Comment 3 for bug 1481556

Hi Robie and all interested parties.

I have linked a source package branch to update Juju to 1.24.5 in wily.

The debian diff can be seen at
http://people.canonical.com/~curtis/wily-juju-1.24.5/debian.diff

There are several kinds of changes in the juju-core release files reflected
in debian/copyright that I can summarise:

1. Go packages dropped:
   * src/bitbucket.org/kardianos/osext
   * src/bitbucket.org/kardianos/service
   * src/code.google.com/p/go.crypto
   * src/code.google.com/p/winsvc

2. Go packages added
   [1] note 2 packages had licence issues that I reported upstream during
   development of 1.24.0. This point release has the upstream fixes, we
   avoided the need to document licensing exceptions:
   * src/github.com/ajstarks/svgo
   * src/github.com/altoros/gosigma
   * src/github.com/coreos/go-systemd
   * src/github.com/dustin/go-humanize
   * src/github.com/godbus/dbus
   * src/github.com/juju/govmomi
   * src/github.com/juju/jujusvg
   * src/github.com/juju/persistent-cookiejar
   * src/github.com/juju/replicaset
   * src/golang.org/x/oauth2
   * src/google.golang.org/api
   * src/google.golang.org/cloud
   * src/gopkg.in/errgo.v1 [1]
   * src/gopkg.in/juju/charm.v5
   * src/gopkg.in/juju/charmstore.v4 [1]
   * src/gopkg.in/macaroon-bakery.v0
   * src/gopkg.in/macaroon.v1

3. Projects moved from launchpad.net; inflating the diff:
   * src/launchpad.net/goamz -> src/gopkg.in/amz.v3
   * src/launchpad.net/goose -> src/gopkg.in/goose.v1

4. Forks of upstream golang to fix issues in golang 1.2 system packages:
   * src/github.com/gabriel-samfira/sys
   * src/github.com/juju/govmomi/vim25/xml
   * src/github.com/juju/httpprof
   * src/github.com/juju/xml

5. Fixes for copyright issues in response to the bugs we reported previously:
   * src/github.com/juju/cmd
   * src/github.com/juju/gojsonpointer
   * src/github.com/juju/gojsonreference
   * src/github.com/juju/gojsonschema
   * src/github.com/juju/juju
   * src/github.com/juju/utils

6. Packages updated to get fixes or new API:
   * src/github.com/juju/blobstore
   * src/github.com/juju/names
   * src/github.com/juju/testing
   * src/golang.org/x/crypto
   * src/gopkg.in/check.v1
   * src/gopkg.in/mgo.v2
   * src/gopkg.in/natefinch/lumberjack.v2
   * src/launchpad.net/gomaasapi

I audited the embedded go packages based on a diff of the dependencies.tsv
http://people.canonical.com/~curtis/wily-juju-1.24.5/deps.diff
and this script to identify undocumented deps:

    for dep in $(cat src/github.com/juju/juju/dependencies.tsv | cut -f 3); do
        grep -q "Last verified commit $dep" debian/copyright || echo "Review $dep"
    done

The actual diff between 1.22.6 and 1.24.5 is a mind-numbing 1,123,938 lines;
http://people.canonical.com/~curtis/wily-juju-1.24.5/1.22.6-1.24.5.diff.gz

I singled out src/githib.com/juju/juju for special attention since files
are moved in and out the project;
http://people.canonical.com/~curtis/wily-juju-1.24.5/juju.diff.gz