Skip to content

Debian - Static-Built-Using for Go/Rust packages #4195

@roliver-rpi

Description

@roliver-rpi

What would you like to be added:
Static-Built-Using (formerly 'X-Cargo-Built-Using'/'Built-Using') should be parsed/retained in 'parseDpkgStatusEntry'.

Why is this needed:
Go/Rust packages make use of static linking in Debian. The 'Static-Built-Using' field in the binary package is used as a record of the exact version of source code that was used during the build. This information is an important constituent part of SBOM that should be preserved.

Additional context:
A few heavily abridged examples from Debian Trixie:

Package: docker.io
Source: docker.io (26.1.5+dfsg1-9)
Version: 26.1.5+dfsg1-9+b9
Built-Using: golang-go.crypto (= 1:0.25.0-1)
Package: debiman
Version: 0.0~git20220907.a582536-1.1
Static-Built-Using: golang-go.crypto (= 1:0.23.0-1)
Package: ripgrep
Source: rust-ripgrep (14.1.1-1)
Version: 14.1.1-1+b4
X-Cargo-Built-Using: rust-serde (= 1.0.217-1)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status

    Ready

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions