Hi Mathias, On Fri, 10 Oct 2025 23:29:40 +0000 Mathias Gibbens <[email protected]> wrote:
notary's upstream is archived as of July 31, 2025 and no longer maintained[0]. Apparently the successor project is "Notation". I'm filing this bug because notary is going to require a Debian- specific patch to build with the updated golang-github-spf13-viper. It looks like it's been over three years since the last non-team upload. There are still several reverse build dependencies, but I think we ought to seriously consider RMing notary.
I wanted to mention that most of the packages in the pkg-go team are maintained like this: nobody really "owns" the packages, and we put our own names only when first packaging it or when doing very substantial work, so almost all uploads are team uploads. Another important thing is that Notary is a build-dependency for some important packages, in particular docker.io and prometheus and many other go packages are currently marked for auto-removal because of this bug. So we cannot RM notary until those other packages are updates to remove the dependency. Would you agree to lower the severity of the bug and keep it as a to-do? -- Martina Ferrari
