:: Re: [DNG] Devuan Jessie security ma…
Top Page
Delete this message
Reply to this message
Author: fsmithred
Date:  
To: dng
Subject: Re: [DNG] Devuan Jessie security maintenance status
On 5/6/19 4:18 AM, Henry Jensen via Dng wrote:
> On Fri, 3 May 2019 20:25:25 +0200
> Alessandro Selli <alessandroselli@???> wrote:
>
>> On 03/05/19 at 19:31, Henry Jensen via Dng wrote:
>
>>> So, you are using auto.mirror.devuan.org. I did use deb.devuan.org,
>>> according to https://devuan.org/os/etc/apt/sources.list
>>>
>>> "IMPORTANT NOTE: auto.mirror is now deprecated and will be
>>> decomissioned. Please make sure you have the latest devuan-keyring
>>> package with apt-get install devuan-keyring and then point
>>> your /etc/apt/sources.list to deb.devuan.org."
>>>
>>>
>>> Indeed, when I change the sources.list to auto.mirror.devuan.org, I got
>>> updates.
>>>
>>> So I guess, the documentation at
>>> https://devuan.org/os/etc/apt/sources.list is wrong?
>>>
>>
>>   As you can see from the above, you were missing the jessie-updates
>> repository.
>
>
>
> That doesn't make any diffenrence, since jessie-updates is for
> fast-changing packages and doesn't receive any updates any more.
>
>
> - With deb.devuan.org:
>
> root@ahu-db:~# cat /etc/apt/sources.list
> deb http://deb.devuan.org/merged/ jessie main
> deb http://deb.devuan.org/merged/ jessie-security main
> deb http://deb.devuan.org/merged/ jessie-updates main
>
>
> root@ahu-db:~# apt update
> Hit http://deb.devuan.org jessie InRelease
> Hit http://deb.devuan.org jessie-security InRelease
> Hit http://deb.devuan.org jessie-updates InRelease
> Hit http://deb.devuan.org jessie/main i386 Packages
> Hit http://deb.devuan.org jessie-security/main i386 Packages
> Hit http://deb.devuan.org jessie-updates/main i386 Packages
> Ign http://deb.devuan.org jessie/main Translation-en_US
> Ign http://deb.devuan.org jessie/main Translation-en
> Ign http://deb.devuan.org jessie-security/main Translation-en_US
> Ign http://deb.devuan.org jessie-security/main Translation-en
> Ign http://deb.devuan.org jessie-updates/main Translation-en_US
> Ign http://deb.devuan.org jessie-updates/main Translation-en
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> All packages are up to date.
>
>
> - With auto.mirror.devuan.org:
>
> root@ahu-db:~# cat /etc/apt/sources.list
> deb http://auto.mirror.devuan.org/merged/ jessie main
> deb http://auto.mirror.devuan.org/merged/ jessie-security main
> deb http://auto.mirror.devuan.org/merged/ jessie-updates main
>
> root@ahu-db:~# apt update
> Get:1 http://auto.mirror.devuan.org jessie InRelease [21.8 kB]
> Get:2 http://auto.mirror.devuan.org jessie-security InRelease [21.2 kB]
> Get:3 http://auto.mirror.devuan.org jessie-updates InRelease [21.8 kB]
> Get:4 http://auto.mirror.devuan.org jessie/main i386 Packages [6,877 kB]
> Get:5 http://auto.mirror.devuan.org jessie-security/main i386 Packages [628 kB]
> Get:6 http://auto.mirror.devuan.org jessie-updates/main i386 Packages [732 B]
> Ign http://auto.mirror.devuan.org jessie/main Translation-en_US
> Ign http://auto.mirror.devuan.org jessie/main Translation-en
> Ign http://auto.mirror.devuan.org jessie-security/main Translation-en_US
> Ign http://auto.mirror.devuan.org jessie-security/main Translation-en
> Ign http://auto.mirror.devuan.org jessie-updates/main Translation-en_US
> Ign http://auto.mirror.devuan.org jessie-updates/main Translation-en
> Fetched 7,570 kB in 3s (2,086 kB/s)
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> 62 packages can be upgraded. Run 'apt list --upgradable' to see them.
>
>



I can confirm that auto.mirror.devuan.org (packages.devuan.org) updates
ahead of deb.devuan.org (pkgmaster.devuan.org) and that this has been
going on for some time, maybe a few months.

Sometimes it's days before pkgmaster catches up, and I'm not sure if it
ever catches up without help from one of the sysadmins.

Here's a current example - the latest firefox-esr is in jessie-security,
but only in auto.mirror.

# apt-cache policy firefox-esr
firefox-esr:
   Installed: 60.6.1esr-1~deb8u1
   Candidate: 60.6.2esr-1~deb8u1
   Version table:
      60.6.2esr-1~deb8u1 0
         500 http://auto.mirror.devuan.org/merged/ jessie-security/main 
amd64 Packages
  *** 60.6.1esr-1~deb8u1 0
         100 /var/lib/dpkg/status
      52.8.1esr-1~deb8u1 0
         500 http://deb.devuan.org/merged/ jessie/main amd64 Packages
         500 http://auto.mirror.devuan.org/merged/ jessie/main amd64 Packages



FWIW, I also tried this using "pkgmaster" and "packages" instead of "deb"
and "auto.mirror" in sources.list and got the same result.

fsmithred