The officially official Devuan Forum!

You are not logged in.

#1 2020-09-26 18:23:25

gu_1
Member
Registered: 2020-09-26
Posts: 3  

Strange mirror?

Hi. this is my first post here and english is not my mother language, so sorry for anything.

The problem is that I just installed Devuan ASCII this week selecting the brazillian mirror, everything was OK, apt install was working, but today apt install found a error that I fixed with apt update.
My fear is that something happened to somewhere between my computer and the mirror because that happened, and yesterday and before the apt install was downloading from some "ippact" server that started with "58.XX", but today is not.
Am I being paraniod or my computer can be infected because of this? (Like modified packages that cointain malware)

cat /etc/apt/sources.list
# deb cdrom:[Devuan GNU/Linux 2.1 (ascii) amd64 NETINSTALL - 2019-12-21 08:19:46 UTC]/ ascii main non-free

#deb cdrom:[Devuan GNU/Linux 2.1 (ascii) amd64 NETINSTALL - 2019-12-21 08:19:46 UTC]/ ascii main non-free

deb http://br.deb.devuan.org/merged ascii main
deb-src http://br.deb.devuan.org/merged ascii main

deb http://br.deb.devuan.org/merged ascii-security main
deb-src http://br.deb.devuan.org/merged ascii-security main

deb [arch=amd64] https://download.virtualbox.org/virtualbox/debian stretch contrib

Today apt install failure and apt update: https://drive.google.com/file/d/1aHxgLf … sp=sharing

Offline

#2 2020-09-26 18:41:39

golinux
Administrator
Registered: 2016-11-25
Posts: 3,132  

Re: Strange mirror?

Country codes are not available in Devuan.  This from the website:

Devuan has a network of package repository mirrors in place. The mirror network is accessible using the FQDN “deb.devuan.org” via http NOT https. Country Codes (CC) are currently unavailable but a specific mirror from the list can be accessed using the corresponding BaseURL.

Offline

#3 2020-09-26 18:54:04

Head_on_a_Stick
Member
From: London
Registered: 2019-03-24
Posts: 3,125  
Website

Re: Strange mirror?

golinux wrote:

Country codes are not available in Devuan.

Looks like the OP's mirror should still work:

~$ nslookup br.deb.devuan.org
Server:         9.9.9.9
Address:        9.9.9.9#53

Non-authoritative answer:
br.deb.devuan.org       canonical name = pkgmaster.devuan.org.
Name:   pkgmaster.devuan.org
Address: 54.36.142.183
Name:   pkgmaster.devuan.org
Address: 2001:41d0:2:1f68::3624:8eb7

~$

I think it's using the DNS Round-Robin for deb.devuan.org but that's just an uneducated guess big_smile


Brianna Ghey — Rest In Power

Offline

#4 2020-09-26 19:20:02

gu_1
Member
Registered: 2020-09-26
Posts: 3  

Re: Strange mirror?

I did not change the mirror,  I just selected the br mirror.
My question is: is there any security risk?

Offline

#5 2020-09-26 19:38:02

golinux
Administrator
Registered: 2016-11-25
Posts: 3,132  

Re: Strange mirror?

. . . a specific mirror from the list can be accessed using the corresponding BaseURL

This from the mirror list:

FQDN:  devuan.c3sl.ufpr.br
BaseURL:  devuan.c3sl.ufpr.br
Bandwidth:  20Gb/s
Rate:  1h
Country:  Brazil
CountryCode:  BR
Protocols:  HTTP | RSYNC
Active:  Yes
DNSRR:  yes

I think this BaseURL needs to be in sources.list not the country code (which devuan is not set up to understand):  devuan.c3sl.ufpr.br

Offline

#6 2020-09-26 19:41:09

golinux
Administrator
Registered: 2016-11-25
Posts: 3,132  

Re: Strange mirror?

gu_1 wrote:

I did not change the mirror,  I just selected the br mirror.
My question is: is there any security risk?

No.  The mirrors are just rsync copies of pkgmaster.devuan.org

Offline

#7 2020-09-26 23:17:24

gu_1
Member
Registered: 2020-09-26
Posts: 3  

Re: Strange mirror?

golinux wrote:
gu_1 wrote:

I did not change the mirror,  I just selected the br mirror.
My question is: is there any security risk?

No.  The mirrors are just rsync copies of pkgmaster.devuan.org

OK, thanks

Offline

#8 2020-09-26 23:23:53

ralph.ronnquist
Administrator
From: Clifton Hill, Victoria, AUS
Registered: 2016-11-30
Posts: 1,100  

Re: Strange mirror?

@gu_1: as was indicated by @Head_on_a_Stick the domain name br.deb.devuan.org resolves to the domain name pkgmaster.devuan.org which is Devuan's own repository server and not to the round-robin domain name deb.devuan.org.

Thus, by using br.deb.devuan.org you don't take advantage of any mirroring, and always get packages served by pkgmaster.devuan.org.

Whilst that is fine for any individual case, it's something we generally want people to avoid doing, since it accumulates into a reduced service for everyone. Therefore the advice is that you should really use deb.devuan.org.

If you do want to use some particular server, or a subset of the round-robin servers, then the way to go is to edit your /etc/hosts to resolve deb.devuan.org to that server/subset. For example, you might add these lines to /etc/hosts:

# My preferred package sources
192.80.24.194           deb.devuan.org  devuan.dcc.uchile.cl
200.236.31.1            deb.devuan.org  devuan.c3sl.ufpr.br
2801:82:80ff:8000::2    deb.devuan.org  devuan.c3sl.ufpr.br

Those particular lines would make apt use only the two servers devuan.dcc.uchile.cl and devuan.c3sl.ufpr.br as package sources (for ipv6, only the latter). (see man hosts for details about /etc/hosts)

Note: you may refer to https://pkgmaster.devuan.org/mirror_list.txt to find out which servers are in the round-robin, and you may use the host or dig commands to determine their IP addresses.

Devuan has a system in place to monitor round-robin servers with respect to their Devuan package service. You find graphs detailing status e.g. at http://veritas.devuan.org/apt-panoptico … pticon_cgp.

Offline

#9 2020-09-27 11:12:55

xinomilo
Unknown
Registered: 2017-07-02
Posts: 315  

Re: Strange mirror?

an alternative way to pick some mirrors,  would be to create a local mirrors.txt file with desired mirrors, eg /home/user/mirrors.txt :

then add a (eg) dev1mirrors.list in /etc/apt/sources.list.d with the following :

deb mirror+file:/home/user/mirrors.txt beowulf main
deb mirror+file:/home/user/mirrors.txt beowulf-updates main
deb mirror+file:/home/user/mirrors.txt beowulf-security main

and `apt update`. if it's working you can comment out/remove other devuan entries sources.list .

Last edited by xinomilo (2020-09-27 11:13:48)

Offline

Board footer