trivy needs these five packages to build. I own its ITP, https://bugs.debian.org/929458, and I am packaging its missing dependencies now:
golang-github-knqyf263-go-deb-version https://bugs.debian.org/1145737 golang-github-knqyf263-go-apk-version https://bugs.debian.org/1145824 golang-github-knqyf263-go-rpm-version https://bugs.debian.org/1147066 golang-github-masahiro331-go-mvn-version https://bugs.debian.org/1146921 golang-github-sassoftware-go-rpmutils https://bugs.debian.org/1146983 grype (ITP https://bugs.debian.org/1061720) also needs go-deb-version, go-apk-version and go-mvn-version, and syft (ITP https://bugs.debian.org/1124819) needs go-rpmutils. Please don't ask for their removal from unstable. They get a reverse dependency again when trivy is uploaded, and then these bugs can be closed. Two more trivy dependencies went this way in October, golang-github-knqyf263-nested and golang-github-zclconf-go-cty-yaml. I am re-introducing both. Juan
