Hi Nilesh,

Am 12.07.26 um 15:26 schrieb Nilesh Patra:
> Got it. I've written a check and it emits the following for hugo:

wow, that was quick! Thank you very much, this is really great.

> I'm worried if this will annoy maintainers.

Yes, you're right. As Andrew already stated, there's currently nothing
sensible which a maintainer could do to fix this. So a warning is not
the right level.

If the MR makes it into lintian now, I think that "info" or even
"pedantic" might be a better choice, as long as Debian still uses
GO111MODULE=off as default setting.

When that has changed in dh-golang, the check you've written could be
bumped in severity to a warning.

For the explanation, you might consider this text:


The binary contains legacy or insecure DefaultGODEBUG variable settings.

Modern Go versions allow developers to force legacy (and potentially
insecure) behaviors using //go:debug directives or GODEBUG settings.
While these are sometimes necessary for temporary compatibility, they
can introduce security vulnerabilities, disable critical fixes, or
compromise build reproducibility.


Regards,
Tobias

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature

Reply via email to