git.devuan.org is a "git store" just like github but owned by Devuan and not Microsoft.

The hands-on would be, after registration, to clone (aka fork) the project concerned, add into your clone and then issue a merge request for the main project developers to review and include it.

Yes, https://git.devuan.org/devuan/xorg-server is where it happens. The review process of a fix is in full swing so you may hold your breath. well, maybe not... breath easy, but expect there's something coming soon.

Are you able to try with the ISO on a stick by itself?

yes it might be slower than some.. but to see an image on your screen of course requires it to be downloaded to your machine, whether or not you know to where on your machine it ends up. (and using "display $url" [from imagemagick] gives you that same vacuous experience all without ads and other junk).

Good idea though; perhaps devuan can find someone to set up and maintain it on the infrastructure.

re catbox; I don't use github since it became a microsoft site.

https://wiki.debian.org/Firmware

Perhaps you can show the non-working qemu command line here.

If you upgrade you should read "upgrade instructions".

The kernel does not install anything when it starts.

Probably you can reconfirm the distribution installation with

apt-get dist-upgrade

but it is up to you to decide whether that is the right thing for you to do. As always you /take responsibility for anything you do.

Yes afaik the UEFI emulation does not handle boot from cdrom.

If you install the ISO as a second disk or a USB memory stick, then eg qemu with UEFI emoulation works (provided that the backing file, i.e. the ISO, is writable).

Has been like that since yonks.

Perhaps you can point me at a small ISO that works, to explore. There may well be something to improve in Devuan's iso preparation.

Afaik, the virtual machine emulation of UEFI can't handle cdrom, so try by having the ISO as a second disk rather, or emulated USB memory stick.

I think the backing file ISO also needs to be writable for that UEFI emulation.

Run apt update once and confirm.

EDIT for some background: The root of this problem is that the InRelease file for debian-security previously had the wrong "Label" setting of "Devuan Security", and that is what has got loaded onto your system while updating devuan-secuirty before while in testing.

Apt keeps a copy of all the "dists" files, such as

/var/lib/apt/lists/....InRelease

and it's that file that has

Label: Devuan Security

on your system, whereas the one in the remote repo was corrected to have

Label: Devuan-Security

when also it changed to

Suite: stable-security

That is what the Apt system (by apt-get) discovers and complains about. The apt program does the same, but then reacts by asking you to confirm that the new file is good rather than  just discarding it.

@abd, perhaps you can enter an Alt-F2 shell, then capture and send the output of blkid and fdisk -l for me.

Note that the ISO has a first partition that "spans the whole drive", which in particular includes the partition table. If you then mess with the partition table, it upsets the recognition of that partition as an iso9660 filesystem, and the installer might not be able to mount it.

EDIT: in short, where the dialogs for manual selection of media ask for module and device, choose "none" for additional module, and use the device node name from blkid, for the first partition of the device with the ISO image.