On 08/07/2025 17:27, Simon Josefsson wrote:
Hi
I am working on updating 'cosign' from v2.5.0 but recent versions
started to depend on unpackaged sigstore-rekor-tiles
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108960
which depends on unpackaged transparency-dev-trillian-tessera
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1102648
which fails to build
https://salsa.debian.org/jas/golang-github-transparency-dev-trillian-tessera/-/jobs/7416980
because of missing google-cloud-dev spanner/ sub-directory:
src/github.com/transparency-dev/trillian-tessera/storage/gcp/gcp.go:43:2: cannot find
package "cloud.google.com/go/spanner"
which presumably only exists in newer golang-google-cloud-dev releases,
but updating that package seems complex:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991942#32
Does anyone have ideas how to proceed here?
Just brainstorming...
Vendoring but as part of the .orig tarball, instead of .debian tarball.
Breaks gbp-import-orig, needs a lengthy d/copyright, but might be easier
than packaging one-dependency-dev-only sources.
I don't recall seeing any recent discussion, but presumably it affects
many packages.
I suppose one could back-port the necessary spanner/ files, but I reckon
that will get ugly...
Did anyone attempt to build the most latest google-cloud release?
/Simon
--
Regards,
Ahmad
