#1062445 yq: Replace with alternative yq app

Package:
yq
Source:
yq
Submitter:
Martin Bruset Solberg
Date:
2026-05-18 12:01:03 UTC
Severity:
normal
#1062445#5
Date:
2024-02-01 15:03:10 UTC
From:
To:
Dear Maintainer,

Will you consider replacing the current yq app with this one instead?
https://github.com/mikefarah/yq

#1062445#10
Date:
2024-02-05 15:58:53 UTC
From:
To:
Hi Martin

Am 01.02.24 um 16:03 schrieb Martin Bruset Solberg:

why do you want to have this different yq version?

I took a look into it before packaging yq and decided to not use it
since it has a lot of go dependencies which are not yet in Debian.

Christoph

#1062445#15
Date:
2024-04-11 16:29:16 UTC
From:
To:
I second the original request.  I installed yq on my Mac using “brew install yq”, wrote a script and then deployed it to a Debian machine on which I’d run “apt install yq".  But when I ran the script on the Debian machine I got a syntax error in the “yq” command.  It was then that I realised Homebrew had installed the mikefarah version but Debian had installed the kislyuk version.  Looking at the GitHub pages for the two projects the mikefarah one has over four times the number of stars of the kislyuk one so is the more popular of the two.  It’s also a separate fully-featured program rather than just being a wrapper round jq.
#1062445#20
Date:
2026-03-15 14:04:23 UTC
From:
To:
Another +1 to replace this package with the version from mikefarah/yq. I
didn't even know that another yq version existed until I installed the yq
package in a Ubuntu version, which is tracking Debian of course. This
kislyuk/yq version bails out when trying to make use of the "load"
directive:
--------------- $ cat foo.yaml chains: - name: this $ cat test.yaml snafu: - name: foo $ kislyuk/yq -e '.chains += (load("foo.yaml") | .chains)' test.yaml jq: error: load/1 is not defined at <top-level>, line 1, column 13: .chains += (load("foo.yaml") | .chains) ^^^^ jq: 1 compile error --------------- The mikefarah version handles this just fine:
--------------- $ mikefarah/yq -e '.chains += (load("foo.yaml") | .chains)' test.yaml snafu: - name: foo chains: - name: this --------------- Please reconsider.
#1062445#25
Date:
2026-03-16 10:44:03 UTC
From:
To:
mikefarah/yq has a lot of build go build depends which are not yet in
Debian.

Am 15.03.26 um 15:04 schrieb Christian Kujau:

#1062445#30
Date:
2026-05-07 09:22:09 UTC
From:
To:
* Package name    : yq-go
   Version         : 4.53.2-1
   Upstream Author : Mike Farah
* URL             : https://github.com/mikefarah/yq
* License         : Expat
   Programming Lang: Go
   Description     : yq is a portable command-line YAML, JSON, XML, CSV,
TOML, HCL  and properties processor

  yq
  .
  A lightweight and portable command-line YAML, JSON, INI and XML
  processor. yq uses jq (https://github.com/stedolan/jq) (a popular JSON
  processor) like syntax but works with yaml files as well as json, kyaml,
  xml, ini, properties, csv and tsv. It doesn't yet support everything jq
  does - but it does support the most common operations and functions, and
  more is being added continuously.
  .
  yq is written in Go - so you can download a dependency free binary for
  your platform and you are good to go! If you prefer there are a variety
  of package managers that can be used as well as Docker and Podman, all
  listed below.

#1062445#35
Date:
2026-05-13 19:57:10 UTC
From:
To:
The Debian NEW review of yq-go 4.53.2-2 has been completed.

Decision: REJECTED
Reviewer: Reinhard Tartler

Review comment:

Thanks for your diligence in bringing yq-go to the archive. I've


had another look through the source, and while it's mostly there,


I have to reject it for now because of a few minor metadata and


policy issues.





I noticed a slight slip in the way copyright statements are handled


in debian/copyright. The statements need to be reproduced


verbatim from the source headers to accurately reflect the upstream


notices. For instance, the notice for scripts/shunit2 should


include the "All Rights Reserved" portion, and the entry for


scripts/release-deb.sh should match the exact format of the


header, including the (C) symbol and email address.





This is also a bit of a DFSG problem regarding the embedded copy of


the shunit2 framework in scripts/shunit2. While it is correctly


licensed, Debian Policy §4.13 generally prefers using the packaged


version from the archive. If you find it necessary to bundle it,


please include a debian/README.source file that documents this


embedded copy and explains why the system-wide package isn't being


used instead.





Lastly, there are some formatting bits in the copyright file to


clean up. The Apache-2.0 license should have its own standalone


stanza at the bottom of the file that points to the common


licenses directory, rather than having the reference nested inside


the file stanza. I also noticed that the License: Expat string is


repeated as the first line of the license text block in the main


stanza, which should be removed.





Once these bits are polished, it should be ready for another look.

#1062445#40
Date:
2026-05-18 12:00:11 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
yq-go, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1062445@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Christoph Martin <chrism@debian.org> (supplier of updated yq-go package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 17 May 2026 23:22:32 +0200
Source: yq-go
Binary: yq-go yq-go-dbgsym
Architecture: source amd64
Version: 4.53.2+ds-1
Distribution: experimental
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Christoph Martin <chrism@debian.org>
Description:
 yq-go      - portable command-line YAML, JSON, XML, CSV, TOML, HCL  and proper
Closes: 1062445 1135905
Changes:
 yq-go (4.53.2+ds-1) experimental; urgency=medium
 .
   * don't include scripts/shunit2 and scripts/release-deb.sh
   * close ITP (Closes: 1135905, 1062445)
Checksums-Sha1:
 1fa9f263dd8be5f475ef795fab3577bfe5f76872 2768 yq-go_4.53.2+ds-1.dsc
 34a16f400c68d702db2a38e95097fe159a068f06 256636 yq-go_4.53.2+ds.orig.tar.xz
 95fb9cde69252ca17dea233b8d0a3ffdbc016b49 3636 yq-go_4.53.2+ds-1.debian.tar.xz
 21d917200494ba8ef580f1367b0dd8f4e26cc0e9 4350312 yq-go-dbgsym_4.53.2+ds-1_amd64.deb
 fe8c7b592fe8c356f5d90a0af7805adbe978103e 9718 yq-go_4.53.2+ds-1_amd64.buildinfo
 813cf783291d7da73e7ef80e5eb381ca0afca32c 4122516 yq-go_4.53.2+ds-1_amd64.deb
Checksums-Sha256:
 5e817711346017d4d725172e9bf9a5ece256eb975b49ea8e0d4afd48110f0b66 2768 yq-go_4.53.2+ds-1.dsc
 17f4ab16963f2b5fcbace2936af30133a7b90965097d80ed9b5184067292f6cf 256636 yq-go_4.53.2+ds.orig.tar.xz
 dfe8c808d75eb232f8c8e75542ad3a3479f60f84b2bda98a50f2a463574c6940 3636 yq-go_4.53.2+ds-1.debian.tar.xz
 11d637804a57659a62da63dc526b24758f4b53e6e1047fe47cdc9c258a72e25f 4350312 yq-go-dbgsym_4.53.2+ds-1_amd64.deb
 37b2f010c0a64e228ba8b59d68d84acebc06f0541fd45502122f86c78164769f 9718 yq-go_4.53.2+ds-1_amd64.buildinfo
 67a2e3b990d9d14837121407c1b36927d12a4ac73fcf8cd7631e8b73920f204f 4122516 yq-go_4.53.2+ds-1_amd64.deb
Files:
 efaf346928de0d17218b4c0d6ca744a2 2768 golang optional yq-go_4.53.2+ds-1.dsc
 75ddd47b0eb24a157ef0ea9927ae38fb 256636 golang optional yq-go_4.53.2+ds.orig.tar.xz
 05766497e1162b7a11710930b859f66c 3636 golang optional yq-go_4.53.2+ds-1.debian.tar.xz
 a2eb5825af93e50aaf957bc40615e09b 4350312 debug optional yq-go-dbgsym_4.53.2+ds-1_amd64.deb
 89d518479881bc9555e6f65064d13906 9718 golang optional yq-go_4.53.2+ds-1_amd64.buildinfo
 390826b47ea39d2899978b37f75468b4 4122516 utils optional yq-go_4.53.2+ds-1_amd64.deb
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEbdFebnsTnCYy4y02kcMUbl2GabQFAmoK1ksACgkQkcMUbl2G
abQNjBAAtuCHdA6/BGGDuBUaIfuGP5BE4uxGj4477FQBlyXHoxQ0AwdmwH/+No7O
bM0fTeWknVNhME4CCcHX2TOVvP8yEOcQmHNOHSDzmX517IlwXxVbnRGMEgN3rgWD
86Bcp4NTP5ir7LiYfBqvgR96KY+lnCbXXuS9E269qf6cYulaEabfg3P+Z1XH/UuF
H8At8jd0tlGshmWPiIT0lFkwS+6NeRoAvhbbR5B8/mGdFWHxxBE4L3xkO+z1ShXZ
bs8ekjYD93pWoxsnckABRHqZJhqSIF5pA2IUe02BpfEtS8fmKz84uO60/4DkaHT5
4yR/AADdu9iYg58hxJo2sCaLF6blL5NVlZoJTCKj1qfS67Lzwfhx54/A2OHuC70D
r2s65OW5Mk3HVfq7obpVzlxANtcG5Fm2A8z5tyaD+/fbxl+bmdf8bDuFyhQIhjsJ
noeb/RCVwpzkB9Ec/fjG2LrPGPLk2UCkbhxOSEEwIKaXbchYXqFXiNBBNLJCIat+
yCO/EoqjJl3EWCnl94KSPsySdG9kOSRsiNZ6BRWbCdDNT4Zo+CPJs+XukAYewtWq
xjkcYQEJP3Dy7W6iZzHHbh0Q3/D+PSJMS8YnCVYcvSkPgvvEUY1wAhqPhceDW4bW
Ur8fU+h/0EMRcMOlBkBajc277X9KiKR0vZxaHuaahu5SMV5JzmY=
=qrP7
-----END PGP SIGNATURE-----