#1135977 ITP: golang-github-anchore-fangs --

Package:
wnpp
Source:
wnpp
Submitter:
Rafael Passos
Date:
2026-10-13 17:49:17 UTC
Severity:
normal
#1135977#5
Date:
2026-05-08 04:02:46 UTC
From:
To:
* Package name    : golang-github-anchore-fangs
  Version         : 0.1.0-1
  Upstream Author : Anchore, Inc.
* URL             : https://github.com/anchore/fangs
* License         : Apache-2.0
  Programming Lang: Go
  Description     : A library that makes integrating Cobra and Viper simpler and more
 consistent

 fangs
 .
 A library that makes integrating Cobra and Viper simpler and more
 consistent.

This is a direct dependency of golang-github-anchore-fangs
	tracked in #1135976
	Which is a dependency of k9s
		tracked in #1053428
#1135977#10
Date:
2026-05-08 04:07:17 UTC
From:
To:
Opps, I miss typed.


- This is a direct dependency of golang-github-anchore-fangs
+ This is a direct dependency of golang-github-anchore-clio
                                                       ^^^^
#1135977#15
Date:
2026-05-08 04:07:17 UTC
From:
To:
Opps, I miss typed.


- This is a direct dependency of golang-github-anchore-fangs
+ This is a direct dependency of golang-github-anchore-clio
                                                       ^^^^
#1135977#22
Date:
2026-09-26 00:04:26 UTC
From:
To:
Hi Rafael,

I am packaging syft, ITP https://bugs.debian.org/1124819. In a clean chroot
it now reaches the compile and stops on four modules. Two are yours: clio
and fangs.

Your blocker on clio, golang-github-pborman-indent, was uploaded on 11
September, so fangs looks like the last one.

Both have been open since May. Tell me how you would like to proceed: I can
package them with you as maintainer, co-maintain, or leave them to you.

Cheers,
Juan
#1135977#27
Date:
2026-09-26 00:41:33 UTC
From:
To:
Hi Juan,

Thanks for the offer.
Clio and fangs are almost completed.
_It took me a while to return to them_.

I'm working on a regression caused by the golang-github-go-viper-mapstructure package.
Fangs depends on it.
Upstream fangs uses 2.4.0, but we have 2.5.0 packaged on Debian, and it caused the regression.

I sent my patch upstream, but no response yet.

Currently, I'm checking the rdeps that broke with my fix (or were broken already, I still aneed to check).

https://salsa.debian.org/go-team/packages/golang-github-go-viper-mapstructure/-/merge_requests/2

If you'd like, check the comment in this MR. There are two packages to check.
I won't have time this weekend. My plan was to check them next week.

Thanks,

Rafael Passos,
Software Engineer
São Paulo, Brasil
#1135977#32
Date:
2026-10-13 12:55:01 UTC
From:
To:
Good news!

I was able to get upstream to add a proper copyright notice
to all their open source packages.
One of the co-founders was very attentions, and made sure it was applied
to all repos.
Link to one of the issues I raised:
https://github.com/anchore/syft/issues/5394

This will unblock my packages, and also yours!
#1135977#37
Date:
2026-10-13 17:43:25 UTC
From:
To:
Thanks Rafael for moving this forward.


For documentation purposes, I will reference this commit: https://github.com/anchore/syft/commit/c2ea35ef328795647cfaabaf33e2ce74032f6e07

So we can use it when packaging such packages.

It adds a COPYRIGHT file with "Copyright (c) Anchore, Inc." to syft, stereoscope, clio, fangs, bubbly and go-logger.

One detail that I will do in packaging that might be useful for you, I share just in case: the file is only in main. v1.54.1 and every earlier tag return 404 for it, so a tarball made from a current tag still needs the holder stated in debian/copyright, with a Comment pointing at that commit. The first release after 12 October will carry the file itself.

Regarding go-rpmdb package: this one is not covered and does not need to be. It is a fork of knqyf263/go-rpmdb and its LICENSE is MIT, Copyright (c) 2019 Teppei Fukuda.

Best,

Juan