golang-opentelemetry-contrib-dev installs Go source whose imports cannot be
satisfied by anything in the archive, so any package importing it fails to
build. The visible victim today is golang-opentelemetry-auto (ITP #1136684),
which reaches it through pipeline/otelsdk.
The -dev package installs 155 files under detectors/, including
detectors/autodetect, detectors/docker and detectors/hetzner, even though
"detectors" is listed in DH_GOLANG_EXCLUDES: d/rules sets
DH_GOLANG_EXCLUDES_ALL := 0, so the excludes only skip the build, not the
installation. The result is source that is shipped but never compiled, and
whose dependencies are therefore never declared in Depends.
detectors/autodetect imports all the registered detectors, and two of them
cannot be satisfied in unstable:
* detectors/docker imports github.com/moby/moby/client,
github.com/moby/moby/api/types/container and .../api/types/system.
No package in unstable provides github.com/moby/moby: golang-github-docker-
docker-dev 28.5.2+dfsg4-5 provides github.com/docker/docker, because Debian
has not yet followed the upstream module rename. The interim packages for
the new paths are ITP #1149066 (golang-github-moby-moby-api) and
ITP #1149067 (golang-github-moby-moby-client); the full picture is in
https://salsa.debian.org/mendezr/docker/-/wikis/Docker29Transition
* detectors/hetzner imports github.com/hetznercloud/hcloud-go/v2/hcloud/metadata.
golang-github-hetznercloud-hcloud-go-dev 2.4.0-2 installs that code under
github.com/hetznercloud/hcloud-go, without the /v2 element the module
requires, and upstream is at 2.47.0. Filed separately against
golang-github-hetznercloud-hcloud-go-dev.
This is not new in 1.46.0-1 alone: 1.43.0-1 already shipped 66 files under
detectors/, and its autodetect already imported the aws, azure and gcp
detectors, whose dependencies are not in Depends either. What 1.46 adds is an
import that cannot be satisfied at all.
Plan on the packaging side:
1. 1.46.0-3 drops detectors/docker and detectors/hetzner from the registry in
detectors/autodetect and stops installing those two directories, as
scaffolding, with the patch referring to the bugs above so it is reverted
once the dependencies land.
2. The detectors whose dependencies are already in unstable (aws, azure/azurevm,
gcp, ibmcloud/vpc, k8sapi, vultr) get built, tested and declared, instead of
being shipped unbuilt.
3. An autopkgtest checks that every Go package the -dev installs resolves its
imports with only its declared Depends installed. dh_golang_autopkgtest only
rebuilds what the package built, which is why this class of problem reached
unstable unnoticed.