Am I missing something?

Deja-lost his-view  .... I am imagining seeing things on forum that were on the list and list things that are on the forum.

Anyway, as there seems to be some confusion of the actual spelling of the entries in /etc/apt/sources.list, and after some clarification by fsmithred I gathered a huge list of repositories to choose from and what I believe is the correct entry.

deb https://pkgmaster.devuan.org/merged/ ascii main contrib non-free
deb https://pkgmaster.devuan.org/merged/ ascii-backports main contrib non-free
deb https://pkgmaster.devuan.org/merged/ ascii-proposed-updates main contrib non-free
deb https://pkgmaster.devuan.org/merged/ ascii-security main contrib non-free
deb https://pkgmaster.devuan.org/merged/ ascii-updates main contrib non-free
deb https://pkgmaster.devuan.org/devuan/ ascii-proposed main contrib non-free
deb https://pkgmaster.devuan.org/devuan/ ascii-proposed-security main contrib non-free
deb https://pkgmaster.devuan.org/merged/ ceres main contrib non-free
deb https://pkgmaster.devuan.org/devuan/ experimental main contrib non-free
deb https://pkgmaster.devuan.org/merged/ jessie main contrib non-free
deb https://pkgmaster.devuan.org/merged/ jessie-backports main contrib non-free
deb https://pkgmaster.devuan.org/devuan/ jessie-proposed main contrib non-free
deb https://pkgmaster.devuan.org/devuan/ jessie-proposed-backports main contrib non-free
deb https://pkgmaster.devuan.org/devuan/ jessie-proposed-security main contrib non-free
deb https://pkgmaster.devuan.org/merged/ jessie-proposed-updates main contrib non-free
deb https://pkgmaster.devuan.org/merged/ jessie-security main contrib non-free
deb https://pkgmaster.devuan.org/merged/ jessie-updates main contrib non-free
deb https://pkgmaster.devuan.org/devuan/ sid main contrib non-free
deb https://pkgmaster.devuan.org/merged/ stable main contrib non-free
deb https://pkgmaster.devuan.org/merged/ stable-backports main contrib non-free
deb https://pkgmaster.devuan.org/devuan/ stable-proposed main contrib non-free
deb https://pkgmaster.devuan.org/merged/ stable-proposed-updates main contrib non-free
deb https://pkgmaster.devuan.org/merged/ stable-security main contrib non-free
deb https://pkgmaster.devuan.org/merged/ stable-updates main contrib non-free
deb https://pkgmaster.devuan.org/merged/ testing main contrib non-free
deb https://pkgmaster.devuan.org/merged/ testing-backports main contrib non-free
deb https://pkgmaster.devuan.org/devuan/ testing-proposed main contrib non-free
deb https://pkgmaster.devuan.org/merged/ testing-proposed-updates main contrib non-free
deb https://pkgmaster.devuan.org/merged/ testing-security main contrib non-free
deb https://pkgmaster.devuan.org/merged/ testing-updates main contrib non-free
deb https://pkgmaster.devuan.org/merged/ unstable main contrib non-free

deb tor://devuanfwojg73k6r.onion/ should be replaced to use the onion address or you could add tor+https://pkg....  to use tor without onion addresses.

I hope this helps to end the confusion.  I think some of those repositories, like sid, may be empty but that is not a 404 error, or the side that has non-free may be empty.  I hope that someone will verify this list is correct before my mistake or misperception spills more panic.

PS  For https and tor you need apt-transport-https & apt-transport-tor otherwise substitute http from the list, right?

PS2  The tor-project repositories are:

deb tor://sdscoq7snqtznauu.onion/torproject.org/ jessie/stretch/buster/sid main  (choose a distribution to match)
deb tor://sdscoq7snqtznauu.onion/torproject.org/ tor-experimental-0.3.2.x-stretch main (switch stretch to one you want)
or https://deb.torproject.org/torproject.org

but you must first import the gpg key (look it up at their web page in the linux/debian/ubuntu instructions for tor)

In what ways is FF-esr better beyond the marketing propaganda?

As I understand it the extended life support provides a more stable code that can be audited line by line before a new version is released and all revisions can be added to the existing code instead for an all new package replacing the old.  This gives more (if not adequate time) for security concerns to be addressed and published.  Meanwhile bugs in functionality cand be backported if the apply.  I believe the current version is 52-4 and has most of any bugs that ever appeared on 52 solved.

But there may be more to this than meets the eye.  It has only been a year or two? that debian quit making their own ff as iceweasel and icedove instead of tb.  I believe this -esr series was the bargain they struck with mozilla for a free-er and more steady code.

I am amazed of the size of the thing.  When I gave it a try I added a tiny bit more and the image doubled.

Katolaz from the DNG-list is trying to clarify

What he seems to not understand is that the repositories as they were could not be updated with the old key and the new key couldn't be updated with /merged
Only when the repositories were switched to /devuan was I able to update the key.  Switching then back to /merged solved the issue but it would have been nice if there were more clarified instructions before some of us were "automatically" shifted to the new system.

AGAIN, the installation that was kept up to date frequently didn't have such a problem, while the ones who hadn't been updated since before the last keyring was issued were impossible to update as they were.

SO, if you, the forum member or outsider, have not updated your installation for a while and are on onion repositories chances are you may experience the same mess. 

The underline of this is that "people" tend to respond a bit nasty here (Devuan) if they thing your question is putting blame on them, especially on that DNG list, when all you ask is for clarification to the lack of detailed instruction.

Amprolla3 was announced as a testing option for people to choose.  Those utilizing onion repositories were automatically and after the fact shoved to be testing something new.  And this made those with un-updated keyrings unable to update or upgrade anything.  That is the bottom line!

I'm waiting on the release notes so I can apply them

I by no means endorse any of them, and you do have a valid concern and everyone should.
WC has been discontinued since 5/16, so all those who do have one it is what they declared back then, or earlier.
TProject never had one, one of their developers did a personal one, and she fled the US to avoid the harassment she was getting for her involvement in tor and leap (bitmask is leap).  On the other hand bitmask is code, the individual vendors of the service should be of concern.  2 which appear to be US based do have a WC.  The rest are out of the US, as is leap.se

There was a good discussion on TP's site on the importance and the not so absolute importance of birds. 

It is the struggle that always matters, not the absolute outcome of a battle.  In lack of massively accepted alternatives it is best to support the little we do have believing in a good direction.

A drawback of being a us citizen is that you can be abducted (in 98% of the world) and brought back to "base".  The rest of us can tweet freely.  Now that is a fallacy in itself.  Nobody had heard of snowden till he was persecuted.

This is what quality journalism is all about.  Tomorrow's headlines would be referring to this forum as the source of the news for the demise of vuu-do

@greenjeans is nowhere to be found either.....   sources have him vacationing in vuu-do land, Jamaica.

Well that explains why I was having repository mix ups earlier this week, I was on this thing before it even got announced.

By the way, socks5 is one heck of a good way to make sure nobody messes with your packages between mirror and your disk.

I think this is really good work, it is appreciated.  I hope most people will appreciate it too.

I was seeing some weird action a few days ago but thought I was doing something wrong, which I always do and forget to fix back what I broke.  While on some recent minor upgrade I saw Debian's repository come up during update, and that was an instruction by devuan while using the onion addresses. 
So, do the new reps have onion addresses as well and what are they?

Re: Fsmithred

No, no sydlexia here    I am talking about pamac the equivalent of synaptic, not pacman the equivalent of apt/dpkg
It is pamac that has an app-tray-indicator for when an update to a package is available.  It may have been originally a Manjaro invention that the AUR community passed to the Arch world, but don't take my word on it.  It used to be simple and functional and they have made something that looks like an ubuntu gadget.

glancing at the repository it seems as devuan and merged have the same content (structure).
The problem appeared to be ffmpeg and some related library, it eventually got upgraded
The repo. that wanted to change name with apt was proposed-updates but appears the same in both devuan and merged

Interesting find was a |sid|

../
contrib/                                           20-Oct-2017 10:02                   -
main/                                              20-Oct-2017 10:02                   -
non-free/                                          20-Oct-2017 10:02                   -
InRelease                                          20-Oct-2017 10:03              128669
Release                                            20-Oct-2017 10:03              128147
Release.gpg                                        20-Oct-2017 10:03                 473

and ceres

../
contrib/                                           20-Oct-2017 10:02                   -
main/                                              20-Oct-2017 10:02                   -
non-free/                                          20-Oct-2017 10:02                   -
InRelease                                          20-Oct-2017 10:03              128669
Release                                            20-Oct-2017 10:03              128147
Release.gpg                                        20-Oct-2017 10:03                 473

Boring as usual, everything works, nothing to fix, nothing to configure .....  just a little more refined and tuned with a couple more gadgets

Still that Alt-F is in there, which in most editors and browsers, and many other guis, opens up the top left menu "File"

Not on vuu-do!