add tusd package

[Ritish134]

Fixes: #77043

Related:

Pre-review Checklist

For new package PRs only

• REQUIRED - The package is available under an OSI-approved or FSF-approved license
• This PR links to the upstream project's support policy (e.g. endoflife.date)

For version bump PRs

• The epoch field is reset to 0

[octo-sts]

📝 Build Failed: Syntax

flag provided but not defined: -require
usage: go get [-t] [-u] [-tool] [build flags] [packages]
Run 'go help get' for details.

Build Details

Category	Details
Build System	Go
Failure Point	go get -require=golang.org/x/crypto@v0.45.0

Root Cause Analysis 🔍

The go get command is using an invalid flag '-require' which is not supported by the Go toolchain. This appears to be a configuration error in the build script where an incorrect flag syntax is being used.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Suggested Changes

File: melange.yaml

• modification at line 21-24 (pipeline step with go get commands)
  Original:

  - runs: |
      go get -require=golang.org/x/crypto@v0.45.0
      go get -require=golang.org/x/net@v0.38.0
      go mod tidy

Replacement:

  - runs: |
      go mod require golang.org/x/crypto@v0.45.0
      go mod require golang.org/x/net@v0.38.0
      go mod tidy

Content:

Replace 'go get -require=' with 'go mod require' to properly add module requirements

Click to expand fix analysis

Analysis

No similar build failures were provided for analysis. However, the error is clear: the go get command is being used with an invalid -require flag that doesn't exist in the Go toolchain. The correct approach is to use go get without the -require flag to add dependencies, or use go mod require to add specific module requirements to go.mod.

Click to expand fix explanation

Explanation

The fix replaces the invalid go get -require= commands with go mod require commands. The -require flag does not exist for the go get command. The correct way to add specific module requirements to a Go project is using go mod require <module>@<version>. This command adds the specified module version as a requirement in the go.mod file. The go mod tidy command that follows will then ensure all dependencies are properly resolved and downloaded. This approach maintains the intent of pinning specific versions of the crypto and net modules while using the correct Go module management syntax.

Click to expand alternative approaches

Alternative Approaches

• Use 'go get golang.org/x/crypto@v0.45.0' and 'go get golang.org/x/net@v0.38.0' without the -require flag, which would download and add the dependencies
• Manually edit the go.mod file to include the required versions and then run 'go mod download' to fetch them
• Remove the version pinning entirely and let 'go mod tidy' resolve to the latest compatible versions if strict version control is not required

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[Ritish134]

I believe in the go.mod dependency version needs to be bumped, which would normally happen when this package is released in a newer upstream version.
Is there a way to specify a dependency version higher than what is currently defined in the upstream go.mod using go bump?