Hi!

The 'hub' package is soon likely to be the last remaining package that
depends on golang-github-bmizerany-assert which ought to be removed:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1143916

I've confirmed that it is only used in the self-tests:

jas@frallan:~/dpkg/hub$ rgrep bmizerany/ass .|grep -v _test.go
./go.sum:github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
./go.sum:github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
./go.mod:	github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869
jas@frallan:~/dpkg/hub$

However it is used in many files.

Last upstream release was 6 years ago for 'hub', is this even maintained
software any more?  Should we ship it in forky?

I've seen an upstream merge release that removes the dependency, but
back-porting it may be complicated:

https://github.com/mislav/hub/pull/2463

Best would be if upstream could make a new release to clarify the
situation.  I'm not holding my breath though:

https://github.com/mislav/hub/issues/2470

/Simon

Hello,

Bug #1143930 in hub reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/go-team/packages/hub/-/commit/226fb5f7043b3629ad50fb465fdd186be37e742a

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1143930

Hello,

Bug #1143930 in hub reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/go-team/packages/hub/-/commit/399fee2cb6a6169b01706281b13752d9d8a4a580

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1143930

We believe that the bug you reported is fixed in the latest version of
hub, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1143930@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon Josefsson <simon@josefsson.org> (supplier of updated hub package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 17 Aug 2026 14:16:56 +0200
Source: hub
Architecture: source
Version: 2.14.2~ds2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Simon Josefsson <simon@josefsson.org>
Closes: 1143930
Changes:
 hub (2.14.2~ds2-1) unstable; urgency=medium
 .
   * New upstream version 2.14.2~ds2
   * Fix d/watch for ds2
 .
 hub (2.14.2~ds1-4) unstable; urgency=medium
 .
   * Team upload
   * Use Standards-Version: 4.7.4
   * Use dh-sequence-golang
   * Use watch v5
   * Bump compat to 14
   * Bump debian/* copyright years
   * Use upstream patch to avoid bmizerany/assert (Closes: #1143930)
   * Back-port internal/assert too
   * Fix usr/bin/hub install for compat 14
   * Use Static-Built-Using
   * Drop B-D golang-github-bmizerany-assert-dev (Closes: #1143930)
   * Drop broken pristine-tar branch
Checksums-Sha1:
 0d736bcb9aa8457b9445b67c5bd5d0accdc2a86a 2692 hub_2.14.2~ds2-1.dsc
 bbf58fa04faf95f1d7616dbe3e229eaa786b2750 137952 hub_2.14.2~ds2.orig.tar.xz
 549d630f1df9e4dd5e4b622917c983db8691b45f 7720 hub_2.14.2~ds2-1.debian.tar.xz
 ff9f56ad5021eaab5a47ea6211879ed87a9b5bdf 278640 hub_2.14.2~ds2-1.git.tar.xz
 b95cec94303d2beee889912b1b86fc24b3ce542a 17556 hub_2.14.2~ds2-1_source.buildinfo
Checksums-Sha256:
 6101da4389940f38745f83ac611cdc06945a25352d41ab11248d6b6f828954b6 2692 hub_2.14.2~ds2-1.dsc
 43e20adee49e31d127f68052122fc4eb7af8cbfedbc202077d7985c4de75f05c 137952 hub_2.14.2~ds2.orig.tar.xz
 1e3346518cd6d1416d1c61a977237359167ac09dfc0f97a0f62519de87407a43 7720 hub_2.14.2~ds2-1.debian.tar.xz
 a69e5101ee1097e7fe22b69b9212899751162a37fa3d73edcef87bd63525edf7 278640 hub_2.14.2~ds2-1.git.tar.xz
 ca693fed46ca82d74382ffa6ab2d8290d587fc7016b0da3f5002a840d720f6b4 17556 hub_2.14.2~ds2-1_source.buildinfo
Files:
 12d29eead9b5d22db1e4756039261b8e 2692 net optional hub_2.14.2~ds2-1.dsc
 fcb3332a172bca0d4050fba061b71384 137952 net optional hub_2.14.2~ds2.orig.tar.xz
 6552cc1fbc668be8f2f2886b2f2beb96 7720 net optional hub_2.14.2~ds2-1.debian.tar.xz
 b7a4d1e28ed4a52f3c474d56757e0189 278640 net None hub_2.14.2~ds2-1.git.tar.xz
 9feea78724964adc4055bc0585d6cfab 17556 net optional hub_2.14.2~ds2-1_source.buildinfo
Git-Tag-Info: tag=4c2373e57d7e330a7488385b1d747b85d43e3ec2 fp=a3cc9c870b9d310abad4cf2f51722b08fe4745a2
Git-Tag-Tagger: Simon Josefsson <simon@josefsson.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqC/hMACgkQYG0ITkaD
wHmztBAAwAlKY4bS1GwX2kdYZNy2v+i+0hDRQKu3uQPVM1l3bEcX3qV9TMZPO1Ew
2dqfhb9/pndC9pQd7wVUFUiuorNlLaru0BzOmYvqXw+bqvt4O75tVZQHEqjnjD6J
Gf3/noi7J6pXoov6e8sGQa/J8/4SqEHlnxy6R3INjtnIw2V6YEtr6hwwDXdPiF9t
Dxvk+ZWC9R9zZemLCsoibBQsd+Y7HaOUsGSKiozqY/4A3XxWeoi7vGcLLsccyYTx
h0iKMfhhQhTLuWCQ+3+3vjYa4RgD5hUoLL5Rtw9A+Fv1/3iuow83bEYxwonsOpU1
szfHJGZJcJm02nFasexWG4+teczSmecZblYD9O8ShLq6K55VA4g2P/pi0RlPMHNR
u0SfXE7Kz56B+8ETufjuXxGiR6JyIo5tbaWzmpHMhGrTM0n9Kc/Ml6gezWn6Y7tw
ksKuaUmZGwfVp3yZmcxFahZHmbmvqB/f5nnHnCjh+0BVzSdgERa6/LEzARmTfk1M
JzPNylXih+FTL6PaCwxfQWByjWaP/5I288anNXM6p+9n04445iUs+R+xUgzpzdh9
l2C9VYRwzfQokwnd3Mk3rGwgxQKBc4juUsvuGwvSaou8NZGPNZ7aV1N1XzEhBqAg
qmJIW5TIuQvU67aoc4l4qlBPKpUzEyEQd42NmRd/FRKRMe9AITE=
=6GnC
-----END PGP SIGNATURE-----