Hello team, This is Juan! Nice to meet you.
I will go straight to the two questions 1. I am packaging syft [1] (SBOM generator, ITP #1124819) and grype [2] (Vulnerability scanner ITP #1061720) Upstream: github.com/anchore/syft and github.com/anchore/grype respectively. A DD sponsored an upload of syft, but FTP master rejected it [3], citing excessive vendoring as the primary blocker. I would like the Go Team's guidance before reworking the package. The vendoring situation (syft 1.42.4): - 319 Go modules in vendor/, 342 MB (88% of the source tree) - 210 modules are already packaged in Debian - 114 modules are not yet packaged The FTP master gave us the following feedback: the vendor tree must be "significantly reduced by utilizing existing Debian libraries. Recently I contacted another DD in the Monday Jitsi meetings that pointed me to icingadb package : I note that src:icingadb fully vendors all 27 of its Go dependencies (54 MB) via a component tarball and was accepted into the archive. I understand the scale difference is significant (27 vs 319 modules), but the architectural question is the same: how should a Go application with many unpackaged dependencies be handled? What approach does the team recommend? (a) Package all 114 missing dependencies first, then upload syft with zero vendoring? (b) Use Build-Depends for the 210 already-packaged modules and vendor only the 114 missing ones (via component tarball or reduced vendor/)? (c) Vendor everything but use a component tarball like icingadb? go:embed complication: syft uses go:embed extensively. dh-golang operates in GOPATH mode and creates symlinks, but go:embed rejects symlinks. This is why the current packaging uses direct go build with -mod=vendor instead of dh-golang. Is there an established workaround within the team's workflow? 2. Another final topic: Joining the Go Team: I would like to maintain syft and grype under the Debian Go Packaging Team long term. Both packages are on salsa: - https://salsa.debian.org/mendezr/syft.git - https://salsa.debian.org/mendezr/grype.git What is the process for joining the team? Thank you for any guidance. Juan Manuel Méndez Rey
