golang-k8s-sigs-controller-runtime 0.24.1-1

Package Information

Description	Go libraries for building Kubernetes controllers The Kubernetes controller-runtime Project is a set of go libraries for building Controllers. It is leveraged by Kubebuilder and Operator SDK.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-k8s-sigs-controller-runtime.git (browse)
Closes	#1152905
Tracker	https://tracker.debian.org/pkg/golang-k8s-sigs-controller-runtime
Uploaded	3 hours ago

New Package Report

.changes◂

Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Fri, 30 Oct 2026 15:27:46 +0100
Source	golang-k8s-sigs-controller-runtime
Version	0.24.1-1

Changelog◂

golang-k8s-sigs-controller-runtime (0.24.1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152905)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-k8s-sigs-controller-runtime-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/kubernetes-sigs/controller-runtime
Upstream-Name: controller-runtime
Upstream-Contact: https://github.com/kubernetes-sigs/controller-runtime/issues

Files: *
Copyright: 2014-2026 The Kubernetes Authors.
License: Apache-2.0

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for golang-k8s-sigs-controller-runtime version 0.24.1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The whole tree is Apache-2.0: every Go source file carries a Copyright <year> The Kubernetes Authors. / Licensed under the Apache License, Version 2.0 header (tools/setup-envtest by SPDX tag), LICENSE is the Apache-2.0 text, and there is no NOTICE, no vendored copy of third-party code and no other licence or holder anywhere in the tree. debian/copyright is DEP-5 with the correct Format URL, one Files: * stanza for upstream, one for debian/* under the same licence, and the Apache-2.0 boilerplate with a pointer to /usr/share/common-licenses/Apache-2.0; holder, licence short name and version all match the evidence. Nothing non-free or unlicensed was found.

Packaging

Mostly conventional: 3.0 (quilt), debhelper 14 with dh-go, Standards-Version 4.7.4, autopkgtest-pkg-go, DEP-3 patches, sane changelog and Vcs-* fields, and a rules file that documents why it works around dh-go's go.work handling. It is let down by an incomplete Depends: pkg/envtest/komega/equalobject.go is a non-test file shipped in the -dev package that imports gomega, yet golang-gomega-dev is only a conditional build dependency (<!nocheck>) and is absent from Depends, so consumers of that subpackage cannot compile it and a nocheck build fails. Three Depends entries are also unused by the shipped code.

Issues

important packaging 1. Depends omits golang-gomega-dev although the shipped file pkg/envtest/komega/equalobject.go imports it ◂

Files: debian/control:32, debian/control:40-68, pkg/envtest/komega/equalobject.go:23-24
Basis: checked, in the package or with a reference tool
Evidence: equalobject.go (no _test suffix, installed by dh_golang into /usr/share/gocode/src/sigs.k8s.io/controller-runtime/pkg/envtest/komega) has "github.com/onsi/gomega/format" and "github.com/onsi/gomega/types"; debian/control has golang-gomega-dev <!nocheck> in Build-Depends and no gomega anywhere in the Depends block, which ends golang-k8s-utils-dev,.
Problem: A -dev package must depend on the packages providing everything needed to build the Go packages it ships (Policy 7.2); a user who imports sigs.k8s.io/controller-runtime/pkg/envtest/komega gets a compile error because gomega is not pulled in. In addition, <!nocheck> drops gomega from the build environment when DEB_BUILD_OPTIONS=nocheck is set, while dh_auto_build still compiles pkg/envtest/komega (it is not in DH_GOLANG_EXCLUDES), so such a build fails.
Fix: Make golang-gomega-dev an unconditional Build-Depends (remove < !nocheck>) and add it to the Depends of golang-k8s-sigs-controller-runtime-dev.

minor packaging 2. Depends lists golang-github-spf13-afero-dev, golang-github-spf13-pflag-dev and golang-golang-x-mod-dev, which no shipped file imports ◂

Files: debian/control:52, debian/control:54, debian/control:56
Basis: checked, in the package or with a reference tool
Evidence: a search of pkg/**/*.go (tests included) and the root *.go for spf13/afero, spf13/pflag and golang.org/x/mod returns no match; those modules are imported only by examples/ and tools/setup-envtest/, both excluded from the build and install by DH_GOLANG_EXCLUDES in debian/rules:5.
Problem: Three libraries are forced on every user of the -dev package although nothing in the installed source needs them; the go.mod require block lists them only because the excluded example and tool modules share it.
Fix: Drop the three entries from the binary Depends (and, if nothing else needs them, from Build-Depends).

minor packaging 3. debian/rules calls private dh-go 1.69 routines but Build-Depends on dh-go carries no version ◂

Files: debian/rules:18-20, debian/rules:28-37, debian/control:5
Basis: inferred from what was read, not seen directly
Evidence: debian/rules: # dh-go 1.69 go.work defects and WRITE_GO_WORK := buildsystems_init(); my $$b = load_buildsystem("golang"); $$b->pre_building_step("build"); $$b->_setup_module_mappings(); $$b->_construct_modules(...); $$b->_create_go_work_file();; debian/control: dh-go,.
Problem: The rules file drives dh-go through underscore-prefixed methods that are not a stable interface, plus sed on the generated go.work and hand-written go.mod/COMPAT directories; this only holds for the dh-go release whose internals it was written against. An unversioned build-dependency lets an older dh-go (lacking _create_go_work_file) fail at the write-go-work target, and a newer one can silently change what the sed expressions see.
Fix: Require the version the hacks were written for, e.g. dh-go (>= 1.69) (or >= 1.69~), and report the two dh-go go.work defects upstream so the workaround can eventually be dropped.

Verified ◂

The scan before the review listed no files to check and reported that every copyright holder it found is named in debian/copyright.
debian/copyright read in full: DEP-5, Format URL exactly https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/, stanzas Files: * (2014-2026 The Kubernetes Authors, Apache-2.0) and debian/* (2026 Juan Manuel Mendez Rey, Apache-2.0), stand-alone Apache-2.0 paragraph with a Comment pointing at /usr/share/common-licenses/Apache-2.0 (a Comment field is allowed in a stand-alone License stanza, copyright-format 5.3).
Licence evidence collected over the whole tree (431 files) with greps for Copyright, (C), (c), Licensed under, SPDX-License-Identifier, All rights reserved, MIT, BSD, GNU ... General Public, Mozilla Public, Creative Commons, ISC, Redistribution and use: only Apache-2.0 appears, and the only holder is The Kubernetes Authors (the Copyright {yyyy} {name of copyright owner} and Grant of Copyright License hits are the Apache-2.0 text itself). A negative-lookahead grep for Copyright lines not naming The Kubernetes Authors matches only LICENSE's template line and the Debian packaging stanza.
Only one licence file exists, top-level LICENSE (full Apache-2.0); there is no NOTICE, no AUTHORS/COPYING and no subdirectory licence file. No vendor/ directory, archive, PDF, minified JavaScript or shared object anywhere in the tree; the single binary file, designs/images/component-config-load.png, is a documentation illustration in a tree otherwise entirely Apache-2.0 under Files: *.
tools/setup-envtest files carry // SPDX-License-Identifier: Apache-2.0, consistent with the stanza.
Patches: both are DEP-3 formatted (From, Subject, Forwarded: no, Last-Update) and touch only test helpers (pkg/internal/testing/process, addr, certs); 0002's localhost handling is consistent with RFC 6761.
The dh_auto_test exclusion list in debian/rules:12-16 was cross-checked: every package it excludes (builder, cache, client, client/apiutil, cluster, controller, controller/controllerutil, envtest, handler, internal/controller, internal/recorder, internal/testing/controlplane, manager, manager/internal/integration, metrics/filters, reconcile, source, webhook) has test files importing pkg/envtest, so the stated reason holds.
Debhelper compat 14: dh skips override_dh_auto_test when DEB_BUILD_OPTIONS contains nocheck, so no explicit check is needed; ${misc:Depends} is present and substvars are added by dh_gencontrol at this level.
Standards-Version 4.7.4 has the same first two components as the reviewing system's Policy 4.7.4.1; changelog is an initial release with a bug closure, distribution unstable; source format 3.0 (quilt); Vcs-Git/Vcs-Browser and XS-Go-Import-Path match the source name and import path; debian/upstream/metadata and gbp.conf are in order.
apt-cache confirmed that golang-github-evanphx-json-patch-dev (5.7.0, the v5 module the rules pins), golang-github-fsnotify-fsnotify-dev, golang-github-go-logr-logr-dev, golang-github-go-logr-zapr-dev, golang-github-google-go-cmp-dev, golang-github-prometheus-client-golang-dev, golang-github-spf13-afero-dev, golang-golang-x-mod-dev, golang-k8s-sigs-yaml-dev, golang-k8s-sigs-structured-merge-diff-v6-dev, golang-k8s-utils-dev, golang-k8s-apimachinery-dev, golang-k8s-apiserver-dev, golang-github-onsi-ginkgo-v2-dev and golang-gomega-dev exist in the archive.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.25.2, packaged 0.24.1), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

apt-cache finds no binary package golang-github-gomodules-jsonpatch-dev (needed for gomodules.xyz/jsonpatch/v2, imported by pkg/webhook/alias.go and pkg/webhook/admission/*.go) nor golang-gopkg-evanphx-json-patch.v4-dev (needed for gopkg.in/evanphx/json-patch.v4, imported by pkg/client/fake/client.go), in unstable, experimental or the NEW queues; if neither exists under those names the Build-Depends are unsatisfiable and the package cannot build, while if they do exist the Build-Depends are right. Both are in Build-Depends and Depends.
Could not read dh-go 1.69 itself (the reviewing system carries the dh-golang 1.67 buildsystem, whose golang.pm has no go.work support); whether the private calls and the cel.dev/cel-go@v0.32.0 require added in fix-go-work resolve offline can only be shown by a build.
The autopkgtest-pkg-go runner is not present on the reviewing system, so how the test suite is invoked under Testsuite: autopkgtest-pkg-go without debian/tests/control was not checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

All three are right. Fixed in 0.24.1-2: https://salsa.debian.org/go-team/packages/golang-k8s-sigs-controller-runtime/-/commit/753af452 (gomega added to Depends and no longer nocheck-only in Build-Depends, unused afero, pflag and x/mod dropped, dh-go versioned). I recommend accepting -1; I'll upload -2 right after.

— Juan Manuel Méndez Rey (mendezr), 1 hour ago

Back to Dashboard | View all reviews for this package