deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

haary · 2019-05-06 08:13:57

The documentation at https://devuan.org/os/etc/apt/sources.list suggests that one should use deb.devuan.org instead of auto.mirror.devuan.org.
However, deb.devuan.org did not get any updates for Devuan Jessie for some time.

With deb.devuan.org:

root@ahu:~# cat /etc/apt/sources.list
deb http://deb.devuan.org/merged/ jessie main
deb http://deb.devuan.org/merged/ jessie-security main
deb http://deb.devuan.org/merged/ jessie-updates main

root@ahu:~# apt update
Hit http://deb.devuan.org jessie InRelease
Hit http://deb.devuan.org jessie-security InRelease
Hit http://deb.devuan.org jessie-updates InRelease
Hit http://deb.devuan.org jessie/main i386 Packages
Hit http://deb.devuan.org jessie-security/main i386 Packages
Hit http://deb.devuan.org jessie-updates/main i386 Packages
Ign http://deb.devuan.org jessie/main Translation-en_US
Ign http://deb.devuan.org jessie/main Translation-en
Ign http://deb.devuan.org jessie-security/main Translation-en_US
Ign http://deb.devuan.org jessie-security/main Translation-en
Ign http://deb.devuan.org jessie-updates/main Translation-en_US
Ign http://deb.devuan.org jessie-updates/main Translation-en
Reading package lists... Done
Building dependency tree       
Reading state information... Done
All packages are up to date.

With auto.mirror.devuan.org:

root@ahu:~# cat /etc/apt/sources.list
deb http://auto.mirror.devuan.org/merged/ jessie main
deb http://auto.mirror.devuan.org/merged/ jessie-security main
deb http://auto.mirror.devuan.org/merged/ jessie-updates main

root@ahu:~# apt update
Get:1 http://auto.mirror.devuan.org jessie InRelease [21.8 kB]     
Get:2 http://auto.mirror.devuan.org jessie-security InRelease [21.2 kB]
Get:3 http://auto.mirror.devuan.org jessie-updates InRelease [21.8 kB]     
Get:4 http://auto.mirror.devuan.org jessie/main i386 Packages [6,877 kB]   
Get:5 http://auto.mirror.devuan.org jessie-security/main i386 Packages [628 kB]
Get:6 http://auto.mirror.devuan.org jessie-updates/main i386 Packages [732 B]
Ign http://auto.mirror.devuan.org jessie/main Translation-en_US     
Ign http://auto.mirror.devuan.org jessie/main Translation-en        
Ign http://auto.mirror.devuan.org jessie-security/main Translation-en_US
Ign http://auto.mirror.devuan.org jessie-security/main Translation-en
Ign http://auto.mirror.devuan.org jessie-updates/main Translation-en_US
Ign http://auto.mirror.devuan.org jessie-updates/main Translation-en
Fetched 7,570 kB in 3s (2,086 kB/s)           
Reading package lists... Done
Building dependency tree       
Reading state information... Done
62 packages can be upgraded. Run 'apt list --upgradable' to see them.

So, where is the bug? In the documentation or in the repo?

Last edited by haary (2019-05-06 08:14:25)

fsmithred · 2019-05-06 19:27:58

The problem was in the repo. It has been fixed and should work for you now.

haary · 2019-05-07 07:50:08

The problem was in the repo. It has been fixed and should work for you now.

No, it doesn't:

root@ahu:~# apt update
Hit http://deb.devuan.org jessie InRelease
Hit http://deb.devuan.org jessie-updates InRelease
Hit http://deb.devuan.org jessie-security InRelease
Hit http://deb.devuan.org jessie/main i386 Packages
Hit http://deb.devuan.org jessie-updates/main i386 Packages
Hit http://deb.devuan.org jessie-security/main i386 Packages
Ign http://deb.devuan.org jessie/main Translation-en_US
Ign http://deb.devuan.org jessie/main Translation-en
Ign http://deb.devuan.org jessie-updates/main Translation-en_US
Ign http://deb.devuan.org jessie-updates/main Translation-en
Ign http://deb.devuan.org jessie-security/main Translation-en_US
Ign http://deb.devuan.org jessie-security/main Translation-en
Reading package lists... Done               
Building dependency tree       
Reading state information... Done
All packages are up to date.

root@ahu:~#  apt update
Get:1 http://auto.mirror.devuan.org jessie InRelease [21.8 kB]     
Hit http://auto.mirror.devuan.org jessie-updates InRelease 
Hit http://auto.mirror.devuan.org jessie-security InRelease              
Get:2 http://auto.mirror.devuan.org jessie/main i386 Packages [6,877 kB] 
Get:3 http://auto.mirror.devuan.org jessie-updates/main i386 Packages [732 B]
Get:4 http://auto.mirror.devuan.org jessie-security/main i386 Packages [628 kB]
Ign http://auto.mirror.devuan.org jessie/main Translation-en_US     
Ign http://auto.mirror.devuan.org jessie/main Translation-en        
Ign http://auto.mirror.devuan.org jessie-updates/main Translation-en_US
Ign http://auto.mirror.devuan.org jessie-updates/main Translation-en
Ign http://auto.mirror.devuan.org jessie-security/main Translation-en_US
Ign http://auto.mirror.devuan.org jessie-security/main Translation-en
Fetched 6,899 kB in 2s (2,336 kB/s)           
Reading package lists... Done
Building dependency tree       
Reading state information... Done
42 packages can be upgraded. Run 'apt list --upgradable' to see them.

ralph.ronnquist · 2019-05-07 08:36:27

Yes, you should use deb.devuan.org, and the URLs should also end with /merged. Please check and try again.

Geoff 42 · 2019-05-07 09:51:53

I have tried moving my ASCII machine from using https://pkgmaster.devuan.org/merged to https://deb.devuan.org/merged, but it fails to complete apt update with the following messages :-

Reading package lists... Done
W: The repository 'https://deb.devuan.org/merged ascii Release' does not have a Release file.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: The repository 'https://deb.devuan.org/merged ascii-backports Release' does not have a Release file.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: The repository 'https://deb.devuan.org/merged ascii-security Release' does not have a Release file.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: The repository 'https://deb.devuan.org/merged ascii-updates Release' does not have a Release file.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: The repository 'https://deb.devuan.org/merged ascii-proposed-updates Release' does not have a Release file.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: Failed to fetch https://deb.devuan.org/merged/dists/ascii/main/binary-amd64/Packages  SSL: certificate subject name (devuan.mine.nu) does not match target host name 'deb.devuan.org'
E: Failed to fetch https://deb.devuan.org/merged/dists/ascii-backports/main/binary-i386/Packages  SSL: certificate subject name (devuan.mine.nu) does not match target host name 'deb.devuan.org'
E: Failed to fetch https://deb.devuan.org/merged/dists/ascii-security/main/binary-amd64/Packages  SSL: certificate subject name (devuan.mine.nu) does not match target host name 'deb.devuan.org'
E: Failed to fetch https://deb.devuan.org/merged/dists/ascii-updates/main/binary-i386/Packages  SSL: certificate subject name (devuan.mine.nu) does not match target host name 'deb.devuan.org'
E: Failed to fetch https://deb.devuan.org/merged/dists/ascii-proposed-updates/non-free/binary-i386/Packages  SSL: certificate subject name (devuan.mine.nu) does not match target host name 'deb.devuan.org'
E: Some index files failed to download. They have been ignored, or old ones used instead.

When I run an update with https://pkgmaster.devuan.org/merged it runs to completion and I can the do the upgrade ok.

I do notice that I have https rather than http. Should this be causing problems?

Geoff

Last edited by Geoff 42 (2019-05-07 09:53:47)

rolfie · 2019-05-07 10:04:08

I am on http://deb.devuan.org/merged/ and that works fine. I remember trying/failing https.

Rolf

Geoff 42 · 2019-05-07 10:13:41

Thank you for your quick response.

I have now retried with http://deb.devuan.org/merged, having converted https to http and the update now runs smoothly.

I do remember some discussion about using https, either here or on the mailing list ,some time ago, but a very quick search failed to find it.

Geoff

Last edited by Geoff 42 (2019-05-07 10:15:35)

Geoff 42 · 2019-05-07 10:23:39

I have found a message on the mailing list relating to https although it is a bit old :-

https://lists.dyne.org/lurker/message/2 … 68.en.html

Geoff

Last edited by Geoff 42 (2019-05-07 10:23:58)

rolfie · 2019-05-07 11:23:54

Just gave it a try and installed apt-transport-https on my Beowulf system. apt update fails after changing to https://deb.devuan.org/merged/ with the same errors as in #5. It works with https://pkgmaster.devuan.org/merged.

Rolf

ralph.ronnquist · 2019-05-07 11:41:57

Please note that packages.devuan.org (and auto.mirror.devuan.org is an alias for that domain name) is the historic repository for Devuan. It still provides it's old repository service, but it should be understood as disconnected from the current packaging workflow, which instead results in populating pkgmaster.devuan.org, and then that is mirrored to the hosts that are identified as deb.devuan.org.

The notion of "using Devuan" is now equivalent with having deb.devuan.org/merged as repository.

In extreme circumstances, one might use pkgmaster.devuan.org; for example during the short periods where mirrors show inconsistency during their sync times. However, it typically works equally well and better to just wait a bit and then repeat the failing update or installation command, having allowed time for the mirror(s) to synchronize. If the problem persists, say a couple of hours, then it is likely to be a source inconsistency at pkgmaster.devuan.org. Please report that, even though the automated work flow may well correct the situation eventually; sometimes a manual touch speeds it up.

Changing to a different repository, such as one of those at the top, is like changing distribution. Don't do that.

fsmithred · 2019-05-07 12:10:29

I'm re-posting something I posted to dng this morning.

I can confirm that auto.mirror.devuan.org (packages.devuan.org) updates ahead of deb.devuan.org (pkgmaster.devuan.org) and that this has been going on for some time, maybe a few months. (Maybe since auto.mirror got upgraded to amprolla3, but not sure about that.)

Sometimes it's days before pkgmaster catches up, and I'm not sure if it ever catches up without help from one of the sysadmins.

Here's a current example - the latest firefox-esr is in jessie-security, but only in auto.mirror.

# apt-cache policy firefox-esr
firefox-esr:
  Installed: 60.6.1esr-1~deb8u1
  Candidate: 60.6.2esr-1~deb8u1
  Version table:
     60.6.2esr-1~deb8u1 0
        500 http://auto.mirror.devuan.org/merged/ jessie-security/main amd64 Packages
 *** 60.6.1esr-1~deb8u1 0
        100 /var/lib/dpkg/status
     52.8.1esr-1~deb8u1 0
        500 http://deb.devuan.org/merged/ jessie/main amd64 Packages
        500 http://auto.mirror.devuan.org/merged/ jessie/main amd64 Packages

FWIW, I also tried this using "pkgmaster" and "packages" instead of "deb" and "auto.mirror" in sources.list and got the same result.

fsmithred

Geoff 42 · 2019-05-07 14:33:10

Do you have any comments on the use of http as opposed to the use of https?

I think I started to use https following mailing list discussion, as it seemed to have been put forward as a good idea!

Geoff

rolfie · 2019-05-07 14:36:27

Geoff 42 wrote:

Do you have any comments on the use of http as opposed to the use of https?
I think I started to use https following mailing list discussion, as it seemed to have been put forward as a good idea!
Geoff

@admins: I would like to support this request.

Thanks you, Rolf

golinux · 2019-05-07 15:19:59

IIUC, not all the mirrors in deb.devuan.org support https so it requires http to function properly. If you want to use https, the advice I remember was to look at the mirror list and choose a specific mirror that provides it.

Geoff 42 · 2019-05-07 15:40:30

Thank you, that is very helpful. At a quick glance, it looks like the Germans use https.

I do wonder, though, whether https is a good security thing or an unnecessary overhead.

Geoff

Last edited by Geoff 42 (2019-05-07 15:41:00)

fsmithred · 2019-05-07 15:48:29

Security is provided by gpg signatures. Use https if you don't want your ISP to know what packages you're installing.

haary · 2019-05-07 21:57:37

ralph.ronnquist wrote:

Yes, you should use deb.devuan.org, and the URLs should also end with /merged. Please check and try again.

Here we go again:

ahu:~# cat /etc/apt/sources.list        
deb http://deb.devuan.org/merged jessie main
deb http://deb.devuan.org/merged jessie-updates main
deb http://deb.devuan.org/merged jessie-security main

root@ahu:~# apt update                       
Hit http://deb.devuan.org jessie InRelease
Hit http://deb.devuan.org jessie-updates InRelease
Hit http://deb.devuan.org jessie-security InRelease
Hit http://deb.devuan.org jessie/main i386 Packages
Hit http://deb.devuan.org jessie-updates/main i386 Packages
Hit http://deb.devuan.org jessie-security/main i386 Packages
Ign http://deb.devuan.org jessie/main Translation-en_US
Ign http://deb.devuan.org jessie/main Translation-en
Ign http://deb.devuan.org jessie-updates/main Translation-en_US
Ign http://deb.devuan.org jessie-updates/main Translation-en
Ign http://deb.devuan.org jessie-security/main Translation-en_US
Ign http://deb.devuan.org jessie-security/main Translation-en
Reading package lists... Done
Building dependency tree
Reading state information... Done
All packages are up to date.

See? sources.list is correct, but still no updates. Please note that I am using Jessie. Ascii is working fine with deb.devuan.org.

Last edited by haary (2019-05-07 22:00:56)

MiyoLinux · 2019-05-07 22:17:10

I'm not sure how this correlates with and affects Devuan, but Debian made some changes to their Jessie repositories...

https://superuser.com/questions/1417617 … -in-debian

golinux · 2019-05-07 22:21:32

haary wrote:

All packages are up to date.

That is working. There are no updates because everything is already up to date,

See? sources.list is correct, but still no updates. Please note that I am using Jessie. Ascii is working fine with deb.devuan.org.

Jessie is old stable. It will probably only get security patches. I just ran update and there are no packages for me to install either on jessie i386.

ralph.ronnquist · 2019-05-07 22:24:22

Let me derail a moment with this note (that might be obvious to many): that I'm learning new about the repo's and that my "world model" above is a bit too simplistic for reality. Probably a good thing, though that model kind of works for me for the moment.

Then, about HTTPS.

The current mirroring technique uses DNS to make deb.devuan.org resolve to some mirror's IP for each "request". Then the problem with using HTTPS is that it requires the sharing of credentials, where recipient organisations need to take on the responsibility of taking due care of them. This is part of the 'trust aspect' of using HTTPS more than the transport encryption aspect, and to have a commercial organisation (which is applicable for many mirrors) take on a responsibility is asking for more than the mere mirroring functionality. Many mirrors do serve via HTTPS, but they do so with their own domain names rather than named as deb.devuan.org.

The alternative solutions would involve handling all requests, either proxying them or bouncing temporary redirects, by a layer of deb.devuan.org hosts physically distributed over the world. This would attract a significant ongoing effort and cost.

Thus, if HTTPS is my thing, then I need to set up my sources.list to use the accredited name(s) of my chosen server(s) directly.

haary · 2019-05-08 06:13:27

golinux wrote:

haary wrote:
All packages are up to date.
That is working. There are no updates because everything is already up to date,
See? sources.list is correct, but still no updates. Please note that I am using Jessie. Ascii is working fine with deb.devuan.org.
Jessie is old stable. It will probably only get security patches. I just ran update and there are no packages for me to install either on jessie i386.

Please read the title and the first post. With auto.mirror.devuan.org updates are there, the last line says

62 packages can be upgraded. Run 'apt list --upgradable' to see

with deb.devuan.org they aren't. It should be easy to reproduce.

Last edited by haary (2019-05-08 06:16:48)

Geoff 42 · 2019-05-08 09:05:11

Thank you for the expert advice on the use of https. I think that I will stick to http and I would like to apologise for high-jacking the thread on Jessie.

Geoff

Last edited by Geoff 42 (2019-05-08 09:05:28)

nixer · 2019-05-09 02:16:55

Just to include a quick check to duplicate what haary, the original poster, is reporting. I have a jessie server operational using the deb.devuan.org address in my sources.list which has not received any updates in a while and it too reports that

root@Am-VPN:/etc/apt# apt-get update
...
All packages are up to date.

However, when I change the url in the sources.list file to "auto.mirror.devuan.org", it shows updates available:

The following packages will be upgraded:
libjs-jquery libsystemd0 libudev1 udev wget

So, the old "auto.mirror.devuan.org" address is showing updates available, while the newer "deb.devuan.org" is showing no updates available. "https" in the url is not even involved here.

As an example using the program wget, which is shown as one of the programs that could be upgraded - with deb.devuan.org no upgrade is showing:

root@Am-VPN:/etc/apt# apt-cache policy wget
wget:
  Installed: 1.16-1+deb8u5
  Candidate: 1.16-1+deb8u5
  Version table:
 *** 1.16-1+deb8u5 0
        500 http://deb.devuan.org/merged/ jessie/main amd64 Packages
        100 /var/lib/dpkg/status

However, using "auto.mirror.devuan.org", it does pick up the upgradeable program:

root@Am-VPN:/etc/apt# apt-cache policy wget
wget:
  Installed: 1.16-1+deb8u5
  Candidate: 1.16-1+deb8u6
  Version table:
     1.16-1+deb8u6 0
        500 http://auto.mirror.devuan.org/merged/ jessie-security/main amd64 Packages
 *** 1.16-1+deb8u5 0
        500 http://auto.mirror.devuan.org/merged/ jessie/main amd64 Packages
        100 /var/lib/dpkg/status

It appears that deb.devuan.org is not picking up the jessie-security updates section of the repo. This is my sources.list. I alternated between the two url addresses, of course.

deb http://deb.devuan.org/merged/ jessie main contrib non-free
#deb http://auto.mirror.devuan.org/merged/ jessie main contrib non-free

deb http://deb.devuan.org/merged/ jessie-security main contrib non-free
#deb http://auto.mirror.devuan.org/merged/ jessie-security main contrib non-free

deb http://deb.devuan.org/merged/ jessie-updates main contrib non-free
#deb http://auto.mirror.devuan.org/merged/ jessie-updates main contrib non-free

MiyoLinux · 2019-05-09 02:29:58

I may be wrong, but I don't remember being advised to change jessie repositories over to deb.devuan.org. I thought they were supposed to stay as auto.mirror.devuan.org. Seems like deb.devuan.org was introduced with ASCII.

I just looked at the Devuan website, and it's still showing jessie as using auto.mirror.devuan.org.

golinux · 2019-05-09 03:24:37

MiyoLinux wrote:

I may be wrong, but I don't remember being advised to change jessie repositories over to deb.devuan.org. I thought they were supposed to stay as auto.mirror.devuan.org. Seems like deb.devuan.org was introduced with ASCII.
I just looked at the Devuan website, and it's still showing jessie as using auto.mirror.devuan.org.

auto.mirror.devuan.org is still the default repository because there has never been a point release for jessie and that is the repository used on the isos.

This note is also on the website (in several places):

IMPORTANT NOTE: auto.mirror is now deprecated and will be decommissioned. Please make sure you have the latest devuan-keyring package with apt-get install devuan-keyring and then point your /etc/apt/sources.list to deb.devuan.org.

The officially official Devuan Forum!

#1 2019-05-06 08:13:57

deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#2 2019-05-06 19:27:58

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#3 2019-05-07 07:50:08

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#4 2019-05-07 08:36:27

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#5 2019-05-07 09:51:53

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#6 2019-05-07 10:04:08

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#7 2019-05-07 10:13:41

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#8 2019-05-07 10:23:39

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#9 2019-05-07 11:23:54

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#10 2019-05-07 11:41:57

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#11 2019-05-07 12:10:29

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#12 2019-05-07 14:33:10

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#13 2019-05-07 14:36:27

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#14 2019-05-07 15:19:59

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#15 2019-05-07 15:40:30

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#16 2019-05-07 15:48:29

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#17 2019-05-07 21:57:37

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#18 2019-05-07 22:17:10

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#19 2019-05-07 22:21:32

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#20 2019-05-07 22:24:22

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#21 2019-05-08 06:13:27

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#22 2019-05-08 09:05:11

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#23 2019-05-09 02:16:55

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#24 2019-05-09 02:29:58

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

#25 2019-05-09 03:24:37

Re: deb.devuan.org doesn't get updates for Jessie, auto.mirror.devuan does

Board footer