"Dr. Tobias Quathamer" <[email protected]> writes: > golang-github-cespare-xxhash
I think this is a false positive -- I don't see any added go.mod after rebuilding. Could you analyze why your script identified this package? There could be more like it. https://packages.debian.org/sid/all/golang-github-cespare-xxhash-dev/filelist /usr/share/gocode/src/github.com/cespare/xxhash/go.mod /usr/share/gocode/src/github.com/cespare/xxhash/go.sum jas@frallan:~/dpkg/golang-github-cespare-xxhash$ dpkg -c ../golang-github-cespare-xxhash-dev_2.3.0-2_all.deb|grep -E 'go.(sum|mod)' -rw-r--r-- root/root 45 2026-07-14 11:33 ./usr/share/gocode/src/github.com/cespare/xxhash/go.mod -rw-r--r-- root/root 0 2026-07-14 11:33 ./usr/share/gocode/src/github.com/cespare/xxhash/go.sum jas@frallan:~/dpkg/golang-github-cespare-xxhash$ Has it something to do with the zero-byte go.sum? That seems unusual, but is coming from upstream, and this package doesn't have any build dependencies so probably expected. I'M uploading a new version anyway, because I had prepared several improvements (thanks debcraft!) and tested it before noticing this. /Simon
signature.asc
Description: PGP signature
