# Notes for the Debconf19 Go Packaging Team BoF

To attend remotely, please get video feed from https://debconf19.debconf.org/schedule/venue/3/
and join #debconf-videoconferencia

People present (please add yourself)
- nodens
- zhsj
- Tina
- zigo
- brother
- rajudev
- utkarsh2102
- jmkim

## Topics
(Please add whatever you want to talk about)
- Go library transition and rebuild
  We have ignored this, but as we see in the buster freeze phase, the release team is not happy with this.
  + Rebuild in security archive
     This should be fixed in bullseye cycle anyway, or the Go stuff will be removed.
  See #928026 + 921284   
- Migrate away Built-Using, it's now against policy. Use something like X-Go-Built-Using, rust team uses X-Cargo-Built-Using
  How to do it? change all packages' debian/control file?
- Go mod? IIRC, there's problem to build with go mod. What if GOPATH is deprecated by upstream(go1.13 will deprecate GOPATH)
  https://blog.golang.org/modules2019
  https://github.com/golang/go/issues/29410
  update: it should work and needs change in dh-golang, see last comment by stapelberg

- "Workflow Change" (https://go-team.pages.debian.net/workflow-changes.html) status update ? Can we consider it final now ? If not, what is missing ?
- #930176 dh-golang: support cross building go packages
- #872423 dh-golang: Please build -dev packages only in stage1 to break build-dependency loop
- sonames/multiple api versions
- Document and making sure that the existing documentation is up to date


- updating and development of dh-make-golang


## Notes

security problem
1. security archive didn't share orig tarball with ftpmaster, so the security team can't schedual binNMU in security archive.
   The problem is from dak, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823820
   We can probably workaroud this, by manually upload all changelog-only packages to security master
   And we need some scripts to figure out which packages need rebuild
   See also: https://lists.debian.org/debian-release/2018/07/msg00030.html
   From moritzm:
      "Torsten Alteholz wrote a script to detect rebuilds (not checked whether it's working/useful), but the archive handling of tarballs is still a showstopper"
      "essentially someone need to commit to some work on dak (or find someone to do the work)"
2. cross build
   review the patch?
3. break loop build-dependency
   add stage1 profile. Just copying source files in stage1? and running go {build,install} in stage2
4. workflow change
   since 2017
   *agreed to be made official policy of the team*
   meeting to be arranged on ML for working on documentation and tooling fixes
5. CI to build reverse dependency
   salsa-ci-team is trying to provide tools
6. policy for mulitple version
   we need policy for multiple API versions to be co-installable
   multiple version in Go, it would take many work. same X-Go-Import? How to teach dh-golang?
   Tina> My answer to that has been to patch the import path so it is effectively a different pacakge.