Hi Rekor needs a newer version of golang-github-asaskevich-govalidator: github.com/sigstore/rekor/cmd/rekor-cli/app # github.com/sigstore/rekor/cmd/rekor-cli/app src/github.com/sigstore/rekor/cmd/rekor-cli/app/validate.go:45:16: undefined: validator.IsSHA512 src/github.com/sigstore/rekor/cmd/rekor-cli/app/validate.go:70:16: undefined: validator.IsSHA256 src/github.com/sigstore/rekor/cmd/rekor-cli/app/validate.go:92:16: undefined: validator.IsSHA1 Debian's current version of golang-github-asaskevich-govalidator is 9+git20180720.0.f9ffefc3-1.1 last uploaded on 2021-01-08 and the latest upstream 11.0.1 released on 2021-05-07 has the 'IsSHA1' etc symbols. I rebuilt the version we have in unstable including all reverse dependencies: https://salsa.debian.org/jas/golang-github-asaskevich-govalidator/-/pipelines/633461 There are two reverse dependencies that fails to build: crowdsec and receptor. Crowdsec was discussed earlier, it fails during self-tests, and there is a FTBFS bug report filed for it. Receptor was recently introduced, and looking at the build log, it fails during testing and it looks network timeout dependent. Jérémy, maybe you could try to increase the timeout delay even more? I tried the job twice in case this was spurious, but it failed both times: https://salsa.debian.org/jas/golang-github-asaskevich-govalidator/-/jobs/5235676 https://salsa.debian.org/jas/golang-github-asaskevich-govalidator/-/jobs/5235764 Then I updated golang-github-asaskevich-govalidator to upstream's version 11.0.1 and fixed several lintian complaints, and built reverse dependencies for the updated package: https://salsa.debian.org/jas/golang-github-asaskevich-govalidator/-/pipelines/633473 The crowdsec package fails again in self-tests, so presumably does not have any API incompatibility during build. The receptor package fails again, also in self-tests, but builds fine. The other reverse dependencies builds fine. The go-team pipeline passes too: https://salsa.debian.org/go-team/packages/golang-github-asaskevich-govalidator/-/pipelines Thus I felt reasonable confident that uploading golang-github-asaskevich-govalidator would not break anything, so I have uploaded it to experimental. I think it is ready to be uploaded into unstable too, but I'm not in a hurry since several other dependencies for rekor are stuck in experimental anyway. I hope to upload it into unstable eventually. Meanwhile, if anyone would like to test it from experimental, please do. /Simon
Attachment:
signature.asc
Description: PGP signature