The fix is still waiting for a sponsor: https://salsa.debian.org/go-team/packages/golang-github-theupdateframework-go-tuf/-/merge_requests/2 Its pipeline is green.
The bug also breaks other dh-go builds. grype 0.119.0 (ITP https://bugs.debian.org/1061720), which gets go-tuf through sylabs-sif and sigstore, fails the same way in a clean sid chroot today: go.work:1712: replace github.com/theupdateframework/go-tuf/v0: invalid module path With -3 from the merge request, grype builds again and its 5827 tests pass. Could someone from the team merge and upload it?
