live-build-4.0.3-1+devuan2 installs debian-archive-keyring instead of devuan-keyring, and it pulls packages from debian repos instead of from devuan.

The keyring is named in config/chroot, and the mirrors are listed in config/bootstrap.

I use the following lines to fix this when I make a new live directory, after I populate it with the first 'lb config'. All the urls are replaced with auto.mirror.devuan.org/merged/, which works, but possibly does not get jessie-security.

sed -i 's/debian-archive-keyring/devuan-keyring/' ${PREFIX}/config/chroot sed -i 's_http://http.debian.net/debian/_http://auto.mirror.devuan.org/merged/_g' ${PREFIX}/config/bootstrap sed -i 's_http://ftp.debian.org/debian/_http://auto.mirror.devuan.org/merged/_g' ${PREFIX}/config/bootstrap sed -i 's_http://security.debian.org/_http://auto.mirror.devuan.org/merged/_g' ${PREFIX}/config/bootstrap

When I tried replacing security.debian.org with https://packages.devuan.org/merged/dists/jessie-security/ , it redirects to amprolla.devuan.org, but it does not connect.