[pkg-go] [PATCH] Compute Built-Using with go list, not Build-Depends

[Michael Hudson-Doyle]

On 15 April 2016 at 03:55, Martín Ferrari <tincho at tincho.org> wrote:
> On 14/04/16 01:43, Michael Hudson-Doyle wrote:
>> Built-Using for a binary is meant to include all packages that are included in
>> the binary itself, but using Build-Depends only pulls in the direct
>> dependencies. Use go list and dpkg-query --search instead to find out which
>> (debian) packages installed the (go) packages that were actually used during
>> the build instead.
>>
>> As a bonus, this is shorter and arguably simpler that what it replaces.
>
> Just one comment. Shouldn't the build-using also include all
> build-dependencies, not only the golang ones?

No, I don't think so. Policy 7.8 says:

Some binary packages incorporate parts of other packages when built
but do not have to depend on those packages. Examples include linking
with static libraries or incorporating source code from another
package during the build. In this case, the source packages of those
other packages are a required part of the complete source (the binary
package is not reproducible without them).

A Built-Using field must list the corresponding source package for any
such binary package incorporated during the build [56], including an
"exactly equal" ("=") version relation on the version that was used to
build that binary package[57].

By default, at least, go packages using cgo will dynamically link
against the C libraries and so get the appropriate runtime
dependencies via dpkg-makeshlibdeps. Packages that statically link
against C libraries will need to take further steps to get an accurate
Built-Using, but that's not something for dh-golang to worry over I
think.

Cheers,
mwh