Hi Otto, On Sun, Sep 13, 2026 at 8:47 AM Otto Kekäläinen <[email protected]> wrote: > In both cases these are indirect dependencies, and the versions they > depend on are satisfied by the version currently in Debian: > > trufflehog ± grep chroma go.mod > github.com/alecthomas/chroma v0.10.0 // indirect > https://tracker.debian.org/pkg/golang-github-alecthomas-chroma -> 0.10.0-6 > > glow ± grep clark go.mod > github.com/dlclark/regexp2 v1.11.0 // indirect > https://tracker.debian.org/pkg/golang-github-dlclark-regexp2 -> 1.11.0+ds1-1 > > Neither package seems to have any GOPATH hacks in their rules files: > https://salsa.debian.org/go-team/packages/golang-github-dlclark-regexp2/-/blob/debian/sid/debian/rules > https://salsa.debian.org/go-team/packages/golang-github-alecthomas-chroma/-/blob/debian/sid/debian/rules > > Are you suggesting that to fix the build errors in Trufflehog and > Glow, Debian repositories need new binary packages named > golang-github-alecthomas-chroma-v0-dev and > golang-github-dlclark-regexp2-v0-dev?
The module-aware build system maps Go import paths directly to installed Debian packages on the filesystem to enable offline builds without network or goproxy access. Because of this mapping, the exact import path is what matters most. For modules without a major version suffix (v0 or v1), upstream usually does not append version suffix to import path. So that, we do not need to add `-v0` or `-v1` suffixes to Debian package names unless upstream added them in the import path. Binary package names like `golang-github-alecthomas-chroma-v0-dev` are not required. Since both `chroma` and `regexp2` are in Debian at the exact upstream versions required by `trufflehog` and `glow`, the build failures are likely due to missing indirect depends during the build process. Can you please check the installed version in the build environment instead of what's available in Debian to locate the issue? Under module-aware builds, indirect depends listed in `go.mod` should matches what's available in the build environment. In many cases, legacy `-dev` packages pull in outdated or incomplete depends. To resolve the build errors, you can check which installed -dev package is bringing in the wrong or missing depends, or simply add the missing indirect depends as Build-Depends in `debian/control`. We may clean up it later once `dh-make-golang` is ready for that. We can run `dh-make-golang` to generate correct dependency automatcally and run a diff to catch package contains dependency that requires an update. Best regards, Andrew -- -Andrew
