Debian carries 0.11.0. Three packages currently being prepared need 1.6.3,
which is what their go.mod files ask for:

  github.com/hashicorp/terraform-plugin-log   ITP https://bugs.debian.org/1148780
  github.com/hashicorp/aws-sdk-go-base        ITP https://bugs.debian.org/1148134
  github.com/hashicorp/go-getter              reintroduction, needed by syft

and through go-getter, syft itself (ITP https://bugs.debian.org/1124819).

Jani Heikkinen did the 1.6.3 packaging. It is on salsa as four merge requests,
split for review as Geert Stappers asked, each one built in a clean unstable
chroot:

https://salsa.debian.org/go-team/packages/golang-github-hashicorp-go-hclog/-/merge_requests/3
https://salsa.debian.org/go-team/packages/golang-github-hashicorp-go-hclog/-/merge_requests/4
https://salsa.debian.org/go-team/packages/golang-github-hashicorp-go-hclog/-/merge_requests/5
https://salsa.debian.org/go-team/packages/golang-github-hashicorp-go-hclog/-/merge_requests/6

They are stacked rather than independent because master does not build on its
own: TestLogger fails on 0.12.0, which is why the tree has sat at
0.12.0-1 UNRELEASED since 2020. The first MR carries a patch of Jani's for a
test that newer encoding/json breaks, and the pristine-tar entry for 1.6.3,
which was missing.