go-licenses

A lightweight tool to report on the licenses used by a Go package and its dependencies. Highlight! Versioned external URL to licenses can be found at the same time.

Explore on GitHub Read Hacker News discussions

3Distinct people

3Mentions

0Explicit recommenders

1KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

A lightweight tool to report on the licenses used by a Go package and its dependencies. Highlight! Versioned external URL to licenses can be found at the same time.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year3 dated mentions

Observed mentions: 2021-12-01 22:47:25 UTC to 2025-12-26 18:17:46 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Comments
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	1	1
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	0	0
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	1	1
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	0	0
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	1	1

What Hacker News says

3 sources

skybrian·Dec 26, 2025

This varies. The lawyers for risk-adverse companies will make sure they follow the licenses. There are auditing tools to make sure you're not pulling in code you shouldn't. An example is Google's go-licenses command [1]. But you can be sure that even the risk-adverse companies are going to go by what the license says, rather than "community norms." Other companies are more careless. [1] https://github.com/google/go-licenses

In Rob Pike goes nuclear over GenAI

shp0ngle·Dec 12, 2023

It goes transitively though. Some popular go packages grab tens (sometimes over hundres, but not as much as in node world) dependencies. NOBODY checks the license all the transitive dependencies in go world. What should or should not happen is one thing, this is the reality edit: oh but that lead me to google this neat https://github.com/google/go-licenses

In LXD now re-licensed and under a CLA

throwaway894345·Dec 1, 2021

> I don't think the exact URL is the problem, it is the fact that it is so easy to include dependencies from external repository that is the problem. In Rust every non-trivial library pulls in 10s or even 100s of dependencies. But it's also quite a lot easier to audit those dependencies, even automatically (incidentally, GitHub provides dependency scanning for free for many languages). > Then there is the issue of licencing - how to verify that I am not using some library in violation of its licence and what happens if the licence changes down the road and I don't notice it because I am implicitly using 500 dependencies due to my 3 main libraries? This is also an automated task. For example, https://github.com/google/go-licenses: "go-licenses analyzes the dependency tree of a Go package/binary. It can output a report on the libraries used

Read the rest

and under what license they can be used. It can also collect all of the license documents, copyright notices and source code into a directory in order to comply with license terms on redistribution." > Rust and Go have solved memory safety compared to C and C++ but have introduced dependency hell of yet unknown proportions. I mean, it's been a decade and things seem to be going pretty well. Also, I don't think anyone who has actually used these languages seriously has ever characterized their dependency management as "dependency hell"; however, lots of people talk about the "dependency hell" of managing C and C++ dependencies. > Python and other dynamically typed languages are in a league of their own in that on top of the dependency hell they also do not provide compiler checks that would allow user to see the problem before the exact conditions occur at runtime. I won't argue with you there.

In This shouldn't have happened: A vulnerability postmortem