've stayed with the file: method.

When it works, you can check overall policy with apt-cache policy and then as said, possibly tune it with pinning preferences.

if it is possible to configure package management so as it first pulls packages requested by user from the install cd(s) and then only if not present or outdated downloads data from the central repository (mirrors)

It might be possible to do that by pinning online sources to lower priority than the file or dvd source. Then you would need to specify the online source with the -t option to get packages from there.

As time goes on, any packages you pull from online sources will be more likely to need newer versions of associated packages that are in the dvd source, so that the package in the dvd won't be installable.

I think another way to do it is to mount the iso file and add it as a cdrom source.

Before we go into details: what do you really want? Be able to be online and getting updates via internet connection? Or do you want to ban the internet and only depend on the DVD? You seem to have a mixture in your sources.list.

Right, it does not reflect clearly my current interest, I would like to profit from the files in the install iso I downloaded for hours, especially if they are proven compliant with all the other components of the system at the time they were published. Therefore I would like to know if it is possible to configure package management so as it first pulls packages requested by user from the install cd(s) and then only if not present or outdated downloads data from the central repository (mirrors).
If such "dual" configuration is not possible, then I would like to know how to properly configure /etc/apt/sources.list to use file: sources correctly and on the other hand, how to properly configure http:/ sources.

Echo . . . yes, that sources.list is a mess. Please have a look at this page:
https://devuan.org/os/packages

I decided to address this in a separate post as I expierienced much confusion, but not only in my /etc/apt/sources.list, but also in the https://www.devuan.org/os/packages you mentioned. It's some way off topic of my question but might be widely useful eventually.

1. First I could read there

2. A few lines below

Therefore I find it hard to decide whether source packages are required or not in devuan, which is default or not, and am looking for more distinct instruction on the expected content of /etc/apt/sources.list. Its post-install content is available in the first post of this topic.

On apt-get update encountered an

error: Media change: please insert the disc labeled 'Devuan GNU/Linux 4.0 chimaera amd64 - desktop 20211012' ...

After realizing that it is not me but the devuan installer thinking it is still in the times of Pentium 4 and expects me to browse through some CDs collection, I decided to permanently store the install .iso file on the internal ssd and point the /etc/apt/sources.list to it. I followed the steps described on https://novicenolonger.com/using-a-debi … rces-list/, so as now my /etc/apt/sources.list reads:

deb file:/mnt/dev-dvd-only chimaera contrib main non-free 

deb http://pkgmaster.devuan.org/merged/ chimaera-security main contrib non-free 
deb-src http://pkgmaster.devuan.org/merged/ chimaera-security main contrib non-free 

I have almost succeeded but on another

 # apt-get update
Get:1 file:/mnt/dev-dvd-only chimaera InRelease
Ign:1 file:/mnt/dev-dvd-only chimaera InRelease
Get:2 file:/mnt/dev-dvd-only chimaera Release [657 kB]
Get:2 file:/mnt/dev-dvd-only chimaera Release [657 kB]
Get:3 file:/mnt/dev-dvd-only chimaera Release.gpg
Ign:3 file:/mnt/dev-dvd-only chimaera Release.gpg
Hit:4 http://pkgmaster.devuan.org/merged chimaera-security InRelease
Reading package lists... Done                           
E: The repository 'file:/mnt/dev-dvd-only chimaera Release' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

So after reading the manpage mentioned above I edited a line in /etc/apt/sources.list to

deb [allow-insecure=yes] file:/mnt/dev-dvd-only chimaera contrib main non-free

However after another attempt of

 # apt-get update
Get:1 file:/mnt/dev-dvd-only chimaera InRelease
Ign:1 file:/mnt/dev-dvd-only chimaera InRelease
Get:2 file:/mnt/dev-dvd-only chimaera Release [657 kB]
Get:2 file:/mnt/dev-dvd-only chimaera Release [657 kB]
Get:3 file:/mnt/dev-dvd-only chimaera Release.gpg
Ign:3 file:/mnt/dev-dvd-only chimaera Release.gpg
Get:4 file:/mnt/dev-dvd-only chimaera/contrib amd64 Packages [18.4 kB]
Get:5 file:/mnt/dev-dvd-only chimaera/main amd64 Packages [3,816 kB]
Get:6 file:/mnt/dev-dvd-only chimaera/non-free amd64 Packages [49.4 kB]
Hit:7 http://pkgmaster.devuan.org/merged chimaera-security InRelease
Reading package lists... Done
W: The repository 'file:/mnt/dev-dvd-only chimaera Release' is not signed.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.

...I steel feel criticized. Is there any more correct way to make apt use install iso?