Strange mirror?

gu_1 · 2020-09-26 18:23:25

Hi. this is my first post here and english is not my mother language, so sorry for anything.

The problem is that I just installed Devuan ASCII this week selecting the brazillian mirror, everything was OK, apt install was working, but today apt install found a error that I fixed with apt update.
My fear is that something happened to somewhere between my computer and the mirror because that happened, and yesterday and before the apt install was downloading from some "ippact" server that started with "58.XX", but today is not.
Am I being paraniod or my computer can be infected because of this? (Like modified packages that cointain malware)

cat /etc/apt/sources.list
# deb cdrom:[Devuan GNU/Linux 2.1 (ascii) amd64 NETINSTALL - 2019-12-21 08:19:46 UTC]/ ascii main non-free

#deb cdrom:[Devuan GNU/Linux 2.1 (ascii) amd64 NETINSTALL - 2019-12-21 08:19:46 UTC]/ ascii main non-free

deb http://br.deb.devuan.org/merged ascii main
deb-src http://br.deb.devuan.org/merged ascii main

deb http://br.deb.devuan.org/merged ascii-security main
deb-src http://br.deb.devuan.org/merged ascii-security main

deb [arch=amd64] https://download.virtualbox.org/virtualbox/debian stretch contrib

Today apt install failure and apt update: https://drive.google.com/file/d/1aHxgLf … sp=sharing

golinux · 2020-09-26 18:41:39

Country codes are not available in Devuan. This from the website:

Devuan has a network of package repository mirrors in place. The mirror network is accessible using the FQDN “deb.devuan.org” via http NOT https. Country Codes (CC) are currently unavailable but a specific mirror from the list can be accessed using the corresponding BaseURL.

Head_on_a_Stick · 2020-09-26 18:54:04

golinux wrote:

Country codes are not available in Devuan.

Looks like the OP's mirror should still work:

~$ nslookup br.deb.devuan.org
Server:         9.9.9.9
Address:        9.9.9.9#53

Non-authoritative answer:
br.deb.devuan.org       canonical name = pkgmaster.devuan.org.
Name:   pkgmaster.devuan.org
Address: 54.36.142.183
Name:   pkgmaster.devuan.org
Address: 2001:41d0:2:1f68::3624:8eb7

~$

I think it's using the DNS Round-Robin for deb.devuan.org but that's just an uneducated guess

gu_1 · 2020-09-26 19:20:02

I did not change the mirror, I just selected the br mirror.
My question is: is there any security risk?

golinux · 2020-09-26 19:38:02

. . . a specific mirror from the list can be accessed using the corresponding BaseURL

This from the mirror list:

FQDN: devuan.c3sl.ufpr.br
BaseURL: devuan.c3sl.ufpr.br
Bandwidth: 20Gb/s
Rate: 1h
Country: Brazil
CountryCode: BR
Protocols: HTTP | RSYNC
Active: Yes
DNSRR: yes

I think this BaseURL needs to be in sources.list not the country code (which devuan is not set up to understand): devuan.c3sl.ufpr.br

golinux · 2020-09-26 19:41:09

gu_1 wrote:

I did not change the mirror, I just selected the br mirror.
My question is: is there any security risk?

No. The mirrors are just rsync copies of pkgmaster.devuan.org

gu_1 · 2020-09-26 23:17:24

golinux wrote:

gu_1 wrote:
I did not change the mirror, I just selected the br mirror.
My question is: is there any security risk?
No. The mirrors are just rsync copies of pkgmaster.devuan.org

OK, thanks

ralph.ronnquist · 2020-09-26 23:23:53

@gu_1: as was indicated by @Head_on_a_Stick the domain name br.deb.devuan.org resolves to the domain name pkgmaster.devuan.org which is Devuan's own repository server and not to the round-robin domain name deb.devuan.org.

Thus, by using br.deb.devuan.org you don't take advantage of any mirroring, and always get packages served by pkgmaster.devuan.org.

Whilst that is fine for any individual case, it's something we generally want people to avoid doing, since it accumulates into a reduced service for everyone. Therefore the advice is that you should really use deb.devuan.org.

If you do want to use some particular server, or a subset of the round-robin servers, then the way to go is to edit your /etc/hosts to resolve deb.devuan.org to that server/subset. For example, you might add these lines to /etc/hosts:

# My preferred package sources
192.80.24.194           deb.devuan.org  devuan.dcc.uchile.cl
200.236.31.1            deb.devuan.org  devuan.c3sl.ufpr.br
2801:82:80ff:8000::2    deb.devuan.org  devuan.c3sl.ufpr.br

Those particular lines would make apt use only the two servers devuan.dcc.uchile.cl and devuan.c3sl.ufpr.br as package sources (for ipv6, only the latter). (see man hosts for details about /etc/hosts)

Note: you may refer to https://pkgmaster.devuan.org/mirror_list.txt to find out which servers are in the round-robin, and you may use the host or dig commands to determine their IP addresses.

Devuan has a system in place to monitor round-robin servers with respect to their Devuan package service. You find graphs detailing status e.g. at http://veritas.devuan.org/apt-panoptico … pticon_cgp.

xinomilo · 2020-09-27 11:12:55

an alternative way to pick some mirrors, would be to create a local mirrors.txt file with desired mirrors, eg /home/user/mirrors.txt :

http://devuan.dcc.uchile.cl/merged
http://devuan.c3sl.ufpr.br/merged

then add a (eg) dev1mirrors.list in /etc/apt/sources.list.d with the following :

deb mirror+file:/home/user/mirrors.txt beowulf main
deb mirror+file:/home/user/mirrors.txt beowulf-updates main
deb mirror+file:/home/user/mirrors.txt beowulf-security main

and `apt update`. if it's working you can comment out/remove other devuan entries sources.list .

Last edited by xinomilo (2020-09-27 11:13:48)

The officially official Devuan Forum!

#1 2020-09-26 18:23:25

Strange mirror?

#2 2020-09-26 18:41:39

Re: Strange mirror?

#3 2020-09-26 18:54:04

Re: Strange mirror?

#4 2020-09-26 19:20:02

Re: Strange mirror?

#5 2020-09-26 19:38:02

Re: Strange mirror?

#6 2020-09-26 19:41:09

Re: Strange mirror?

#7 2020-09-26 23:17:24

Re: Strange mirror?

#8 2020-09-26 23:23:53

Re: Strange mirror?

#9 2020-09-27 11:12:55

Re: Strange mirror?

Board footer