I guess it will work in jessie or ascii. The devuan bug report is on ascii, and I tested it on ascii (with cryptsetup 1.7). The debian bug report is from 2013 and is for cryptsetup 1.6. You might need to apply it manually on jessie if the files aren't exactly the same in jessie and ascii.

Huh. Other than when net.ifnames=1, when else would it not be generated? I have two ascii installs on the same computer; one has 70-persistent-net.rules and the other does not. Interfaces get the old names on both.

A patch was submitted for the slow shutdowns. (Thanks, Jan!)
https://bugs.devuan.org//cgi/bugreport.cgi?bug=237
I just tested it and can shut down with no delay and no "failed" message.

It's not one of our packages, and upstream already has marked it "Wontfix".
https://bugs.debian.org/cgi-bin/bugrepo … bug=720340

------------------------patch------------------------------------------------------
--- /lib/cryptsetup/cryptdisks.functions.orig   2018-08-14 17:12:31.543227705 +0200
+++ /lib/cryptsetup/cryptdisks.functions        2018-08-23 16:36:23.849064962 +0200
@@ -763,9 +763,17 @@
 
 # Removes all mappings in crypttab
 do_stop () {
-       local dst src key opts opencount major minor
+       local dst src key opts opencount major minor vgs vg
 
        dmsetup mknodes
+       if [ -x /sbin/lvm ]; then
+        vgs="$(/sbin/lvm vgscan | sed -n '/"/s/^.*"\([^'\'']*\)".*$/\1/p')"
+         if [ -n "${vgs}" ]; then
+          for vg in ${vgs}; do
+           /sbin/lvm vgchange -a n ${vg} >/dev/null 2>&1 
+          done 
+         fi
+        fi
        log_action_begin_msg "Stopping $INITSTATE crypto disks"
 
        egrep -v "^[[:space:]]*(#|$)" "$TABFILE" | while read dst src key opts; do
------------------------patch/-----------------------------------------------------

There are no devuan kernels. We use the debian kernels, unchanged. The only packages from debian that get changed are the ones that depend on systemd.

RAID - LUKS - LVM

This method uses one encrypted raid array with lvm on top of it, so you only have to enter one password to unlock the encrypted volume.

Partition two disks, each with a small partition for boot and a large partition for the array.
If you use gpt with bios boot, add a third partition, greater than 1M, unformatted, with EF02 or bios_grub flag.
If you use uefi, add a third partition, 100-500M, fat32, EF00 or esp and boot flags.

This example uses the first partition for the boot array and the second partition for the system array.
(The second array for /boot is optional. See notes on full-disk encryption at the end of this post.)

Create the arrays.

Don't use names like /dev/md0, /dev/md1...  If you do, cryptsetup will complain during update-initramfs. Use names like /dev/md/mdroot1 and /dev/md/mdboot1. (Note: the digit at the end is for refractainstaller, and it's really only needed on the unencrypted /boot. Any logical partitions in the lvm will have mapper names, and you can end those with a digit.)

mdadm --create -v /dev/md/mdroot1 -l1 -n2 /dev/sda2 /dev/sdb2
mdadm --create -v /dev/md/mdboot1 -l1 -n2 /dev/sda1 /dev/sdb1

Encrypt the root array, /dev/md/mdroot1, then open it and give it a name, like crypt

cryptsetup luksFormat /dev/md/mdroot1
cryptsetup luksOpen /dev/md/mdroot1 crypt

Set up LVM on the encrypted volume. The lv name sould end in a digit to make the installer happy.

pvcreate /dev/mapper/crypt
vgcreate vol0 /dev/mapper/crypt
lvcreate -L 5G vol0 -n  lvroot1
lvcreate -l +100%FREE vol0 -n lvhome1

Run refractainstaller.

Enter the following devices when the installer asks for the locations of /boot, operating system and /home.

/boot      /dev/md/mdboot1
/            /dev/mapper/vol0-lvroot1
/home    /dev/mapper/vol0-lvhome1

At the pause, switch to another console or terminal and do the following:

# save md detail to /etc/mdadm/mdadm.conf
mdadm --detail --scan /dev/md/mdboot1 >> /target/etc/mdadm/mdadm.conf
mdadm --detail --scan /dev/md/mdroot1 >> /target/etc/mdadm/mdadm.conf

# edit /target/etc/crypttab to add the following line:
crypt	    /dev/md/mdroot1    none    luks

# edit /target/etc/cryptsetup-initramfs/conf-hook so it says:
CRYPTSETUP=y

# rebuild the initramfs:
chroot /target update-initramfs -u

Return to installer and proceed.

RAID1 - LUKS - LVM with FULL DISK ENCRYPTION (no separate unencrypted boot)

This is the same as the above,except for the following:
  - don't make a separate array for /boot
  - don't enter a partition for /boot in the installer
  - at the pause, edit /target/etc/default/grub and add the following line:

GRUB_ENABLE_CRYPTODISK=y

Run update-initramfs after you have edited all the files.

When you reboot, you should be asked for the password twice - once before you see the grub menu and once when the system is booting. Grub is slow to recognize the password. Be patient. Don't press ENTER a second time, or your boot menu will disappear too fast for you to select anything other than the default boot.

Slow Shutdown Fix
When you get tired of waiting for your encrypted system to shut down, see this post for a fix:
https://dev1galaxy.org/viewtopic.php?pid=8289#p8289

LVM on RAID1

Partition disks as in the first post.

mdadm --create --verbose /dev/md0 --level=1 --raid-devices=2 /dev/sda1 /dev/sdb1
pvcreate /dev/md0
vgcreate vol0 /dev/md0
lvcreate -L 5G vol0 -n lvroot1
lvcreate -l +100%FREE vol0 -n lvhome2

Run refractainstaller
Choose a partition for the operating system:  /dev/mapper/vol0-lvroot1
Choose a partition for /home: /dev/mapper/vol0-lvhome2

At pause, before installing bootloader
go to another vt and run:

chroot /target
mdadm --detail --scan /dev/md0 >> /etc/mdadm/mdadm.conf
update-initramfs -u
exit

Proceed with installer. (install GRUB)

A simple solution would be to move those dependencies to Recommends. Then anyone who wanted a minimalist xfce could install without recommends. (Many of them already do this.)

campus, can you list the functions that are lost by installing without consolekit?

Something from this list probably does what you want.

$ apt-cache search yandex
rclone - rsync for commercial cloud storage
translate-shell - Command-line translator using Google Translate, etc.
git-annex-remote-rclone - rclone-based git annex special remote
youtube-dl - downloader of videos from YouTube and other sites

As explained above, you need to fix your sources.list.

This is wrong:

deb http://gb.deb.devuan.org/merged/ ascii/non-free main

This is right:

deb http://gb.deb.devuan.org/merged/ ascii main contrib non-free

Make similar changes in the other lines and update the cache again.

Edit: Ah, you posted while I was typing.

The microcode will be inserted into the initrd when you install the package. I think you can have both the amd and intel packages installed, but only the one for your processor will be in the initrd.

The messages are letting you know that some of your hardware can use non-free firmware. You would need to enable contrib and non-free repos, update, and then install firmware-misc-nonfree if you wanted it. I don't know if it will make a difference in how your vid card performs.

Sorry about that. I did read all your posts, but I didn't re-read them every time I returned.

Anyway, I did get xfce running without any *kits and without xfce4-session in ascii. There may be better ways to do this, but this is mostly working. I doubt that there will be any changes in xfce4-session in ascii, but it might be possible for beowulf. If you start testing beowulf, you could file a bug report against xfce4-session to get things moving.

I started with a refracta-nox install in virtualbox. (standard system utilities plus some extras, no X)
Added the following packages (without Recommends):

xorg xinit xserver-xorg-legacy xfwm4 xfwm4-themes xfconf xfce4-panel xfce4-settings xfdesktop4 xfce4-terminal thunar thunar-volman

Added needs_root_rights=yes to /etc/X11/Xwrapper.config

Put the following (exactly as posted) in /etc/X11/Xsession.d/31nokit

xfwm4 &
xfce4-panel &
xfdesktop

Start the xsession as user with startx /etc/X11/Xsession

To end the xsession, I've been dropping to console and running 'init 1' as root. I'm sure there are better ways to do this, but this is convenient for testing.