Contents
Debian Go Team Sprint at DebConf26
The Debian Go Packaging Team is organizing a dedicated sprint during ?DebConf26 in Santa Fe to transition our packaging workflow, and toolchain toward to modern Go Module-Aware Builds. This is a critical transition planned for the upcoming forky release cycle.
Historically, Debian has built Go packages using in GOPATH mode with GO111MODULE=off. This outdated approach brings unexpected and insecure compatibility debug defaults into final binaries.
By migrating fully to modern Module-Aware Go Builds using dh-golang version 1.66. We may respect upstream's code and simplify dependency management, and eliminate manual override workarounds, eg: in incus and openvpn-auth-oauth2 packages..
This sprint is an excellent opportunity for both long term Go packagers and new contributors(with upload permission) looking to get involved with the Go team to help modernize a major golang ecosystem transition within Debian.
Logistics
Organized by: ajqlee
Location: Venue hacklabs / online hybrid (communication via mailing list. daily sync on 3pm in hacklab.)
Mailing List: debian-go@lists.debian.org
IRC Channel: #debian-golang on OFTC
Coordination Page: Teams/DebianGoTeam
Main Goals
Modernize the Build System for Forky
We will work through the entrie archive for all golang related -dev packages and also packages ship with executable binaries.
Phase 1: Ensure all golang related -dev package ships go.mod
We start to ship go.mod file from the main module and all the submodules since dh-golang version 1.64. Due to all the -dev packages are Architecture: all, so we can not do binNMU but source upload.
Here is a list of work needed packages:
https://wiki.debian.org/DebConf/26/Sprints/DebianGoTeam/DevPackages
Phase 2: Test and Stabilize dh-golang 1.66+
We plan to gather practical feedback on the latest dh-golang version 1.66 releases from experimental. Sprint attendees will help build and test complex packages against the updated dh-golang, identify regressions, and document clear upgrade paths golang package maintainers.
List of all golang related package which ships executable binary:
https://wiki.debian.org/DebConf/26/Sprints/DebianGoTeam/GoModBuilds
List of known dh-golang issues that need to be fixed before uploading to upstable:
https://wiki.debian.org/DebConf/26/Sprints/DebianGoTeam/Known-dh-golang-issues
Helper Tools Enhancement
Lintian
We make lintian to detect package ships executable binaries with unexpected GODEBUG settings. Our goal is to clean up golang packages which carries GODEBUG settings to prevent unexpected behaves and insecure default across the whole archive.
Submitted and Merged by Nilesh: Add a new check to detect DefaultGODEBUG in golang binaries: https://salsa.debian.org/lintian/lintian/-/merge_requests/755
Since we switch to Module-Aware Builds. The XS-Go-Import-Path: in debian/control should matches with upstream's Go import path from go.mod file.
Submitted by Nilesh:New tag: xs-go-import-path-differs-from-module-path: https://salsa.debian.org/lintian/lintian/-/merge_requests/757
Since go import path are the only indentification to Go compiler in modern Module-Aware Builds. We should make the source/binary package name matches with upstream's go import path in it's go.mod file. So that dh-golang may not confused while resolve it's module mapping for offline builds. Need to add a lintian check with package name. If the path contains /v? number. The number should also reflect on it's source and binary package name.
- Awaiting Merge request
dh-make-golang
In module-aware builds, each Go module import path including its major version suffix must be matches to it's corresponding Debian source and binary package names. For example, a module at path [github.com/foo/bar/v3](https://github.com/foo/bar/v3) should produce golang-github-foo-bar-v3-dev instead of dropping the major version.
We need tooling enhancements in dh-make-golang to automate this mapping, to repair it's package names on existing packages.
Automatic Package Renaming
Source and Binary Naming: When generating a new package configuration, dh-make-golang must parse the root go.mod path. If a major version suffix equal to v2 is present, it must append that version to both the source package and the -dev binary package name (e.g., golang-github-user-repo-v2-dev).
Control Metadata Alignment: The tool must automatically update it's vcs-tags for corresponding new source package name in debian/control file.
Automated Dependency Correction (Build-Deps and Depends)
Dependencies Parsing: The tool should read the require block of the target package's go.mod file.
Package Name Resolution: For each require module, the tool must lookup the correct Debian -dev package name. If the dependency specifies a versioned path (like v2), it must map that requirement to the versioned Debian package name (golang-...-v2-dev) rather than falling back to the unversioned legacy name.
Mass Refactoring Script for Reverse Dependencies
We need a dedicated helper script (e.g., dh-golang-fix-deps) capable of scanning an existing source tree, reading its go.mod requirements, and automatically patching debian/control or print out detected correction for replace legacy unversioned Build-Depends with versioned -dev package name.
How to Join
Whether you are attending ?DebConf26 in person or participating remotely, you are welcome to help us hack.
If you are joining in person, look for us in the hacklabs during DebCamp. We will coordinate specific meeting times and send to mailing list later.
If you are participating remotely, you can pick up packaging tasks, run local build tests using dh-golang from experimental, and report your issues on the mailing list. Please list your name below if you plan to join the effort.
Build Aware Builds Migration FAQ
Participants
- ajqlee (In-person)
- gibmat (In-person)
- cipriano (In-person)
- eamanu (in-person)