[MIR] golang-gopkg-mgo.v2

[Nicholas Skaggs]

[Availability]
Source-only package currently available in universe.

[Rationale]
Build-dependency for juju. This is part of our on-going work for bug 1508120, to stop bundling our dependencies in our source package.

[Security]
This is a source package which will only be used by other Go projects that build-depend on it.
Standard practices in the Go ecosystem unfortunately is not to do any release/tag, nor publish changelogs, bugfix announcements or other advisory information.
Most of those projects will therefore have a 0.0+git-hash kind of version scheme for their packaged form.
Update to those will typically be a completely new snapshot and refresh of their downstreams to match or be a one-off cherry-pick after a specific issue is reported.

[Quality assurance]
Source-only, arch:all package.
There are currently no bug reports filed against this source package.
The package is either maintained in Debian or maintained by its upstream directly in Ubuntu.
Most of those packages do not have a debian/watch file due to their upstream never pushing out versioned releases.

[Dependencies]
We are only interested in the -dev source-only package. None of those have build-dependencies due to being source-only.

[Maintenance]
This package already has a maintainer, and exists in the archive already. As with the other juju packages, the ubuntu-server team will provide ownership. However, the Juju QA team has also been subscribed to all bug mails for this package, and all others which we are requesting promotion into main as part of of work on bug 1508120 in order to ensure a smooth transition.

[Background information]
These MIRs are being filed in support of the ongoing work on bug 1508120, at the behest of the Security team, and the FFe for juju-core's inclusion in main for xenial, bug 1545913.

Note, the juju package will continue to bundle this dependency for trusty and older release, due to lack of go support and resources to backport and maintain these dependencies in trusty. However, these dependencies are used for all new builds, and have priority whenever present. This is in-line with the security team's recommendations and agreement as part of bug 1508120.

[Michael Terry (mterry)]

- What's the story with the tests? They're disabled with the comment "Tests require newer mongodb features such as --sslMode preferSSL" Is mongodb in xenial still too old? Can the tests be re-enabled?

- I see ~canonical-juju-qa is the team bug subscriber. But it's a private team... I couldn't even see membership to confirm that it was a suitable team for maintaining this (enough people with upload rights, etc.) Is there a more suitable team to subscribe? Or could the team be opened up?

[Nicholas Skaggs (nskaggs)]

mterry, the ubuntu server team should be the team bug subscriber. I added canonical-juju-qa as we are helping package this, and thus it makes it easier for us to also keep track during this process. Sorry for the confusion.

On the test front, mongodb has had some packaging work done during xenial to try and get it updated. See bug 1557852 for the big discussion. Presumably yes, once the work is done, the tests can be enabled again.

[Launchpad Janitor (janitor)]

[Expired for golang-gopkg-mgo.v2 (Ubuntu) because there has been no activity for 60 days.]