[pkg-go] Bug#1145642: keep golang-github-aead-chacha20 out of forky/testing and consider removal

Simon Josefsson simon at josefsson.org
Wed Aug 26 07:55:09 BST 2026


Package: golang-github-aead-chacha20
Severity: serious

Hi!  This package's upstream https://github.com/aead/chacha20 was
archived in 2023 and as security-sensitive, we shouldn't be shipping
this in forky.  Consider removing this package from the archive.

The reverse dependency golang-github-jedisct1-xsecretbox incorrectly
depended on this package, it was long migrated to use normal Go crypto
library in the upstream.  I'm making an upload to drop the no longer
needed dependencies.

/Simon
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 1287 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-go-maintainers/attachments/20260826/c84e3688/attachment.sig>


More information about the Pkg-go-maintainers mailing list