vcswatch reports that
this package seems to have new commits in its VCS but has
not yet updated debian/changelog. You should consider updating
the Debian changelog and uploading this new version into the archive.
Here are the relevant commit logs:
commit dcb54eea2875a0c1c51b6d972aa6add5a7427bb6
Merge: 0880239 3a4829c
Author: Simon Quigley <tsimonq2@debian.org>
Date: Sun Oct 25 15:44:55 2026 -0500
Merge branch 'dh-go-0.2.0' into 'debian/unstable'
Update to 0.2.0, repack without the RPM databases, migrate to dh-go
See merge request go-team/packages/golang-github-anchore-go-rpmdb!1
commit 3a4829c6ed3c0aab9425b37e62c09a85a97683c7
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Mon Oct 19 13:40:28 2026 +0200
Use the standard Salsa CI template
The file came from the pkg-go template. That one runs the Salsa CI jobs only
when somebody presses the Play button, and it runs the archive job only
inside the go-team namespace, so a pipeline on this branch built nothing.
The standard template builds the package and runs autopkgtest, lintian and
piuparts on every push, the same as syft and siso.
commit 374da3cb5d3b7a38536edfa560672b68146101be
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Sat Sep 26 02:36:14 2026 +0200
Tell uscan about the +ds suffix
Without the mangle, lintian's debian-watch-not-mangling-version fires and uscan
compares 0.2.0 upstream against 0.2.0+ds.
commit a822285201923dec7bf4c66036a8e1e7c88e0d5c
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Sat Sep 26 02:32:32 2026 +0200
Update to upstream 0.2.0 and migrate to dh-go
syft 1.52.0 and grype 0.119.0 both require go-rpmdb v0.2.0. 0.2.0 drops
hashicorp/go-multierror and golang.org/x/xerrors and needs no new dependency, so
Build-Depends loses two entries.
dh-go 1.68 removed Provides: dh-sequence-golang, so the addon has to be asked for
explicitly with --with=golang, or dh_golang never runs and Static-Built-Using
comes out empty. That costs one lintian tag, overridden with the reason.
The library itself imports nothing outside the standard library: pkg/sqlite3 goes
through database/sql and leaves the driver to the caller, so the -dev package
Depends on ${misc:Depends} alone.
The modernc-instead-of-glebarez patch is refreshed for 0.2.0, keeping its author.
Two tests are skipped: they read the RPM databases the +ds tarball drops.
commit ca38536bea3c9ff334c61514d6c8d6aa325a46ad
Merge: 8496e5b 55d5366
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Sat Sep 26 02:31:18 2026 +0200
Update upstream source from tag 'upstream/0.2.0+ds'
Update to upstream version '0.2.0+ds'
with Debian dir 75794bfcd46142a42c26a1c12655413b1e1d30c0
commit 55d5366f3b10d6a1f15f3b7dc07b9f0ce86b6359
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Sat Sep 26 02:31:17 2026 +0200
New upstream version 0.2.0+ds
commit 8496e5bef33fb83d05a7d085a47a39f976254e1b
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Sat Sep 26 02:31:00 2026 +0200
Repack the tarball without the RPM databases
pkg/testdata holds 18 Berkeley DB and SQLite files copied out of CentOS, Oracle
Linux, Rocky Linux, SLE and CBL-Mariner images: 259 MB against 1.4 MB for the
rest of the source. They are build output rather than source and carry those
distributions' package metadata, so Files-Excluded drops them and the tarball
goes from 76 MB to 169 KB.
Also declare the two files that hold the test expectations, which licensecheck
reads as GPL-2 because they quote the licence field of CentOS packages.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/golang-github-anchore-go-rpmdb.png){kind=link}