Packaging: Debian

[dominikschulz]

We should try to get gopass into the official Debian repos. Unfortunately gopass is already taken (ref), but maybe a package name of gopasspw would work.

Any help here is appreciated since I'm not very keen Debian policies and proceses myself.

We should:

• File an ITP bug
• Create a "proper" Deb package (we have proper packages, but they are most likely not fully in line with the extensive Debian policy)
• Find a Sponsor to upload the package

If any changes to gopass are necessary to ease that work I will look into it.

[dominikschulz]

Actually there is an ITP already: #901133.

Someone already started working on packaging gopass as gopasspw for Debian a long time ago. Seems like this work never finished.

I'll try reaching out to them to see if we can make progress somehow.

[dominikschulz]

IIRC a proper Debian package in the archive requires all dependencies to be packaged as their own proper packages.

Looking at our go.mod and packages.debian.org this is the list of missing packages. Most are packaged already, but a few remain. Either we get rid of these dependencies or get them packaged as well.

• [x] bitbucket.org/creachadair/stringset - golang-bitbucket.org-creachadair-stringset
• [ ] github.com/caspr-io/yamlpath - golang-github-caspr-io-yamlpath-dev
• [x] github.com/godbus/dbus - golang-dbus-dev
• [ ] github.com/jsimonetti/pwscheme - golang-github-jsimonetti-pwscheme-dev ITP
• [x] github.com/boombuler/barcode - golang-barcode-dev
• [x] github.com/danieljoos/wincred - This only for windows. We sholdn't need this on Debian.
• [x] filippo.io/age - age (?)
• [x] github.com/skip2/go-qrcode - go-qrcode (?)
• [x] github.com/ProtonMail/go-crypto - golang-github-protonmail-go-crypto-dev
• [x] github.com/twpayne/go-pinentry - golang-github-twpayne-go-pinentry-dev
• [x] github.com/zalando/go-keyring - golang-github-zalando-go-keyring-dev
• [x] github.com/rogpeppe/go-internal - golang-github-rogpeppe-go-internal-dev
• [x] gopkg.in/check.v1 - golang-check.v1
• [x] github.com/atotto/clipboard - golang-github-atotto-clipboard-dev
• [x] github.com/blang/semver/v4 - golang-github-blang-semver-dev
• [x] github.com/cenkalti/backoff - golang-github-cenkalti-backoff-dev
• [x] github.com/chzyer/readline - golang-github-chzyer-readline-dev
• [x] github.com/dustin/go-humanize - golang-github-dustin-go-humanize-dev
• [x] github.com/fatih/color - golang-github-fatih-color-dev
• [x] github.com/gokyle/twofactor - golang-github-gokyle-twofactor-dev
• [x] github.com/google/go-cmp - golang-github-google-go-cmp-dev
• [x] github.com/google/go-github - golang-github-google-go-github-dev
• [x] github.com/hashicorp/golang-lru - golang-github-hashicorp-golang-lru-dev
• [x] github.com/kballard/go-shellquote - golang-github-kballard-go-shellquote-dev
• [x] github.com/martinhoefling/goxkcdpwgen - goxkcdpwgen
• [x] github.com/mattn/go-colorable - golang-github-mattn-go-colorable-dev
• [x] github.com/mattn/go-isatty - golang-github-mattn-go-isatty-dev
• [x] github.com/mattn/go-tty - golang-github-mattn-go-tty-dev
• [x] github.com/mitchellh/go-ps - golang-github-mitchellh-go-ps-dev
• [x] github.com/muesli/crunchy - golang-github-muesli-crunchy-dev
• [x] github.com/nbutton23/zxcvbn-go - golang-github-nbutton23-zxcvbn-go-dev
• [x] github.com/pquerna/otp - golang-github-pquerna-otp-dev
• [x] github.com/schollz/closestmatch - golang-github-schollz-closestmatch-dev
• [x] github.com/stretchr/testify - golang-github-stretchr-testify-dev
• [x] github.com/urfave/cli/v2 - golang-github-urfave-cli-v2-dev
• [x] golang.org/x/crypto - golang-golang.org-x-crypto-dev
• [x] golang.org/x/exp - golang-golang.org-x-exp-dev
• [x] golang.org/x/net - golang-golang.org-x-net-dev
• [x] golang.org/x/oauth2 - golang-golang.org-x-oauth2-dev
• [x] golang.org/x/sys - golang-golang.org-x-sys-dev
• [x] golang.org/x/term - golang-golang.org-x-term-dev
• [x] gopkg.in/yaml.v3 - golang-gopkg-yaml.v3-dev
• [x] filippo.io/edwards25519 - golang-filippo-edwards25519-dev
• [x] github.com/alessio/shellescape - golang-github-alessio-shellescape-dev
• [x] github.com/cloudflare/circl - golang-github-cloudflare-circl-dev
• [x] github.com/cpuguy83/go-md2man/v2 - golang-github-cpuguy83-go-md2man-v2-dev
• [x] github.com/davecgh/go-spew - golang-github-davecgh-go-spew-dev
• [x] github.com/golang/protobuf - golang-goprotobuf-dev
• [x] github.com/google/go-querystring - golang-github-google-go-querystring-dev
• [x] github.com/hashicorp/errwrap - golang-github-hashicorp-errwrap-dev
• [x] github.com/kr/pretty - golang-github-kr-pretty-dev
• [x] github.com/pmezard/go-difflib - golang-github-pmezard-go-difflib-dev
• [x] github.com/rs/zerolog - golang-github-rs-zerolog-dev
• [x] github.com/russross/blackfriday/v2 - golang-github-russross-blackfriday-v2-dev
• [x] github.com/xrash/smetrics - golang-github-xrash-smetrics-dev
• [x] go.uber.org/atomic - golang-go.uber.org-atomic-dev
• [x] go.uber.org/multierr - golang-go.uber.org-multierr-dev
• [x] google.golang.org/appengine - golang-google-appengine-dev
• [x] google.golang.org/protobuf - golang-google-protobuf-dev
• [x] rsc.io/qr - golang-rsc-qr-dev

[dominikschulz]

I've reached out a few days ago but no response so far.

Maybe we can at least send some PRs to get the existing repo on Salsa up to date. Then there are maybe four libraries missing.

Reference

[dominikschulz]

Adding the missing libraries might be fairly easy, but I don't know how to collaborate on Salsa. Opening Pull Requests doesn't seem to be possible for outside contributors.

[AnomalRoil]

Aren't Go binaries circumventing this since we're building a static binary except for our dependencies on git, gpg, vim?

[dominikschulz]

For all other distros: Yes.

But Debian is special. Don't ask me to explain why. I did not make an attempt to understand the "why", yet.

[rjt]

Are both multierr packages below required? github.com/hashicorp/go-multierror - golang-github-hashicorp-go-multierror-dev go.uber.org/multierr - golang-go.uber.org-multierr-dev

The uber version requires go 1.19 but on the debian derivative PoPOS, go is 1.18.1.

I just wasted so much time not realizing the gopass i was using was not your gopass.

[dominikschulz]

@rjt Sorry to hear that, I'd love to improve the situation for Debian users.

In the long run I don't think we'll need any third party multierror package since Go got native error wrapping support. But these are still likely used by some of our dependencies. If this will help the Debian packaging I will try to hunt down these and try to get rid of one (or maybe both).

[dominikschulz]

github.com/hashicorp/go-multierror seems to be only used in internal/store/root/fsck.go. I'm sure we can replace that with errors.Join.

The go.uber.org/multierr package is used by github.com/twpayne/go-pinentry/. This might require some investigation if it can be removed, but we can try.