Package: golang-opentelemetry-contrib-dev Version: 1.46.0-1 Severity: important X-Debbugs-Cc: [email protected]
golang-opentelemetry-contrib-dev installs Go source whose imports cannot be satisfied by anything in the archive, so any package importing it fails to build. The visible victim today is golang-opentelemetry-auto (ITP #1136684), which reaches it through pipeline/otelsdk. The -dev package installs 155 files under detectors/, including detectors/autodetect, detectors/docker and detectors/hetzner, even though "detectors" is listed in DH_GOLANG_EXCLUDES: d/rules sets DH_GOLANG_EXCLUDES_ALL := 0, so the excludes only skip the build, not the installation. The result is source that is shipped but never compiled, and whose dependencies are therefore never declared in Depends. detectors/autodetect imports all the registered detectors, and two of them cannot be satisfied in unstable: * detectors/docker imports github.com/moby/moby/client, github.com/moby/moby/api/types/container and .../api/types/system. No package in unstable provides github.com/moby/moby: golang-github-docker- docker-dev 28.5.2+dfsg4-5 provides github.com/docker/docker, because Debian has not yet followed the upstream module rename. The interim packages for the new paths are ITP #1149066 (golang-github-moby-moby-api) and ITP #1149067 (golang-github-moby-moby-client); the full picture is in https://salsa.debian.org/mendezr/docker/-/wikis/Docker29Transition * detectors/hetzner imports github.com/hetznercloud/hcloud-go/v2/hcloud/metadata. golang-github-hetznercloud-hcloud-go-dev 2.4.0-2 installs that code under github.com/hetznercloud/hcloud-go, without the /v2 element the module requires, and upstream is at 2.47.0. Filed separately against golang-github-hetznercloud-hcloud-go-dev. This is not new in 1.46.0-1 alone: 1.43.0-1 already shipped 66 files under detectors/, and its autodetect already imported the aws, azure and gcp detectors, whose dependencies are not in Depends either. What 1.46 adds is an import that cannot be satisfied at all. Plan on the packaging side: 1. 1.46.0-3 drops detectors/docker and detectors/hetzner from the registry in detectors/autodetect and stops installing those two directories, as scaffolding, with the patch referring to the bugs above so it is reverted once the dependencies land. 2. The detectors whose dependencies are already in unstable (aws, azure/azurevm, gcp, ibmcloud/vpc, k8sapi, vultr) get built, tested and declared, instead of being shipped unbuilt. 3. An autopkgtest checks that every Go package the -dev installs resolves its imports with only its declared Depends installed. dh_golang_autopkgtest only rebuilds what the package built, which is why this class of problem reached unstable unnoticed. -- Juan Manuel Méndez Rey
