Re: discovering no longer necessary Build-Depends?

[Shengjing Zhu <zhsj@debian.org>]

On Fri, Nov 8, 2024 at 4:59 PM Simon Josefsson <simon@josefsson.org> wrote:
>
> All,
>
> For some reasons I had a look at the golang-ed25519-dev package in
> Debian and wanted to understand who used it (since it is obsolete), and
> noticed that 'riseup-vpn' referred to it in Build-Depends but at some
> upstream release it must have stopped using it.  There seems to be no
> references to that library namespace in the latest current release.  So
> rebuilding the package without that Build-Depends works fine, and I did
> an upload of 'riseup-vpn' to reduce the number of build-depends of
> golang-ed25519-dev.
>
> However this seems like a generic problem, and I worry that there is a
> large number of no longer necessary Build-Depends for Go packages.
>
> Is that the case?  Thoughts?
>
> Are there any tools or linters to discover possibly no longer relevant
> Build-Depends for Go packages?  Any thoughts on how one could be
> created?  It could be a lintian plugin, so every packager will notice
> it, but maybe it is too difficult to write one for lintian.  A salsa
> pipeline job is another idea.
>
> I don't recall seeing this concern discussed in the go packaging team
> documentations, but pointers welcome.

`dh-make-golang check-depends` can help but dh-make-golang needs more
volunteers to help the development :/

The basic idea is comparing the build-deps with the go.mod file.

-- 
Shengjing Zhu