Dear maintainer,

to prepare the switch of the default golang version in unstable,
I've asked Santiago Vila to rebuild all packages which depend
on golang with Go 1.27. This package failed to build, but it
could be built successfully with Go 1.26.

The full build log is available here:

https://people.debian.org/~toddy/ftbfs-golang-1.27/

I'm filing this bug with severity important for now. Once the
default golang compiler has been switched in unstable, this
bug becomes release-critical. When that happens, I'll upgrade
the severity to serious.

Regards,
Tobias

Could this be a Go 1.27 problem to me, it shouldn't panic?

Did something change in this particular crypto implementation between
1.26 and 1.27?

/Simon

PANIC: jose_test.go:2056: TestSuite.TestEncrypt_ECDH_ES_A192KW_A192CBC_HS384

... Panic: runtime error: invalid memory address or nil pointer dereference (PC=0x491564)

/usr/lib/go-1.27/src/runtime/panic.go:859
  in gopanic
/usr/lib/go-1.27/src/runtime/panic.go:336
  in panicmem
/usr/lib/go-1.27/src/runtime/signal_unix.go:931
  in sigpanic
ecdh.go:138
  in Ecdh.deriveKey
ecdh.go:60
  in Ecdh.WrapNewKey
ecdh_aeskw.go:27
  in EcdhAesKW.WrapNewKey
jose.go:343
  in encrypt
jose.go:260
  in EncryptBytes
jose.go:225
  in Encrypt
jose_test.go:2061
  in TestSuite.TestEncrypt_ECDH_ES_A192KW_A192CBC_HS384
/usr/lib/go-1.27/src/reflect/value.go:369
  in Value.Call
/usr/lib/go-1.27/src/runtime/asm_amd64.s:1264
  in goexit

Hello,

Bug #1146191 in golang-github-dvsekhvalnov-jose2go reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/go-team/packages/golang-github-dvsekhvalnov-jose2go/-/commit/1c122c0fa2aa9160403378aaa7033f7cc4fc7fa5
------------------------------------------------------------------------
Fix FTBFS with golang-1.27

Closes: #1146191
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1146191

We believe that the bug you reported is fixed in the latest version of
golang-github-dvsekhvalnov-jose2go, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1146191@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Dr. Tobias Quathamer <toddy@debian.org> (supplier of updated golang-github-dvsekhvalnov-jose2go package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 27 Sep 2026 13:05:09 +0200
Source: golang-github-dvsekhvalnov-jose2go
Architecture: source
Version: 1.11.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Dr. Tobias Quathamer <toddy@debian.org>
Closes: 1146191
Changes:
 golang-github-dvsekhvalnov-jose2go (1.11.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream version 1.11.0
   * Add build dependency to binary package as well
   * Fix FTBFS with golang-1.27. (Closes: #1146191)
Checksums-Sha1:
 15b0df065db212f781e53476fcb5e9c0528c130f 2677 golang-github-dvsekhvalnov-jose2go_1.11.0-1.dsc
 28f5d68fff229b9f2e8d4677ac6ffebcdf474737 81054 golang-github-dvsekhvalnov-jose2go_1.11.0.orig.tar.gz
 1910c7b0282dcd4d0e9fd9b5662d9c1fc1ff15e8 3424 golang-github-dvsekhvalnov-jose2go_1.11.0-1.debian.tar.xz
 98ca5de3b8bb0540e5de1251e29f86260a77ff7b 138908 golang-github-dvsekhvalnov-jose2go_1.11.0-1.git.tar.xz
 0c13097848c944c80e89dd41aa9c6682d18c1100 17836 golang-github-dvsekhvalnov-jose2go_1.11.0-1_source.buildinfo
Checksums-Sha256:
 5c590326ed9fea92a99d2f04d9d2869311f48da20be700a0cd761584780d90d1 2677 golang-github-dvsekhvalnov-jose2go_1.11.0-1.dsc
 8534e7f0a69bfc32bb3d60b51fc260523818e7964a2e626911b6ee437c6f5709 81054 golang-github-dvsekhvalnov-jose2go_1.11.0.orig.tar.gz
 f944cbc8c0380604697bfd1b49153f6082a1688998cf62ab555cfe2154b0b7cc 3424 golang-github-dvsekhvalnov-jose2go_1.11.0-1.debian.tar.xz
 aa478d65fc70fe1112e2495d9885199dba96e44f8abdc0ec9aa20a4c1fe321d6 138908 golang-github-dvsekhvalnov-jose2go_1.11.0-1.git.tar.xz
 8468593a5c2bf0947a412a8ceba23f30fb37bb89afca4db17b1372e8bdd5fedc 17836 golang-github-dvsekhvalnov-jose2go_1.11.0-1_source.buildinfo
Files:
 10adc7371f3ddb2cb7807d7c0069709f 2677 golang optional golang-github-dvsekhvalnov-jose2go_1.11.0-1.dsc
 51420200a443c67f2da87340ae118984 81054 golang optional golang-github-dvsekhvalnov-jose2go_1.11.0.orig.tar.gz
 5b0f53753d525fd6564f2fbc662291d0 3424 golang optional golang-github-dvsekhvalnov-jose2go_1.11.0-1.debian.tar.xz
 32ca631910641d8bb5601823e7d7c32c 138908 golang None golang-github-dvsekhvalnov-jose2go_1.11.0-1.git.tar.xz
 6c108259fee92c610a257eff55d6befd 17836 golang optional golang-github-dvsekhvalnov-jose2go_1.11.0-1_source.buildinfo
Git-Tag-Info: tag=5864666c6ad7d61a3f856f951b86bdf9ce1ce053 fp=d1cb8f39bc5ded24c5d2c78c1302f1f036ebeb19
Git-Tag-Tagger: Dr. Tobias Quathamer <toddy@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmq4+RsACgkQYG0ITkaD
wHmhug//VLSvz0TsC2xO+zZAUX0zydxq1WKDYOz+RWdvUyPpKf9twAYkWcPOqD+B
NQn3dEdl7HbTZHnjLlxbz4Kv3uIGM3e+dxrJYwkLNSfav3h30Nb/WNQjtKA9iPcL
/RHjzLGznOjjvZ2j8NF7IQtCSaveJ27idtlfZN8o0DYvJowFn7HRkcH2zZR+Nvak
WcG9mFZudCZd01Q9C9tw0HPnt9lsr5MnprTKLefzALcVV/gEqqF5s8t+sttuADja
xhs0cZWoZSp+1n8GnCwHTIovIVHnsa8BErSiLqqKQ4rke26kDDit5hNa8+n+XJUf
zGI2aXAZ9YcndrnFuLjCQOFanISuzmRURpZW1J/kTKjgis/ey45VSfOuPcXys1NJ
vtwht/NNkJkOp7bFUn1eZg8YC5AqKhq4hiCwcIgV7tJqUH5EicAcLXfj7dVMbtDP
Z9Vo7HBHWREJJQ1gsi3bCkWQ78gFTBQf987f8gXsseC67SbDZ2c4EIXBKcSinlHR
xcZNMGQ/iwhXdszAxkm3eCR0uoBlesxdybR8tqeQXn6Kc2PkROdxwqy7V88tLcMP
SGkYRDWbV5la0Qj1YGHNkdflNLYPpu7C6pDl/lN6I4ihH3GaDrhTiB9KD19Sfm/3
pn+7hLZkuBm55TRdHwVzyY692khtiBGgx/hr9sfg+gKTHd2AhgU=
=VQwh
-----END PGP SIGNATURE-----