Andrew Lee

Rescue Forky: We have Go Time Travel to 2011. Building Go Like It's 2011 is Broken.

Hidden Injections, 404 Errors, and the Path to Modern Builds.

When a modern Go package is added to Debian, it should just work. But what if a perfectly compiled binary fails with a “404 Not Found” error that nobody can explain?

After our investigation: We found Debian’s Go infrastructure is trapped Bookworm, Trixie and also Forky in Time Travel to 2011. Can we rescue “Forky” (Debian 14) Go back to the present and to be ready for the future?

Chicken, Egg, or go.mod? Solving Go Circular Build-Dependencies in Debian

Technical Presentation

If you maintain Go related packages. You’ve seen the error: Package A needs B, but B needs A.

In the Go world, this is becoming the “normal” for core libraries as Go’s modular designs for a world of “get the latest” but Debian still lives in a world of “builds in order from source”.

Let’s see how we can clear the path easily with Go and go.mod itself to resolving the Go Circular Build-Dependencies in Debian.