debian/patches/0001-Use-xi2-xz-instead-of-fork.patch swaps the import in
internal/decompress/xz.go to github.com/xi2/xz, but go.mod still requires
github.com/therootcompany/xz. That was harmless under GOPATH. Under dh-go
anything that build-depends on golang-github-sylabs-squashfs-dev fails:

    src/github.com/sylabs/squashfs/internal/decompress/xz.go:7:2:
    module github.com/xi2/xz provides package github.com/xi2/xz and is replaced
    but not required

The patch also looks obsolete now. golang-github-therootcompany-xz-dev 1.0.1-1 is
in unstable, with github.com/therootcompany/xz as its import path, which is what
go.mod asks for. I dropped the patch and put that package in Build-Depends and
Depends in place of golang-github-xi2-xz-dev: it builds in a clean chroot with no
test failures. I can send that as a merge request.

I ran into this packaging stereoscope, which syft needs. go-git had the same
shape, https://bugs.debian.org/1149024.