Ahmad Khalifa <ahmad@khalifa.ws> writes: > On 02/10/2025 14:14, Simon Josefsson wrote: >> Naively I can think of two ways forward: >> 0) Somehow patch out this dependency from >> golang-github-transparency-dev-tessera. >> 1) ITP a golang-github-cenkalti-backoff-v5 for the new API and use >> it. >> 2) ITP a golang-github-cenkalti-backoff-v4 as a copy of the current >> packaging, update all reverse dependecies replacing >> golang-github-cenkalti-backoff-dev with >> golang-github-cenkalti-backoff-v4-dev, and then package v5 as >> golang-github-cenkalti-backoff-dev and use that in >> golang-github-transparency-dev-tessera. > > Couple more suggestions, not tested: > > 3) add v5 as an MUT in v5/ dir of backoff-dev. > > 4) vendor backoff v5 in tessera, it's only 6 source files. Good ideas, thank you! I like the 3) approach, but haven't done that before (unless you count my ugly golang-github-theupdateframework-go-tuf approach). I'll see if I can make something build out of it. Meanwhile, for tessera, I did a experimental upload of backoff-dev so solving this problem is not urgent so let's continue discuss and test various ideas. /Simon
Attachment:
signature.asc
Description: PGP signature