dependency ''howeyc/gopass'' archived by owner in 2021 and set to read only ; debian release candidate bug affects pat

[donfede]

The pat dependency ''howeyc/gopass'' ( https://github.com/howeyc/gopass ) was archived by the owner in 2021 and the repository set to read only, with their README suggesting to use "terminal" ( https://golang.org/x/crypto/ssh/terminal ).

The debian project has recently marked this as a release candidate (RC) bug #1130525 ( https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130525 ) that could affect pat removing it from the next release. With good communication this risk may be postponed, however it would likely be ideal for pat to transition to a better maintained dependency code base.

I'll admit not having dug this deep into pat code, so I'm not clear how large or small of an effort this may be.

[donfede]

Debian email list thread discussing this issue at the end -- https://lists.debian.org/debian-go/2026/03/msg00107.html

[martinhpedersen]

Thanks for the heads-up 😊

I will look into this asap. Hopefully not a big task.

[martinhpedersen]

Hi again,

Looks like I might have a fix already. I'll have to do some testing, and prepare a new release.

How much time do you think we have? 😅

[donfede]

We're good for at least several weeks (2026-Apr-25), and likely a couple
months provided there are comms (we/I bump the debian bug thread that the
issue is being worked on; my plan is to hold until ~Apr-14, then seek to buy
more time).

Nothing to stress over, but rather plan and work towards solid progress.

TY for the quick feedback and efforts!

[martinhpedersen]

@donfede - Thank you! I have pushed 43788c1 to develop, and will focus on getting a new release out soon.