Simon Josefsson <[email protected]> writes: > "Dr. Tobias Quathamer" <[email protected]> writes: > >> golang-github-cespare-xxhash > > I think this is a false positive
Another false positive from your list: golang-github-github-smimesign. There is only one go.mod in that package. I made the upload anyway since I had prepared it. /Simon > -- I don't see any added go.mod after rebuilding. Could you analyze > why your script identified this package? There could be more like it. > > https://packages.debian.org/sid/all/golang-github-cespare-xxhash-dev/filelist > > /usr/share/gocode/src/github.com/cespare/xxhash/go.mod > /usr/share/gocode/src/github.com/cespare/xxhash/go.sum > > jas@frallan:~/dpkg/golang-github-cespare-xxhash$ dpkg -c > ../golang-github-cespare-xxhash-dev_2.3.0-2_all.deb|grep -E > 'go.(sum|mod)' > -rw-r--r-- root/root 45 2026-07-14 11:33 > ./usr/share/gocode/src/github.com/cespare/xxhash/go.mod > -rw-r--r-- root/root 0 2026-07-14 11:33 > ./usr/share/gocode/src/github.com/cespare/xxhash/go.sum > jas@frallan:~/dpkg/golang-github-cespare-xxhash$ > > Has it something to do with the zero-byte go.sum? That seems unusual, > but is coming from upstream, and this package doesn't have any build > dependencies so probably expected. > > I'M uploading a new version anyway, because I had prepared several > improvements (thanks debcraft!) and tested it before noticing this. > > /Simon >
signature.asc
Description: PGP signature
