Shengjing Zhu <z...@debian.org> writes: > On Fri, Nov 8, 2024 at 4:59 PM Simon Josefsson <si...@josefsson.org> wrote: >> >> All, >> >> For some reasons I had a look at the golang-ed25519-dev package in >> Debian and wanted to understand who used it (since it is obsolete), and >> noticed that 'riseup-vpn' referred to it in Build-Depends but at some >> upstream release it must have stopped using it. There seems to be no >> references to that library namespace in the latest current release. So >> rebuilding the package without that Build-Depends works fine, and I did >> an upload of 'riseup-vpn' to reduce the number of build-depends of >> golang-ed25519-dev. >> >> However this seems like a generic problem, and I worry that there is a >> large number of no longer necessary Build-Depends for Go packages. >> >> Is that the case? Thoughts? >> >> Are there any tools or linters to discover possibly no longer relevant >> Build-Depends for Go packages? Any thoughts on how one could be >> created? It could be a lintian plugin, so every packager will notice >> it, but maybe it is too difficult to write one for lintian. A salsa >> pipeline job is another idea. >> >> I don't recall seeing this concern discussed in the go packaging team >> documentations, but pointers welcome. > > `dh-make-golang check-depends` can help but dh-make-golang needs more > volunteers to help the development :/ > > The basic idea is comparing the build-deps with the go.mod file.
Thanks, that worked fine for a couple of packages! And found real examples, including golang-ed25519-dev. I'll try to integrate use of this in my personal go packaging workflow, maybe a pbuilder hook is sufficient. /Simon
signature.asc
Description: PGP signature
