[From nobody Wed Sep 2 18:57:05 2026 Received: (at submit) by bugs.debian.org; 26 Aug 2026 06:55:11 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-20.1 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,HAS_PACKAGE,PGPSIGNATURE,RCVD_IN_DNSWL_MED,SPF_HELO_PASS, SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 11; hammy, 120; neutral, 19; spammy, 1. spammytokens:0.860-+--shipping hammytokens:0.000-+--forky, 0.000-+--sk:golang, 0.000-+--sk:golang-, 0.000-+--H*ct:application, 0.000-+--H*ct:protocol Return-path: <simon@josefsson.org> Received: from uggla.sjd.se ([178.174.241.107]:36548) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <simon@josefsson.org>) id 1wz7XT-007FLB-1b for submit@bugs.debian.org; Wed, 26 Aug 2026 06:55:11 +0000 DKIM-Signature: v=1; a=ed25519-sha256; q=dns/txt; c=relaxed/relaxed; d=josefsson.org; s=ed2303; h=Content-Type:MIME-Version:Message-ID:Date: Subject:To:From:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description; bh=/x4GckNRD9wZFCVmdj+/ntA93yH4py9tW/aMRLecFyE=; t=1787727311; x=1788936911; b=GvpKlbPVCJGTUkikFj7pmtMNIP7dimF94KkVRr4UKDZKpEP Y1ZvtPNmkqprdtm11dbW3xtEuLO0j3QWyv+S8AQ==; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=josefsson.org; s=rsa2303; h=Content-Type:MIME-Version:Message-ID:Date: Subject:To:From:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description; bh=/x4GckNRD9wZFCVmdj+/ntA93yH4py9tW/aMRLecFyE=; t=1787727311; x=1788936911; b=nmiaI3BKLlrZprqYI62NSQOdCY1KF6AAJd0y5Hezs++r60i BhdUukRFc84xoTGjQsiyUASJ4lDLnbQc/gVUn1HTxA5/QH98bXPPQxqGlPxvs9VIrE4EEMwBGYU2d aCUhYoA3TkeDTMh5/Z2fHcLL5mHSWmk6SERZ3oGAhY+C6+WFSrtQoViIgqX03/sgLd6qaEWs+xhzh kEhpXspypjML8YEv70czKbyZbE2mjC1pwv3l8G9rPHBg79SIQocArQGXCuVqeYLsqHaw9On/sPJIK NQxoQ/XMDgLgQKgqUot6plTrn7gmhPdeNSvTLXIfPxMqtvzBPaXUbmzZXifPSDyyz2AafI/vMxIAI +HMLyWiBnoKvbpWZ/FbrXCwkOvIzM+RatG/2qMI+1EUl1Bj/LWDmE39IlWUl5iyDfcAbjOpESepYA Go9Rw4EDCf6b63dANVSUdVre; Received: from h-178-174-130-130.a498.priv.bahnhof.se ([178.174.130.130]:54932 helo=frallan) by uggla.sjd.se with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from <simon@josefsson.org>) id 1wz7XR-000rqi-Vw for submit@bugs.debian.org; Wed, 26 Aug 2026 06:55:10 +0000 From: Simon Josefsson <simon@josefsson.org> To: submit@bugs.debian.org Subject: keep golang-github-aead-chacha20 out of forky/testing and consider removal OpenPGP: id=B1D2BD1375BECB784CF4F8C4D73CF638C53C06BE; url=https://josefsson.org/key-20190320.txt X-Hashcash: 1:23:260826:submit@bugs.debian.org::cZJGIg/+nwSbTkUi:2djr Date: Wed, 26 Aug 2026 08:55:09 +0200 Message-ID: <87qzjl1icy.fsf@josefsson.org> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Delivered-To: submit@bugs.debian.org --=-=-= Content-Type: text/plain Package: golang-github-aead-chacha20 Severity: serious Hi! This package's upstream https://github.com/aead/chacha20 was archived in 2023 and as security-sensitive, we shouldn't be shipping this in forky. Consider removing this package from the archive. The reverse dependency golang-github-jedisct1-xsecretbox incorrectly depended on this package, it was long migrated to use normal Go crypto library in the upstream. I'm making an upload to drop the no longer needed dependencies. /Simon --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQOEBAEWCgMsFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAmqOjc0bFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyFBxzaW1vbkBqb3NlZnNzb24ub3JnwhwmAJgzBFyS zrQWCSsGAQQB2kcPAQEHQAiHK2SL4a8QwZCvX1fkJU5l8aNp2jmw7hrcOfGGsZTr tCVTaW1vbiBKb3NlZnNzb24gPHNpbW9uQGpvc2Vmc3Nvbi5vcmc+iJYEExYIAD4C GwMFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AWIQSx0r0Tdb7LeEz0+MTXPPY4xTwG vgUCaeH1kQUJDmvq3QAKCRDXPPY4xTwGvoViAP9ZUL6yXhpUKudJT+rZvfQ9cw8u ydbUN4WuMdCce65BUwD/YaVCrk75uptX18omVWGZbtviHfw6twiAGbzRflxK9gS4 MwRcks+BFgkrBgEEAdpHDwEBB0DsUwiDmnlwMSNoSF+ByvW0E6TVXou9PKDa9SpZ vKghioj1BBgWCAAmAhsCFiEEsdK9E3W+y3hM9PjE1zz2OMU8Br4FAmngltcFCQ5q i1YAgXYgBBkWCAAdFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAlySz4EACgkQUXIr CP5HRaKnTAEAoB+OWrHmYCK8Cjr1DgPUH7JnhPBmR2DbhR5jPRREEugA+gOMeWmL 6GOpaPfKYLcNhzw4ZnAlxSLY1wq1eANBpiQOCRDXPPY4xTwGvrOwAPoCCB6QQKQ6 XA49bCocw54Jqb8EH9FZB5nurPhBu6koKQEA3v1zK1NHND2t44vOXDKmYb8yThSP 7KHuutpcy9EGNwW4OARcks9qEgorBgEEAZdVAQUBAQdAMZUbpg1up2WOwPlQn3pP VaRMejyZnScmD7d5TRzHehwDAQgHiH4EGBYIACYCGwwWIQSx0r0Tdb7LeEz0+MTX PPY4xTwGvgUCaeCW1wUJDmqLbQAKCRDXPPY4xTwGvkTVAP9n2kDv5xU9OhPjJYZU HaP9HIZUFwuU2TD01b1QRcKCzgD/cSyStKMORI082CQeCvNdAC/yL+jxDgBIAOHD 0x1ZWwkACgkQUXIrCP5HRaIiagEAmZ3CueGmH2PwcCTp/jB8I5yainK4010UCygr NgeBIyQBAJS89sLvFy6XIkdw2urpSHe7T5jEoQ95U7Lfhl8cmvAJ =Plxt -----END PGP SIGNATURE----- --=-=-=-- ]