Forwarded for contributors who joined in Go Team Sprint but not on the Debian Go Team mailing list.
---------- Forwarded message --------- From: Andrew Lee <[email protected]> Date: Wed, Aug 5, 2026 at 7:22 PM Subject: Go Team Sprint Summary, DebConf26 Follow-up and Module-Aware Build Transition Plan To: Debian-Go Mailing List <[email protected]> Dear Go Team, Here is a summary of where we are now with our transition to Modern, Module-Aware Builds, what we achieved during DebCamp and DebConf26, and what is still needed as we prepare for the Forky release. Background ========= During mini DebConf Hamburg 2026, we identified critical runtime and security issues in Debian's Go ecosystem caused by building packages in legacy GOPATH mode (GO111MODULE=off). This setup ignores go.mod files and injected outdated DefaultGODEBUG flags into compiled binaries. Toddy uploaded dh-golang 1.66 to experimental for our Sprint. This 1.66 release sets `GO111MODULE=on` by default and maps dependencies to /usr/share/gocode/src locally, satisfying Debian's strict offline build requirement while enabling Modern Module-Aware Builds. Sprint Progress & DebConf26 Outcomes =============================== During the sprint, we validated the transition from legacy GOPATH builds (GO111MODULE=off) to Go Workspaces (go.work) using dh-golang 1.66 from experimental with default `GO111MODULE=on` fixes silent runtime issue (such as HTTP routing failure) and eliminates legacy crypto/TLS defaults across compiled binaries. Since dh-golang 1.66 maps module paths, we can finully use Go compiler to handle dependency resolution. This drops the need for manual workarounds and reduces Debian-specific legacy GOPATH patches. With Module-Aware Builds, most upstream tests now pass out of the box without patching. We also hosted two Go related talks and a team BoF: * Chicken, Egg, or Go Mod: Demonstrating how to resolve circular build dependencies using local workspace builds and binary-only uploads. https://debconf26.debconf.org/talks/88-chicken-egg-or-gomod-solving-go-circular-build-dependencies-in-debian/ * Rescue Forky: Presenting technical evidence behind the 2011 time-travel bugs caused by legacy GOPATH with DefaultGODEBUG defaults and outlining our roadmap to Modern Module-Aware Builds for Forky. https://debconf26.debconf.org/talks/87-rescue-forky-we-have-go-time-travel-to-2011-building-go-like-its-2011-is-broken/ * Finally, our Go Team BoF: https://debconf26.debconf.org/talks/137-go-team-bof/ Key Takeaways from the BoF ====================== Team Policy for Module-Aware Builds: Andrew will draft an updated Go Team packaging document for the Modern Module-Aware Build. Will post later on wiki for collaborative work. Real-World Proof of Concept: Mathias shared that a large, complex package `incus` already builds completely using dh-golang 1.66, proving that Go Workspaces builds well for large-scale packaging. Unstable Timeline: Mathias plan to upload the updated dh-golang to unstable in about one month. (Maybe before mini DebConf Winterthur, Switzerland, so people may hack on it during it's DebCamp. Anyone will attend mini DebConf Winterthur?) Please Help Test dh-golang 1.66 in Experimental ====================================== To make this transition as smooth as possible for the entire archive, we really need more eyes and hands on this. Please try porting your applications using dh-golang 1.66 from experimental now. Catching edge cases early will help us refine the tooling or fix corrsponding -dev packages in unstable before switches over as default. Tooling Wishlist (Help Wanted!) ======================== We still have a few features missing in our core tooling helpers: * dh-make-golang: https://wiki.debian.org/DebConf/26/Sprints/DebianGoTeam#dh-make-golang - Needs native Module-Aware support to generate correction for debian/control file - Correct package name, vcs-tags - Handles XS-Go-Import-Path version suffixes (e.g., /v2) - Generate correct build-dependencies and dependencies * Lintian: https://wiki.debian.org/DebConf/26/Sprints/DebianGoTeam#Lintian - Mostly done by Nilesh. Should file bug report for any additional. Upstream Module Relocations & Re-Naming Guideline ========================================= In module-aware builds, we must ensure every Debian package name and its XS-Go-Import-Path strictly match upstream's canonical module path. Because Go treats any change in import path, such as domain relocations or major version bumps like /v2, matching package names ensures dh-golang offline builds mapping resolve correctly and allows coexisting major versions without breaking reverse dependencies. Based on recent mailing list discussions regarding package renames from Simon: I draft it on wiki: https://wiki.debian.org/Teams/DebianGoTeam/MigrationFAQ#Upstream_Module_Relocations_.26_Re-Naming_Guideline Please feel free to update it on wiki if anything is missing from me. Thanks to everyone who contributed during DebCamp and DebConf! Let's work together to get our Go ecosystem ready for Forky. Cheers, -- -Andrew -- -Andrew
