Re: Using debian/vendor/ in Go packages?

[Jérémy Lal <kapouer@melix.org>]

Le jeu. 3 avr. 2025 à 09:59, Otto Kekäläinen <otto@debian.org> a écrit :

Hi,

Are people in the Go team always packaging every individual go.mod
require as a separate package? Or are people here occasionally
"vendoring" packages in e.g. debian/vendor/ to avoid polluting Debian
archives with tiny packages?

I am considering doing this in usql
(https://salsa.debian.org/go-team/packages/usql/-/merge_requests/1)
instead of uploading a dozen small packages to Debian.

i did find a couple of examples, but still raising this for discussion
to hear views.

https://sources.debian.org/src/prometheus/2.53.3%2Bds1-1/debian/vendor/
https://sources.debian.org/src/ncbi-entrez-direct/19.2.20230331%2Bdfsg-3/debian/vendor/
https://sources.debian.org/src/golang-webpki-org-jsoncanonicalizer/1.0.1-3/debian/vendor/

Hi

When there are dependencies that won't ever change for some reason, and that are useless to other packages,

you can copy them in debian/vendor/ (this typically happens with test dependencies using a deprecated module).

For dependencies that may be updated, but don't make sense to be packaged in Debian (not stable enough, or

used by almost no other modules), it makes more sense to make a multiple-upstream-tarball using "component" in watch file,

see uscan(1) and https://codesearch.debian.net/search?q=component%3Dgolang+path%3Adebian%2Fwatch

In any case debian/copyright must correctly index them.

Jérémy