Control: severity -1 important On Thu, 2026-09-10 at 10:52 +0200, Simon Josefsson wrote: > Package: golang-github-anchore-go-version > Severity: serious > Tags: sid forky > User: [email protected] > usertags: zombie-removal > > This package ships unmaintained upstream code. It has no reverse > dependencies in Debian testing/unstable, see dak output at the end of > this e-mail. > > https://tracker.debian.org/pkg/golang-github-anchore-go-version > > The upstream project has been archived: > > https://github.com/anchore/go-version > > I noticed this package is needed for 'syft', which is not yet in Debian, > but it seems upstream is still using the archived fork, which I > mentioned here: > > https://github.com/anchore/syft/issues/5266
This should not be closed until 1124819 becomes stale or we reach the 1 January 2027, whichever comes first, in my opinion. Otherwise we won't be giving the contributor working on syft a chance to (re-)upload. > I don't think we should ship golang-github-anchore-go-version in forky. > Since it is archived upstream I think we should also remove it from > Debian. But let's start with triggering testing removal for now, in > case it will be needed for 'syft'. It was added to Debian relatively > recently. > > Having golang-*-dev packages in testing, and consequently the next > stable release, has a QA cost. These packages normally have no use > for Debian users, but are intended for building other Debian packages > that rely on them. No package in Debian testing rely on this package. > > This bug is filed to trigger discussion if the package is still useful > to keep in Debian testing, and also (when no discussion occurs after > one month) trigger testing autoremoval of the package. > > Please don't take this as disrespect of the amount of work that went > into the upstream code, or its packaging -- this bug report is part of > a QA effort to remove 100+ unused golang-*-dev packages. The QA cost > associated with keeping all the packages in testing is assumed to be > larger than the cost to (hopefully rarely) have some discussion, > re-evaluation and closing of this bug report, if there is ever any > reasonable need to keep this package in testing. > > If you discover this bug report when doing QA work on this package, > please consider avoid doing any QA upload, and instead evaluate if the > package still has any use in Debian, and consider re-assigning this to > a ftp-master RM bug to finally trigger removal of it. > > /Simon > > ssh mirror.ftp-master.debian.org dak rm -Rn -s=testing > golang-github-anchore-go-version > Will remove the following packages from testing: > > golang-github-anchore-go-version | 0.0~git20210903.51efa5b-2 | source > golang-github-anchore-go-version-dev | 0.0~git20210903.51efa5b-2 | all > > Maintainer: Debian Go Packaging Team <[email protected]> > > ------------------- Reason ------------------- > > ---------------------------------------------- > > Checking reverse dependencies... > No dependency problem found. -- Maytham
signature.asc
Description: This is a digitally signed message part
