Hi, .. > Since golang-github-cenkalti-backoff is already at v5 in experimental, I > suggest we package v4 as src:golang-github-cenkalti-backoff-v4 which produces > golang-github-cenkalti-backoff-v4-dev. > > This -v4 package would then live in unstable side-by-side with the v5 code in > the existing binary packages. This will break existing packages, which will > need to be fixed by either porting them to v5, or updating debian/control to > build against golang-github-cenkalti-backoff-v4-dev.
Even though this is a bit painful, I still think it is the best thing to do. The package name that is "versionless" should be reserved for the latest version, and if older versions are needed to be kept around, they should have the version suffix. Reinhard mentioned that Rust packages do this, and I have also done this in e.g. Godot where src:godot is the latest version (4.x) and src:godot3 is kept around for anything that still depends on it and will be maintained until upstream stops publishing security releases, or until nothing in Debian uses it anymore. >From the Salsa CI reverse builds dep job you shared I can see these are failing. Seems indeed majority (but not all) are failing on dependency on cenkalti/backoff/v4. Many of the packages are already using v5 upstream and would be fixed by simply updating the package, but not all. This topic also ties into the general question that who is expected to update what and when. As time goes by, Debian gets more and more packages that sit at a specific version for years build-rdep-deck 1.4.0 from 2021 (latest 1.54) src/github.com/kong/deck/diff/diff.go:28:17: undefined: backoff.WithMaxRetries src/github.com/kong/deck/diff/diff.go:424:5: in call to backoff.Retry, type backoff.BackOff of defaultBackOff() does not match backoff.Operation[T] (cannot infer T) build-rdep-docker.io 27.5.1 (latest 29.1.2, upstream has v5 already in https://github.com/moby/moby/blob/master/go.mod#L149 since v29.1.0) src/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/retry/retry.go:17:2: cannot find package "github.com/cenkalti/backoff/v4" in any of: build-rdep-gh 2.46.0 from January 2025 (latest 2.83) src/github.com/cli/cli/v2/internal/codespaces/codespaces.go:11:2: cannot find package "github.com/cenkalti/backoff/v4" in any of: build-rdep-golang-github-lestrrat-go-backoff 2.0.8 from 2021 (upstream dead since) src/github.com/lestrrat-go/backoff/bench/backoff_test.go:30:16: undefined: cenkalti.WithMaxRetries build-rdep-golang-github-maxmind-geoipupdate 6.1.0 from March 2025 (latest 7.1.1, unrelease upstream already has v5 support) src/github.com/maxmind/geoipupdate/pkg/geoipupdate/database/http_reader.go:17:2: cannot find package "github.com/cenkalti/backoff/v4" in any of: build-rdep-golang-github-ovn-org-libovsdb 0.8.1 from Oct 2025 (upstream does *not* support v5 yet) src/github.com/ovn-org/libovsdb/client/client.go:18:2: cannot find package "github.com/cenkalti/backoff/v4" in any of: build-rdep-golang-github-r3labs-sse 2.10 from Feb 2025 (upstream dead) src/github.com/r3labs/sse/client.go:19:2: cannot find package "github.com/cenkalti/backoff/v4" in any of: build-rdep-golang-github-xenolf-lego 4.9.1 from 2023 (latest 4.29.0) src/github.com/go-acme/lego/acme/api/api.go:12:2: cannot find package "github.com/cenkalti/backoff/v4" in any of: build-rdep-golang-github-zorkian-go-datadog-api src/github.com/zorkian/go-datadog-api/request.go:196:5: bo.MaxElapsedTime undefined (type *backoff.ExponentialBackOff has no field or method MaxElapsedTime) src/github.com/zorkian/go-datadog-api/request.go:228:33: in call to backoff.Retry, type *backoff.ExponentialBackOff of bo does not match backoff.Operation[T] (cannot infer T) build-rdep-golang-gvisor-gvisor src/gvisor.dev/gvisor/runsc/cgroup/cgroup.go:581:16: undefined: backoff.WithContext src/gvisor.dev/gvisor/runsc/cgroup/cgroup_v2.go:183:15: undefined: backoff.WithContext build-rdep-golang-opentelemetry-otel Can't stat exporters/jaeger/internal/third_party/thrift/NOTICE: No such file or directory build-rdep-gost src/github.com/knqyf263/gost/notifier/slack.go:60:20: undefined: backoff.RetryNotify build-rdep-incus src/github.com/lxc/incus/internal/server/network/ovn/ovn_icnb.go:13:2: cannot find package "github.com/cenkalti/backoff/v4" in any of: build-rdep-prometheus-alertmanager src/github.com/prometheus/alertmanager/notify/notify.go:25:2: cannot find package "github.com/cenkalti/backoff/v4" in any of: build-rdep-prometheus-sql-exporter src/github.com/justwatchcom/sql_exporter/job.go:223:5: bo.MaxElapsedTime undefined (type *backoff.ExponentialBackOff has no field or method MaxElapsedTime) src/github.com/justwatchcom/sql_exporter/job.go:224:8: bo.MaxElapsedTime undefined (type *backoff.ExponentialBackOff has no field or method MaxElapsedTime) src/github.com/justwatchcom/sql_exporter/job.go:225:6: bo.MaxElapsedTime undefined (type *backoff.ExponentialBackOff has no field or method MaxElapsedTime) src/github.com/justwatchcom/sql_exporter/job.go:227:37: in call to backoff.Retry, type *backoff.ExponentialBackOff of bo does not match backoff.Operation[T] (cannot infer T) build-rdep-restic 0.18.1 (upstream still using v4) src/github.com/restic/restic/internal/backend/local/local.go:21:2: cannot find package "github.com/cenkalti/backoff/v4" in any of: build-rdep-vuls The following packages have unmet dependencies: golang-github-olekukonko-tablewriter-dev : Breaks: golang-github-kotakanbe-go-cve-dictionary-dev (<= 0.3.1-5) but 0.3.1-5 is to be installed
