Rob wrote:

> Looking at http://packages.devuan.org/merged/pool/
> there is nothing there, though
> http://packages.devuan.org/devuan/ is populated.

/merged/pool are unmodified Debian packages,
/devuan are Devuan's.‎

There is insufficient signing (look up the thread
I started last week) in Ceres because Debian dropped
SHA1.

Mitt