Hello Fede and others, I am also new to the build-reverse-dependencies via salsa-ci stuff.
I just forked the project and then ran build-reverse-dependencies via salsa-ci under my namespace. However, I got only 13 reverse-dependencies: https://salsa.debian.org/ajqlee/golang-github-hashicorp-go-version/-/pipelines/1036826 And my salsa-ci pipeline uses this recipes: https://salsa.debian.org/ajqlee/pipeline/-/blob/master/debian-go-ratt.yml Please let me know if it's okay to upload for Federico as all the 13 reverse-dependencies builds. Or correct me if I missed something. Best regards, -Andrew On Tue, Mar 3, 2026 at 2:38 AM Federico Grau <[email protected]> wrote: > > * bump * > > Checking again per next steps to upload v1.8.0 of > golang-github-hashicorp-go-version > to unstable. > > I had updated the copyright and performed my attempts at reverse build checks > that appeared mostly ok. > > Welcome guidance on additional steps I should take or other constructive > feedback. > > Respectfully, > donfede > > Fede Grau > > > On Thu, Jan 29, 2026 at 07:14:27PM -0500, Federico Grau wrote: > > Hello -- > > > > Kind thanks for the OOB feedback. I have updated debian/copyright of > > golang-github-hashicorp-go-version to match their upstream changes circa > > 2025-11. > > > > Checking per next steps to upload v1.8.0 of > > golang-github-hashicorp-go-version > > to unstable. > > > > Regards, > > donfede > > > > Fede Grau > > > > > > On Tue, Jan 27, 2026 at 07:57:43PM -0500, Federico Grau wrote: > > > > > > Greetings again debian-go team -- > > > > > > > > > I've completed "ratt" (0.0~git20250829.39528ce-1+b1) runs for > > > golang-github-hashicorp-go-version in my local build environment. > > > > > > It reports 19/20 reverse dependencies build OK, and errors with > > > "go-cve-dictionary". I have not pursued the go-cve-dictionary errors > > > (and am > > > not sure I'm the right person for that; at least for a couple months, > > > while I > > > finish "pat" updates). > > > > > > What might be the next best steps to progress > > > golang-github-hashicorp-go-version v1.8.0 to unstable (or alt path)? > > > Should a > > > bug report be filed for go-cve-dictionary or some email notice sent? Both > > > packages are maintained by the Debian Go Packaging Team. > > > > > > https://tracker.debian.org/pkg/go-cve-dictionary > > > > > > https://tracker.debian.org/pkg/golang-github-hashicorp-go-version > > > > > > https://manpages.debian.org/unstable/ratt/ratt.1.en.html > > > > > > > > > While I don't understand salsa.d.o gitlab CI very well, I had attempted > > > to run > > > a reverse dependency check on golang-github-hashicorp-go-version, which > > > seemed > > > to report a much higher number of reverse dependencies -- ~342 vs 20 by > > > ratt?!? It's possible I erred submitting the job or misinterpreted the > > > output. > > > > > > > > > https://salsa.debian.org/go-team/packages/golang-github-hashicorp-go-version/-/jobs/8894428 > > > > > > > > > https://salsa.debian.org/salsa-ci-team/pipeline/#build-reverse-dependencies > > > > > > > > > I welcome constructive feedback or suggested guidance on next steps, and > > > also > > > recognize other tasks may have priority near term. > > > > > > > > > Best, > > > donfede > > > > > > Fede Grau > > > > > > > > > On Wed, Jan 21, 2026 at 08:41:46PM -0500, Federico Grau wrote: > > > > > > > > Many thanks again for the constructive feedback Simon, > > > > > > > > > > > > (pardon my delayed response, I've been balancing other tasks) > > > > > > > > > > > > While I appreciate the feedback, this go-version effort is presenting > > > > some new > > > > scenarios to me, and I have some question responses before making more > > > > changes. > > > > > > > > > > > > a) debian/copyright > > > > > > > > While I was reviewing the go-version git diffs, I had observed "IBM" > > > > added as > > > > a copyright owner to upstream files ... but admit not understanding how > > > > to > > > > best proceed, and erroneously extended the debian/copyright years for > > > > the > > > > original author. > > > > > > > > Looking over the upstream git repo closer today, it seems circa > > > > 2025-Nov-03 > > > > that IBM copyright replaced previous Hashicorp copyrights for 2025 and > > > > also > > > > backdated to 2014. The license remains the same (MPL-2.0). > > > > > > > > > > > > https://github.com/hashicorp/go-version/commit/9325934670def5fb8afc1eb866fbbeba243f02ce > > > > > > > > > > > > https://github.com/hashicorp/go-version/commit/0824a8987d8bc2b76c928ccea7d8a4a4f0b6c9e0 > > > > > > > > *** Should debian/copyright likewise be edited, removing past > > > > references to > > > > "Mitchell Hashimoto <[email protected]>" and replacing them > > > > with > > > > "IBM Corp." or something else? *** > > > > > > > > > > > > > > > > b) ratt - reverse build tests > > > > > > > > I had not previously used ratt, but will explore it following the links > > > > below. > > > > Skimming the github page this looks like something I can test/run in my > > > > local > > > > build environment (gbp, sbuild). How would salsa CI fit into this, not > > > > clear > > > > what job to start or study? > > > > > > > > https://manpages.debian.org/unstable/ratt/ratt.1.en.html > > > > > > > > https://github.com/Debian/ratt > > > > > > > > > > > > > > > > c) upstream code changes? "Looks like some potential for API > > > > difficulties," > > > > > > > > I had read through the code changes via git diff, but am not an expert > > > > golang > > > > coder and may be overextending myself. > > > > > > > > > > > > Trying to look over these code and potential API changes closer, they > > > > seem > > > > mostly compatible but I'm still unclear if they may cause issues with > > > > other > > > > packages. Hopefully ratt will help. > > > > > > > > - new BenchmarkVersionString() functions should not be an issue > > > > - new Scan() functions for sql.Scanner should not be an issue > > > > - new constraintRegexp() functions are added, and constraintOperators > > > > var > > > > removed; unclear if this is publicly exposed > > > > - new getVersionRegexp() appears to return a similar type as old var > > > > - new equalSegments() function does not look like an issue > > > > > > > > > > > > # upstream CHANGELOG.md lists: > > > > v1.8.0 > > > > - Add benchmark test for version.String() in > > > > https://github.com/hashicorp/go-version/pull/159 > > > > - Bytes implementation in > > > > https://github.com/hashicorp/go-version/pull/161 > > > > > > > > v1.7.0 > > > > - Remove `reflect` dependency > > > > ([#91](https://github.com/hashicorp/go-version/pull/91)) > > > > - Implement the `database/sql.Scanner` and `database/sql/driver.Value` > > > > interfaces for `Version` > > > > ([#133](https://github.com/hashicorp/go-version/pull/133)) > > > > > > > > v1.6.0 - current Debian package > > > > > > > > > > > > > > > > Regards, > > > > donfede > > > > > > > > > > > > On Fri, Jan 16, 2026 at 05:17:14PM +0100, Simon Josefsson wrote: > > > > > Upstream added a copyright notice: > > > > > > > > > > https://salsa.debian.org/go-team/packages/golang-github-hashicorp-go-version/-/commit/a9da87e466345495e4bc89d5f38f5861aecc30cc#0398ccd0f49298b10a3d76a47800d2ebecd49859_1_1 > > > > > > > > > > You need to add it to debian/copyright. > > > > > > > > > > Otherwise looks good to me, but a reverse rebuild is necessary here. > > > > > Did you try ratt? > > > > > > > > > > We have used Salsa CI for this a couple of times for migrations, it > > > > > has > > > > > a 100 job limit. So please start a job like that. Did you review > > > > > upstream code changes? Looks like some potential for API > > > > > difficulties, > > > > > but let's hope for the best... > > > > > > > > > > /Simon > > > > > > > > > > Federico Grau <[email protected]> writes: > > > > > > > > > > > Hello again debian-go team -- > > > > > > > > > > > > > > > > > > I've updated package golang-github-hashicorp-go-version on > > > > > > salsa.d.o from > > > > > > v1.6.0 to v1.8.0 . > > > > > > > > > > > > > > > > > > https://tracker.debian.org/pkg/golang-github-hashicorp-go-version > > > > > > > > > > > > > > > > > > This is a dependency of the `pat' package I've been collaborating > > > > > > on. > > > > > > > > > > > > https://lists.debian.org/debian-go/2025/12/msg00012.html > > > > > > > > > > > > https://tracker.debian.org/pkg/pat > > > > > > > > > > > > > > > > > > The upstream changes were relatively minor. > > > > > > > > > > > > I also made some minor debian updates (standards [no changes], > > > > > > copyright > > > > > > years, watch [format v3 to v5 using uscan generator]). My review > > > > > > and testing > > > > > > appear ok. > > > > > > > > > > > > However, checking the reverse dependencies there appear to be ~342 > > > > > > other > > > > > > packages using golang-github-hashicorp-go-version. I do not want > > > > > > to create > > > > > > issues. > > > > > > > > > > > > > > > > > > https://salsa.debian.org/salsa-ci-team/pipeline/#build-reverse-dependencies > > > > > > > > > > > > > > > > > > As there are cycles I welcome review and constructive feedback if > > > > > > corrections > > > > > > are needed. If all is well may the package be upload to unstable? > > > > > > > > > > > > > > > > > > Regards, > > > > > > donfede > > > > > > > > > > > > Fede Grau > > -- -Andrew
