Hey, yes! I am on it. Merge request: https://salsa.debian.org/go-team/packages/golang-github-theupdateframework-go-tuf/-/merge_requests/2
I was waiting on the pipelines to be green before answering. It is still running, but in case you want to have a look later. I could reproduce it, and the cause is in go-tuf. The cause: Since -2, v0 is installed at github.com/theupdateframework/go-tuf/v0 with its own go.mod, which says "module github.com/theupdateframework/go-tuf/v0". I missed it because go-tuf builds with dh-golang, which never reads go.mod, and so do the reverse dependencies I rebuilt (sigstore, sigstore-go). From now on I check that every installed go.mod parses at its own path, and I rebuild at least one dh-go reverse dependency. Cheers, Juan El viernes, 23 de octubre de 2026 a las 18:14, Otto Kekäläinen <[email protected]> escribió: > Hi! > > Thanks for reporting. We did do a reverse deps build test before > upload > (https://salsa.debian.org/go-team/packages/golang-github-theupdateframework-go-tuf/-/pipelines/1196043) > and both sigstore packages built fine. Interesting to learn that this > distrobuilder was also dependant of it. > > Juan: Can you look into it? >
