On 08/07/2025 17:27, Simon Josefsson wrote:
Hi I am working on updating 'cosign' from v2.5.0 but recent versions started to depend on unpackaged sigstore-rekor-tiles https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108960 which depends on unpackaged transparency-dev-trillian-tessera https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1102648 which fails to build https://salsa.debian.org/jas/golang-github-transparency-dev-trillian-tessera/-/jobs/7416980 because of missing google-cloud-dev spanner/ sub-directory: src/github.com/transparency-dev/trillian-tessera/storage/gcp/gcp.go:43:2: cannot find package "cloud.google.com/go/spanner" which presumably only exists in newer golang-google-cloud-dev releases, but updating that package seems complex: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991942#32 Does anyone have ideas how to proceed here?
Just brainstorming... Vendoring but as part of the .orig tarball, instead of .debian tarball.Breaks gbp-import-orig, needs a lengthy d/copyright, but might be easier than packaging one-dependency-dev-only sources.
I don't recall seeing any recent discussion, but presumably it affects many packages. I suppose one could back-port the necessary spanner/ files, but I reckon that will get ugly... Did anyone attempt to build the most latest google-cloud release? /Simon
-- Regards, Ahmad