debian packaging not updated

[gehoern]

debian change log is still stuck with version 20191204.00, but upstream is at 20210524.00.

The other more immanent problem is: it does not build with debian testing anymore:

make[1]: Entering directory '/home/dev/google-guest-agent'
dh_auto_build -O--buildsystem=golang -- -ldflags="-s -w -X main.version="
go: cloud.google.com/[email protected]: module lookup disabled by GOPROXY=off
	cd obj-x86_64-linux-gnu && go install -trimpath -v -p 16 "-ldflags=-s -w -X main.version="
go: cloud.google.com/[email protected]: module lookup disabled by GOPROXY=off
dh_auto_build: error: cd obj-x86_64-linux-gnu && go install -trimpath -v -p 16 "-ldflags=-s -w -X main.version=" returned exit code 1
make[1]: *** [debian/rules:25: override_dh_auto_build] Error 25
make[1]: Leaving directory '/home/dev/google-guest-agent'
make: *** [debian/rules:13: build] Error 2
dpkg-buildpackage: error: debian/rules build subprocess returned exit status 2
debuild: fatal error at line 1182:
dpkg-buildpackage -us -uc -ui failed

[hopkiw]

Hi, @gehoern thank you for the issue. Can you expand a bit on how you are attempting to build this package and why? The packaging files in this repository are used for the Google-authored builds of these packages and are not official Debian build files, so we don't track the ability to build in testing. You can see the produced packages in our cloud repositories, configured by default on GCE VMs.

As for the changelog, we autogenerate a new changelog entry in that file for every build using dch, and don't intend to manually maintain that file.

[gehoern]

We have higher demands for security, so we do not take "just compiled" binaries. Most of our used packages either compile completely for our cloud image or at least use packages that are reproducible (we have a valid source package).
Since you provide on the google repositories binary only builds - especially here for the go stuff - we cannot verify if we get what we expect. Since for Debian testing now the Google-compute-engine packages dropped out of the distribution we have to switch to this repo here and build ourselves.
How we build? we take the package folder, move the debian folder to the main directory and hit debuild. For this package this is completely broken (killer), not having a valid changelog (ignore) using the wrong version number (ignore). So we really try to use this repo for our own, reproducible, verifiable build. At the moment this breaks.
Thanks for being more transparent here!

[hopkiw]

Thanks for your reply, @gehoern

Sure, being able to build from source is a common requirement. Our source code is provided here to enable builds from source. However, the packaging files here are only guaranteed to work for our own package building system and are unsupported for others. We don't guarantee that they will work in any build environment other than our own, and we don't guarantee that they meet any particular Linux distribution's packaging requirements, and they are not used in any of the official distribution-maintained builds such as for Debian or Ubuntu. They are included here only for our own use and for the sake of transparency.

With that background in mind, we are happy to answer questions to assist your troubleshooting. In your build output it isn't at all clear what failed or why (go install returned code 25?), but if you get something more specific and need information, feel free to ask questions in this issue. If you discover an issue that seems generally wrong and can be fixed without impact to existing customers, we will consider accepting pull request. If the issue is more specific to your use case, you would be encouraged in that case to maintain your own packaging files. For the maximum reliability, we would recommend you maintain your own packaging files regardless.