Nicolas Peugnet <[email protected]> writes: > On 22/04/2026 21:22, Simon Josefsson wrote: >> Package: wnpp >> Severity: wishlist >> Owner: Simon Josefsson <[email protected]> >> * Package name : golang-github-git-pkgs-packageurl-go >> Version : 0.3.0-1 >> Upstream Author : the purl authors >> * URL : https://github.com/git-pkgs/packageurl-go >> * License : Expat >> Programming Lang: Go >> Description : Go implementation of the package url spec >> Go implementation of the package url spec. >> https://salsa.debian.org/go-team/packages/golang-github-git-pkgs-packageurl-go >> https://salsa.debian.org/jas/golang-github-git-pkgs-packageurl-go/-/pipelines > > Do you really want to package this fork when the upstream package is > already in Debian [1]? > It seems that the only change is a performance optimization [2] that > has been proposed is a pull request already [3]. > > It is probably better to patch it out to use the upstream package > and/or contact the maintainer of the fork to ask them to do it (and > maybe tell them to use a "replace" directive [4] for development > instead).
Nice catch! I don't have any good answers. I opened https://github.com/package-url/packageurl-go/pull/86#issuecomment-4307078802 to get upstream input on this aspect, I think the decision pretty much depends on if the pull request is going to be accepted or not, right? Still, with modern tooling and rapid DFSG team, maintaining yet another package is not all that bottersome these days. The problem with not having both packages is that then we need to keep patching these forever to change namespace. I'm doing this for some build dependencies in the Sigstore ecosystem -- and I worry that some of the namespace patching is actually introducing unintended consequences (potentially with security or stability consequences), so I have a mild dislike of this approach. /Simon > [1] https://tracker.debian.org/pkg/golang-github-package-url-packageurl-go > [2] > https://github.com/package-url/packageurl-go/compare/master...git-pkgs:packageurl-go:master > [3] https://github.com/package-url/packageurl-go/pull/86 > [4] https://go.dev/doc/modules/gomod-ref#replace
signature.asc
Description: PGP signature
