Dear maintainer:

During a rebuild of all packages in unstable, this package failed to build.

Below you will find the last part of the build log (probably the most
relevant part, but not necessarily). If required, the full build log
is available here:

https://people.debian.org/~sanvila/build-logs/202610/

About the archive rebuild: The build was made on virtual machines from AWS,
using sbuild and a reduced chroot with only build-essential packages.

If you cannot reproduce the bug please contact me privately, as I
am willing to provide ssh access to a virtual machine where the bug is
fully reproducible.

If this is really a bug in one of the build-depends, please use
reassign and add an affects on src:distrobuilder, so that this is still
visible in the BTS web page for this package.

Thanks.
--------------------------------------------------------------------------------
[...]
dh_auto_build: warning: package does not provide 'go.mod', please add it.
go: errors parsing go.work:
_build/go.work:1661: replace github.com/theupdateframework/go-tuf/v0: invalid module path
	cd _build && go install -trimpath -v -p 2
go: errors parsing go.work:
go.work:1661: replace github.com/theupdateframework/go-tuf/v0: invalid module path
dh_auto_build: error: cd _build && go install -trimpath -v -p 2 returned exit code 1
make: *** [debian/rules:8: binary] Error 255
dpkg-buildpackage: error: debian/rules binary subprocess failed with exit status 2
--------------------------------------------------------------------------------

control: reassign -1 golang-github-theupdateframework-go-tuf 2.4.2+0.7.0-2
control: affects -1 src:distrobuilder

  distrobuilder has switched to module-aware builds via Build-Depending
on dh-go. The recent upload of golang-github-theupdateframework-go-tuf
made some changes to XS-Go-Import-Path and how its sources are
installed, which is now causing a build error for distrobuilder.

  distrobuilder is affected via an indirect dependency on golang-
github-theupdateframework-go-tuf (not sure exactly what one right off
hand); there's no reference to this library anywhere in its code or
go.mod file.

Mathias

Hey, yes! I am on it.

Merge request: https://salsa.debian.org/go-team/packages/golang-github-theupdateframework-go-tuf/-/merge_requests/2

I was waiting on the pipelines to be green before answering.
It is still running, but in case you want to have a look later.


I could reproduce it, and the cause is in go-tuf.

The cause: Since -2, v0 is installed at github.com/theupdateframework/go-tuf/v0 with its own go.mod, which says "module github.com/theupdateframework/go-tuf/v0".

I missed it because go-tuf builds with dh-golang, which never reads go.mod, and so do the reverse dependencies I rebuilt (sigstore, sigstore-go). From now on I check that every installed go.mod parses at its own path, and I rebuild at least one dh-go reverse dependency.

Cheers,

Juan



El viernes, 23 de octubre de 2026 a las 18:14, Otto Kekäläinen <otto@debian.org> escribió:

Hi!

Thanks for reporting. We did do a reverse deps build test before
upload (https://salsa.debian.org/go-team/packages/golang-github-theupdateframework-go-tuf/-/pipelines/1196043)
and both sigstore packages built fine. Interesting to learn that this
distrobuilder was also dependant of it.

Juan: Can you look into it?

  Thanks for the quick investigation and fix! :) I know we're in kind
of a pseudo-transition period where some Go packages have switched over
to dh-go in their Build-Depends; as we collectively get more experience
with the module-aware builds I think we'll become familiar with common
errors or other issues that may crop up.

  Yeah, somewhere in the dependencies of distrobuilder go-tuf
exists.... it's interesting to note that `build-rdeps golang-github-
theupdateframework-go-tuf-dev` does report 26 reverse dependencies for
this library, and distrobuilder is among them. I know that command is
also reporting more than immediate, first-level dependencies too.

Mathias

The fix is still waiting for a sponsor:
https://salsa.debian.org/go-team/packages/golang-github-theupdateframework-go-tuf/-/merge_requests/2
Its pipeline is green.

The bug also breaks other dh-go builds. grype 0.119.0 (ITP
https://bugs.debian.org/1061720), which gets go-tuf through sylabs-sif and
sigstore, fails the same way in a clean sid chroot today:

    go.work:1712: replace github.com/theupdateframework/go-tuf/v0: invalid module path

With -3 from the merge request, grype builds again and its 5827 tests pass.

Could someone from the team merge and upload it?

Hello,

Bug #1151720 in golang-github-theupdateframework-go-tuf reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/go-team/packages/golang-github-theupdateframework-go-tuf/-/commit/aca4c7136ae4dca8619ad45738c69822d05bbc88
------------------------------------------------------------------------
Do not install the go.mod of v0

It names the module github.com/theupdateframework/go-tuf/v0. Go rejects
/v0 as a major version suffix, and dh-go copies the name into a replace
directive in go.work, so every dh-go build with this package installed
fails.

Closes: #1151720
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1151720

We believe that the bug you reported is fixed in the latest version of
golang-github-theupdateframework-go-tuf, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151720@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Juan Manuel Méndez Rey <juan.mendezr@proton.me> (supplier of updated golang-github-theupdateframework-go-tuf package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 23 Oct 2026 17:42:27 +0200
Source: golang-github-theupdateframework-go-tuf
Architecture: source
Version: 2.4.2+0.7.0-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Closes: 1151720
Changes:
 golang-github-theupdateframework-go-tuf (2.4.2+0.7.0-3) unstable; urgency=medium
 .
   * Team upload.
   * Do not install the go.mod of v0. It names the module
     github.com/theupdateframework/go-tuf/v0, which is not a valid module
     path, and dh-go builds failed on it (Closes: #1151720).
Checksums-Sha1:
 1e6229801088f85b63bcfa5996629ff4efe5c650 3103 golang-github-theupdateframework-go-tuf_2.4.2+0.7.0-3.dsc
 8e79f94b94b46bd774e2f7a88fba04da7cc139a6 6900 golang-github-theupdateframework-go-tuf_2.4.2+0.7.0-3.debian.tar.xz
 5aec54d6373f61a811cf98e8e54dffafefcbd009 7166 golang-github-theupdateframework-go-tuf_2.4.2+0.7.0-3_source.buildinfo
Checksums-Sha256:
 04a45ef523f4bce2883b474d808a37ac432766eb618adb835e69ede4efea6a52 3103 golang-github-theupdateframework-go-tuf_2.4.2+0.7.0-3.dsc
 52158cd9c16e9165a6bed8e4275e7cc3a9bd9aabae6812e6e2375669a2caf310 6900 golang-github-theupdateframework-go-tuf_2.4.2+0.7.0-3.debian.tar.xz
 bd377e9cc43b0b17b328a63e6b36c49ac862d7d37347be24f79e1d32d63de704 7166 golang-github-theupdateframework-go-tuf_2.4.2+0.7.0-3_source.buildinfo
Files:
 4a208c94ddaf91f03f8bddd7ae27de6b 3103 golang optional golang-github-theupdateframework-go-tuf_2.4.2+0.7.0-3.dsc
 131e314e8595ad70cdf8513aa13f1125 6900 golang optional golang-github-theupdateframework-go-tuf_2.4.2+0.7.0-3.debian.tar.xz
 de79455a83e4260a16edd29fbbbd627d 7166 golang optional golang-github-theupdateframework-go-tuf_2.4.2+0.7.0-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmrepckACgkQ4n8s+EWM
L6TE3w/8DObl2O6cA1CAdEVg0bEFlwM4Zm4iys+1keLNLInC2zRSxV2n2Q5YklzD
SgNglU2ffvtN0Mzmh5SMAMMWrZmuIaoY+KGiNSSCE7FJGITs31DkgqTH9iOj4KJH
oyxMyahPxKBTHeREH7fGqlLuWAUnFJo1nJXVnTmMr3fGkQO4Bd7e5B+LJ4Q22Rs2
Si0WOtmMC1jVTdELV59RJg1vj+S+FFqUmoOMUJYCpYADmECN+CTERAl2BoU7yEDz
qtCFq0bSc4V9tBmzldWOyv+Vw04/28tIR2g7uErYUj+E9lRkcTI2AJmvHsGxFZFz
8EKTK3EkTS2FU2AaQ68TBzy4ANbS+KZWQKxGAoWe2kUONl1OVTCPRNkFlI2SBa30
8JMlcHEoJ2qhoe0RgMWtQpohqn+3CSlr1SvwRl0Odn9JTbmKB/hi8DIUiDdPM6Ju
rX8YCWA0kN1Nx7pdecM2awZ87uJdms4lScA4xBMLaCbzrgCeAqNfmNxuG6exUl5H
+ihBEZC3V9oXnS9czOWe1SsF89PyiSzUPJtA3BUHOt1ltp/U5vJY6/uHrjkQIop0
OgWAnWmVNwF6W3WmFRbo8bNGodHrgHZp5mbtr8XrWHFL7DmrENQKyNMTgyqyoeyx
lTFI51ihrXTjIHGitO+k9wMvqVibbOSfNNqYdIjiGKiGG9+e1UY=
=xbjg
-----END PGP SIGNATURE-----