Le mer. 9 avr. 2025 Ã 17:26, Simon Josefsson <
simon@josefsson.org> a écrit :
Jérémy Lal <kapouer@melix.org> writes:
I had a look at another approach, just upgrading the dependency to
golang-github-smallstep-crypto-dev
for these two packages:
- golang-step-cli-utils: all fine, level1
- golang-github-smallstep-certificates: level 2, needs the previous one
rebuilt first, and the attached patch.
There are probably mistakes in that patch.
Now that that patch passes the test suite by borrowing from upstream
fixes,
and that "caddy" also builds fine with them, I'm going to do as
advertised.
I just uploaded caddy.
Thank you! Some observations - tl;dr: I suggest to remove
golang-step-crypto-dev from the archive as discussed in 1) below, and
for us to ignore issue 2) + 3) below, even though they warrant more consideration.
1) Now there are no reverse dependencies on golang-step-crypto-dev any
more, so I think we could ask for removal of that package from the
archive which would resolve https://bugs.debian.org/1100967
jas@kaka:~/dpkg/golang-github-smallstep-crypto$ ssh mirror.ftp-master.debian.org "dak rm -Rn -b golang-step-crypto-dev"
Will remove the following packages from unstable:
golang-step-crypto-dev | 0.24.0-2 | all
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org> ------------------- Reason ------------------- ----------------------------------------------
Checking reverse dependencies...
No dependency problem found.
jas@kaka:~/dpkg/golang-github-smallstep-crypto$
To be careful, the golang-step-crypto-dev should be removed after all its previous rdeps have migrated to testing.
2) However I realized I was wrong in my comment in https://bugs.debian.org/1100967#10 about which package name is the
"proper" one. Upstream's go.mod namespace is still go.step.sm/crypto
even in latest upstream master:
https://github.com/smallstep/crypto/blob/master/go.mod
So then the "correct" package name in Debian really ought to be "golang-step-crypto" after all.... sigh. Should we upload
golang-step-crypto v0.60.0 and migrate all dependencies back to the
proper name, and then remove golang-github-smallstep-crypto?
Naming policy:
https://go-team.pages.debian.net/packaging.html#_naming_conventions_2
What was missing there for me was the definition of the term "import
path", which I now take to mean the 'module FOO' line in go.mod. I
probably confused it with the source code hosting site before.
3) Upstream namespace go.step.sm/* has been renamed to
github.com/smallstep/* for many (most?) other smallstep packages, and I
had expected this to happen to go.step.sm/crypto as well. I found this
bug report that discuss it:
https://github.com/smallstep/crypto/issues/579
So it may be that shortly the right name is actually the one we have
already prematurely migrated to. Given that there are no reverse dependencies on golang-step-crypto-dev now, I think the simplest way out
of this mess is to ask for that package to be dropped.
Once golang-step-crypto-dev has been removed, whatever the right name
will be can be provided by golang-github-smallstep-crypto ?
If there is no urgency to do that before Trixie, let's not change things
right now ?
Jérémy
<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">Le mer. 9 avr. 2025 à  17:26, Simon Josefsson <<a href="mailto:
simon@josefsson.org">
simon@josefsson.org</a>> a écrit :<
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Jérémy Lal <<a href="mailto:kapouer@melix.org" target="_blank">kapouer@melix.org</a>> writes:<br>
>> I had a look at another approach, just upgrading the dependency to<br> >> golang-github-smallstep-crypto-dev<br>
>> for these two packages:<br>
>> - golang-step-cli-utils: all fine, level1<br>
>> - golang-github-smallstep-certificates: level 2, needs the previous one<br>
>> rebuilt first, and the attached patch.<br>
>> There are probably mistakes in that patch.<br>
>><br>
><br>
> Now that that patch passes the test suite by borrowing from upstream fixes,<br>
> and that "caddy" also builds fine with them, I'm going to do as advertised.<br>
<br></blockquote><div><br></div><div>I just uploaded caddy.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Thank you! Some observations - tl;dr: I suggest to remove<br> golang-step-crypto-dev from the archive as discussed in 1) below, and<br>
for us to ignore issue 2) + 3) below, even though they warrant more<br> consideration.<br>
1) Now there are no reverse dependencies on golang-step-crypto-dev any<br> more, so I think we could ask for removal of that package from the<br>
archive which would resolve <a href="
https://bugs.debian.org/1100967" rel="noreferrer" target="_blank">
https://bugs.debian.org/1100967</a><br>
jas@kaka:~/dpkg/golang-github-smallstep-crypto$ ssh <a href="
http://mirror.ftp-master.debian.org" rel="noreferrer" target="_blank">mirror.ftp-master.debian.org</a> "dak rm -Rn -b golang-step-crypto-dev"<br>
Will remove the following packages from unstable:<br>
golang-step-crypto-dev |Â Â 0.24.0-2 | all<br>
Maintainer: Debian Go Packaging Team <<a href="mailto:team%
2Bpkg-go@tracker.debian.org" target="_blank">
team+pkg-go@tracker.debian.org</a>><br>
------------------- Reason -------------------<br> ----------------------------------------------<br>
Checking reverse dependencies...<br>
No dependency problem found.<br> jas@kaka:~/dpkg/golang-github-smallstep-crypto$</blockquote><div><br></div><div>To be careful, the golang-step-crypto-dev should be removed after all its previous rdeps have migrated to testing.</div><div><br></div><div> </div><blockquote class="gmail_
quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
2) However I realized I was wrong in my comment in<br>
<a href="
https://bugs.debian.org/1100967#10" rel="noreferrer" target="_blank">
https://bugs.debian.org/1100967#10</a> about which package name is the<br>
"proper" one. Upstream's go.mod namespace is still <a href="
http://go.step.sm/crypto" rel="noreferrer" target="_blank">go.step.sm/crypto</a><br>
even in latest upstream master:<br>
<a href="
https://github.com/smallstep/crypto/blob/master/go.mod" rel="noreferrer" target="_blank">
https://github.com/smallstep/crypto/blob/master/go.mod</a><br>
So then the "correct" package name in Debian really ought to be<br> "golang-step-crypto" after all.... sigh. Should we upload<br> golang-step-crypto v0.60.0 and migrate all dependencies back to the<br>
proper name, and then remove golang-github-smallstep-crypto?<br>
Naming policy:<br>
<a href="
https://go-team.pages.debian.net/packaging.html#_naming_conventions_2" rel="noreferrer" target="_blank">
https://go-team.pages.debian.net/packaging.html#_naming_conventions_2</a><br>
What was missing there for me was the definition of the term "import<br> path", which I now take to mean the 'module FOO' line in go.mod. I<br>
probably confused it with the source code hosting site before.<br>
3) Upstream namespace <a href="
http://go.step.sm/*" rel="noreferrer" target="_blank">go.step.sm/*</a> has been renamed to<br>
<a href="
http://github.com/smallstep/*" rel="noreferrer" target="_blank">github.com/smallstep/*</a> for many (most?) other smallstep packages, and I<br>
had expected this to happen to <a href="
http://go.step.sm/crypto" rel="noreferrer" target="_blank">go.step.sm/crypto</a> as well. I found this<br>
bug report that discuss it:<br>
<a href="
https://github.com/smallstep/crypto/issues/579" rel="noreferrer" target="_blank">
https://github.com/smallstep/crypto/issues/579</a><br>
So it may be that shortly the right name is actually the one we have<br> already prematurely migrated to. Given that there are no reverse<br> dependencies on golang-step-crypto-dev now, I think the simplest way out<br>
of this mess is to ask for that package to be dropped.</blockquote><div><br></div><div>Once golang-step-crypto-dev has been removed, whatever the right name</div><div>will be can be provided by golang-github-smallstep-crypto ?</div><div>If there is no
urgency to do that before Trixie, let's not change things right now ?</div><div><br></div><div>Jérémy</div></div></div>
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)