Managing Package licenses in Go
summary
Every sizeable Go codebase risks license creep and the claim is concrete not vague there are 2,200 Golang projects licensed GPL-2 on GitHub that can taint a compiled binary. The team builds WWHRD (Henry) a tiny Go tool you install with go get that checks vendor folder against whitelist blacklist and exceptions in a YAML file and runs in CI like Travis failing the build when a forbidden license appears.
AI-written summary · about
related talks
28mFinding Dependable Go Packages
13mBuild license management into your pipelines
26mFinding Dependable Go Packages
24m"Finding Dependable Go Packages"
36mThe Role of Package Managers as Partners in License and Attribution Compliance
17mPackage Management in Go: Under the Hood
31mLicense Compliance 101
49mLicense to Kill One's Code