#1148552 golang-k8s-metrics-dev: ships k8s.io/component-helpers under k8s.io/metrics (wrong orig)

Package:
golang-k8s-metrics
Source:
golang-k8s-metrics
Submitter:
Hermes Jesús Rodríguez Azuaje
Date:
2026-09-28 17:37:12 UTC
Severity:
normal
Tags:
#1148552#5
Date:
2026-09-20 17:48:40 UTC
From:
To:
Dear Maintainer,

golang-k8s-metrics-dev 0.36.4-1 in unstable installs files under
/usr/share/gocode/src/k8s.io/metrics/, but that tree is not the
kubernetes/metrics module.

Evidence on an unstable chroot after installing golang-k8s-metrics-dev:

  $ head -3 /usr/share/gocode/src/k8s.io/metrics/go.mod
  module k8s.io/component-helpers
  go 1.26.0

  $ head -5 /usr/share/gocode/src/k8s.io/metrics/doc.go
  package componenthelpers

The installed layout (auth/rbac, apps/poddisruptionbudget, node/topology,
apimachinery/lease, …) matches k8s.io/component-helpers, which is already
packaged correctly as golang-k8s-component-helpers-dev under
k8s.io/component-helpers.

The real upstream for this source package is:

https://github.com/kubernetes/metrics
  (go.mod: module k8s.io/metrics)

At tag v0.36.4 that repository provides the expected API client paths, e.g.:

  k8s.io/metrics/pkg/apis/metrics/v1beta1
  k8s.io/metrics/pkg/client/clientset/versioned

Those directories are absent from golang-k8s-metrics_0.36.4.orig.tar.gz /
golang-k8s-metrics-dev. Homepage and Description claim metrics APIs/clients,
but the orig tarball appears to be component-helpers content renamed into the
metrics import path.

Impact: reverse dependencies that import the metrics client (e.g. packaging of
github.com/hrodrig/groot, ITP #1148543) FTBFS with:

  cannot find package "k8s.io/metrics/pkg/apis/metrics/v1beta1"
  cannot find package "k8s.io/metrics/pkg/client/clientset/versioned"

Suggested fix: reimport the correct kubernetes/metrics orig for 0.36.4 (or the
intended version), drop the mistaken component-helpers tree from this package,
and keep depending on golang-k8s-component-helpers-dev only if metrics actually
needs it.

I can help test a corrected package against groot's Debian packaging once a
fixed orig is available.

Thanks,
Hermes Rodríguez

#1148552#10
Date:
2026-09-20 19:31:02 UTC
From:
To:
Hi,

I prepared a local fix for testing (not uploaded):

  Version: 0.36.4+really0.36.4-1
  Upstream: https://github.com/kubernetes/metrics tag v0.36.4
  (cannot replace golang-k8s-metrics_0.36.4.orig.tar.gz in the archive)

Changes vs 0.36.4-1:
  - reimport correct kubernetes/metrics tree (go.mod: module k8s.io/metrics;
    pkg/apis/... and pkg/client/... present)
  - drop golang-k8s-component-helpers-dev from Build-Depends/Depends
    (not required by metrics go.mod)

Verified: sbuild of github.com/hrodrig/groot (ITP #1148543) against this
.deb succeeds (DEB_BUILD_OPTIONS=nocheck for unrelated fake-gcs test deps).

Happy to open a Salsa MR on go-team/packages/golang-k8s-metrics if that
helps, or send a debdiff / branch tip.

Thanks,
Hermes Rodríguez

#1148552#15
Date:
2026-09-25 11:52:41 UTC
From:
To:
Hi,

Thanks for finding this issue.

Somehow my uscan tripped when downloading the tarball and used the
components-helpers local .tar.gz instead.

Yes, please open the MR and let's get this uploaded.

Thanks!

#1148552#20
Date:
2026-09-28 17:36:24 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
golang-k8s-metrics, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148552@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Arthur Diniz <arthurbd@debian.org> (supplier of updated golang-k8s-metrics package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 28 Sep 2026 17:51:51 +0100
Source: golang-k8s-metrics
Architecture: source
Version: 0.36.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Arthur Diniz <arthurbd@debian.org>
Closes: 1148552
Changes:
 golang-k8s-metrics (0.36.5-1) unstable; urgency=medium
 .
   * New upstream version 0.36.5 (Closes: #1148552)
   * d/control: Drop unused golang-k8s-component-helpers-dev dependency
   * d/copyright: Update The Kubernetes Authors years to 2017-2021
Checksums-Sha1:
 857541ba1a3557ee7651b30e52de0b70873da42d 2334 golang-k8s-metrics_0.36.5-1.dsc
 b75708d30ec891f8b547e40a9102102ffef9645c 59993 golang-k8s-metrics_0.36.5.orig.tar.gz
 9fec0afe0f341d21989f09c11c12b6b8703c2d65 2688 golang-k8s-metrics_0.36.5-1.debian.tar.xz
 3fec776ea26adc9f1acc617b0c9361e3a4c8730f 10830 golang-k8s-metrics_0.36.5-1_amd64.buildinfo
Checksums-Sha256:
 669f48475392106fbfd2f82d7051d8bb7dd195c44aa7b7e2b06ef6bb79175f68 2334 golang-k8s-metrics_0.36.5-1.dsc
 7af696c92d3370221360549032aed696127640ea91035a8233c6f4c15f3dbd42 59993 golang-k8s-metrics_0.36.5.orig.tar.gz
 74bee172eb60501d31606a11423869d309ddb11d5b2db7c1e0b2f84a9f678a5e 2688 golang-k8s-metrics_0.36.5-1.debian.tar.xz
 6a233dc3d66dfa99e2fcbce1c7776385f425af0030980b3f01a7fe5c92c51a2a 10830 golang-k8s-metrics_0.36.5-1_amd64.buildinfo
Files:
 e963db57f70e6b6815f4e40870be8e5e 2334 golang optional golang-k8s-metrics_0.36.5-1.dsc
 013d1eeeb96d71c0374c93d7681e2557 59993 golang optional golang-k8s-metrics_0.36.5.orig.tar.gz
 bd9eb79bbcaff4c48cbd8682b72b8116 2688 golang optional golang-k8s-metrics_0.36.5-1.debian.tar.xz
 aab478cfa904f5d028318bfc69b8aa36 10830 golang optional golang-k8s-metrics_0.36.5-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEECOt4p/pKieBdXIaey86ybZa5jLsFAmq6nMIUHGFydGh1cmJk
QGRlYmlhbi5vcmcACgkQy86ybZa5jLtX7Q//VAdSL0+BlqtDYmS7RMi4Xbai89s6
H8vP/UFdROP0H1Bn1PVWOnSoEmWNw5suyZBINp46IcVbymkjzDWDArLbTXVOyIp+
HJzzU72c7gPfAhbiBUHporGxOuVzjiywCAEwmlR6u1oRf/ReP+sRWHhrwAEx4lrg
FFrc5KTdwX/JJ01yuTJV90Xk4Aa7C5GZhtWDsbOlRSyxPc6yo+kiLp7LXO5N20a4
be/H6gucoTIozCPq7LZxK8lpF3O37R0gwiTyxx934SFEyHiWFicWRXWFgrvq3a5d
HsVj9+arjWr+UUWTOOH00eZJaO7iMI2AVH2Ux8yM76MvbD9eDkCwiog2be1IcL0a
CMj8Xsj4fMRDrQzwKVU2W7hBX+RDAVveDYCoNYil9jmu+/fXGkMUVc/I62QHiEjp
zh1X2x+fN5G18Emd63RMOVsDEQWeob7799ZHntMVXt8CKHC5bQBSzxPIKV8UMkp4
yXzKGrlJG51aQwMGeVKgq1fbLISafk1oj0oKtzwTg5JsHuUhv5tIjE5dE37bYBj/
UiOL6zu2690h5xpGLEAJHHOC++HQXChye2PJyGBZ+C9N3cXDTSkruMD/7IKvQOq6
as79lQDsFvK5s7/cK1cTIO9loiJ7HuryAp/a6JZJIebV8p25UvTj8fasjhuNy3gF
dOKakAIS9YT+8xM=
=Koc7
-----END PGP SIGNATURE-----