Hi Andrew and thanks for taking time to explain, On Sun, 13 Sept 2026 at 17:57, Andrew Lee <[email protected]> wrote: > > Hi Otto, > > On Sun, Sep 13, 2026 at 8:47 AM Otto Kekäläinen <[email protected]> wrote: > > In both cases these are indirect dependencies, and the versions they > > depend on are satisfied by the version currently in Debian: > > > > trufflehog ± grep chroma go.mod > > github.com/alecthomas/chroma v0.10.0 // indirect > > https://tracker.debian.org/pkg/golang-github-alecthomas-chroma -> 0.10.0-6 > > > > glow ± grep clark go.mod > > github.com/dlclark/regexp2 v1.11.0 // indirect > > https://tracker.debian.org/pkg/golang-github-dlclark-regexp2 -> 1.11.0+ds1-1 > > > > Neither package seems to have any GOPATH hacks in their rules files: > > https://salsa.debian.org/go-team/packages/golang-github-dlclark-regexp2/-/blob/debian/sid/debian/rules > > https://salsa.debian.org/go-team/packages/golang-github-alecthomas-chroma/-/blob/debian/sid/debian/rules > > > > Are you suggesting that to fix the build errors in Trufflehog and > > Glow, Debian repositories need new binary packages named > > golang-github-alecthomas-chroma-v0-dev and > > golang-github-dlclark-regexp2-v0-dev? > > The module-aware build system maps Go import paths directly to > installed Debian packages on the filesystem to enable offline builds > without network or goproxy access. Because of this mapping, the exact > import path is what matters most. > > For modules without a major version suffix (v0 or v1), upstream > usually does not append version suffix to import path. So that, we do > not need to add `-v0` or `-v1` suffixes to Debian package names unless > upstream added them in the import path. Binary package names like > `golang-github-alecthomas-chroma-v0-dev` are not required. > > Since both `chroma` and `regexp2` are in Debian at the exact upstream > versions required by `trufflehog` and `glow`, the build failures are > likely due to missing indirect depends during the build process. Can > you please check the installed version in the build environment > instead of what's available in Debian to locate the issue?
In both cases the -v2 package was pulled in as an indirect build dependency. Explicitly depending on the v0 versions by adding golang-github-dlclark-regexp2-dev and golang-github-alecthomas-chroma-dev respectively solved it. I don't know which indirect dependency incorrectly has the wrong relation to a too new version, but explicitly depending on the v0 versions fixed it for Trufflehog and Glow. I will finalize the changes and upload tomorrow. Thanks!
