{"id":13461387,"url":"https://github.com/google/go-licenses","last_synced_at":"2025-10-20T16:09:17.190Z","repository":{"id":36652571,"uuid":"221192652","full_name":"google/go-licenses","owner":"google","description":"A lightweight tool to report on the licenses used by a Go package and its dependencies. Highlight! Versioned external URL to licenses can be found at the same time.","archived":false,"fork":false,"pushed_at":"2025-03-17T19:49:51.000Z","size":659,"stargazers_count":877,"open_issues_count":44,"forks_count":126,"subscribers_count":13,"default_branch":"master","last_synced_at":"2025-03-22T00:41:48.458Z","etag":null,"topics":["go","golang","license","license-checking","license-management"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/google.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-11-12T10:37:11.000Z","updated_at":"2025-03-20T14:23:29.000Z","dependencies_parsed_at":"2024-04-22T18:27:24.346Z","dependency_job_id":"a280c81b-9510-48fe-94ee-9fc946e4bf48","html_url":"https://github.com/google/go-licenses","commit_stats":{"total_commits":118,"total_committers":29,"mean_commits":4.068965517241379,"dds":0.7796610169491526,"last_synced_commit":"706b9c60edd424a8b6d253fe10dfb7b8e942d4a5"},"previous_names":[],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fgo-licenses","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fgo-licenses/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fgo-licenses/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fgo-licenses/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/google","download_url":"https://codeload.github.com/google/go-licenses/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245366184,"owners_count":20603438,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["go","golang","license","license-checking","license-management"],"created_at":"2024-07-31T11:00:37.312Z","updated_at":"2025-10-20T16:09:17.172Z","avatar_url":"https://github.com/google.png","language":"Go","funding_links":[],"categories":["Go","Software Composition Analysis"],"sub_categories":[],"readme":"# Licenses tool\n\n\u003e This is not an officially supported Google product.\n\n`go-licenses` analyzes the dependency tree of a Go package/binary. It can output a\nreport on the libraries used and under what license they can be used. It can\nalso collect all of the license documents, copyright notices and source code\ninto a directory in order to comply with license terms on redistribution.\n\n## Before you start\n\nTo use this tool, make sure:\n\n* [You have Go v1.16 or later installed](https://golang.org/dl/).\n* Change directory to your go project, **for example**:\n\n  ```shell\n  git clone git@github.com:google/go-licenses.git\n  cd go-licenses\n  ```\n\n* Download required modules:\n\n  ```shell\n  go mod download\n  ```\n\n## Installation\n\nUse the following command to download and install this tool:\n\n```shell\ngo install github.com/google/go-licenses/v2@latest\n```\n\nIf you were using `go get` to install this tool, note that\n[starting in Go 1.17, go get is deprecated for installing binaries](https://go.dev/doc/go-get-install-deprecation).\n\n## Reports\n\n```shell\n$ go-licenses report github.com/google/go-licenses\nW0410 06:02:57.077781   31529 library.go:86] \"golang.org/x/sys/unix\" contains non-Go code that can't be inspected for further dependencies:\n/home/username/go/pkg/mod/golang.org/x/sys@v0.0.0-20220111092808-5a964db01320/unix/asm_linux_amd64.s\nW0410 06:02:59.476443   31529 library.go:86] \"golang.org/x/crypto/curve25519/internal/field\" contains non-Go code that can't be inspected for further dependencies:\n/home/username/go/pkg/mod/golang.org/x/crypto@v0.0.0-20220112180741-5e0467b6c7ce/curve25519/internal/field/fe_amd64.s\nW0410 06:02:59.486045   31529 library.go:86] \"golang.org/x/crypto/internal/poly1305\" contains non-Go code that can't be inspected for further dependencies:\n/home/username/go/pkg/mod/golang.org/x/crypto@v0.0.0-20220112180741-5e0467b6c7ce/internal/poly1305/sum_amd64.s\nW0410 06:02:59.872215   31529 library.go:253] module github.com/google/go-licenses has empty version, defaults to HEAD. The license URL may be incorrect. Please verify!\nW0410 06:02:59.880621   31529 library.go:253] module github.com/google/go-licenses has empty version, defaults to HEAD. The license URL may be incorrect. Please verify!\ngithub.com/emirpasic/gods,https://github.com/emirpasic/gods/blob/v1.12.0/LICENSE,BSD-2-Clause\ngithub.com/golang/glog,https://github.com/golang/glog/blob/23def4e6c14b/LICENSE,Apache-2.0\ngithub.com/golang/groupcache/lru,https://github.com/golang/groupcache/blob/41bb18bfe9da/LICENSE,Apache-2.0\ngithub.com/google/go-licenses,https://github.com/google/go-licenses/blob/HEAD/LICENSE,Apache-2.0\ngithub.com/google/go-licenses/internal/third_party/pkgsite,https://github.com/google/go-licenses/blob/HEAD/internal/third_party/pkgsite/LICENSE,BSD-3-Clause\ngithub.com/google/licenseclassifier,https://github.com/google/licenseclassifier/blob/3043a050f148/LICENSE,Apache-2.0\ngithub.com/google/licenseclassifier/stringclassifier,https://github.com/google/licenseclassifier/blob/3043a050f148/stringclassifier/LICENSE,Apache-2.0\ngithub.com/jbenet/go-context/io,https://github.com/jbenet/go-context/blob/d14ea06fba99/LICENSE,MIT\ngithub.com/kevinburke/ssh_config,https://github.com/kevinburke/ssh_config/blob/01f96b0aa0cd/LICENSE,MIT\ngithub.com/mitchellh/go-homedir,https://github.com/mitchellh/go-homedir/blob/v1.1.0/LICENSE,MIT\ngithub.com/otiai10/copy,https://github.com/otiai10/copy/blob/v1.6.0/LICENSE,MIT\ngithub.com/sergi/go-diff/diffmatchpatch,https://github.com/sergi/go-diff/blob/v1.2.0/LICENSE,MIT\ngithub.com/spf13/cobra,https://github.com/spf13/cobra/blob/v1.4.0/LICENSE.txt,Apache-2.0\ngithub.com/spf13/pflag,https://github.com/spf13/pflag/blob/v1.0.5/LICENSE,BSD-3-Clause\ngithub.com/src-d/gcfg,https://github.com/src-d/gcfg/blob/v1.4.0/LICENSE,BSD-3-Clause\ngithub.com/xanzy/ssh-agent,https://github.com/xanzy/ssh-agent/blob/v0.2.1/LICENSE,Apache-2.0\ngo.opencensus.io,https://github.com/census-instrumentation/opencensus-go/blob/v0.23.0/LICENSE,Apache-2.0\ngolang.org/x/crypto,https://cs.opensource.google/go/x/crypto/+/5e0467b6:LICENSE,BSD-3-Clause\ngolang.org/x/mod/semver,https://cs.opensource.google/go/x/mod/+/9b9b3d81:LICENSE,BSD-3-Clause\ngolang.org/x/net,https://cs.opensource.google/go/x/net/+/69e39bad:LICENSE,BSD-3-Clause\ngolang.org/x/sys,https://cs.opensource.google/go/x/sys/+/5a964db0:LICENSE,BSD-3-Clause\ngolang.org/x/tools,https://cs.opensource.google/go/x/tools/+/v0.1.10:LICENSE,BSD-3-Clause\ngolang.org/x/xerrors,https://cs.opensource.google/go/x/xerrors/+/5ec99f83:LICENSE,BSD-3-Clause\ngopkg.in/src-d/go-billy.v4,https://github.com/src-d/go-billy/blob/v4.3.2/LICENSE,Apache-2.0\ngopkg.in/src-d/go-git.v4,https://github.com/src-d/go-git/blob/v4.13.1/LICENSE,Apache-2.0\ngopkg.in/warnings.v0,https://github.com/go-warnings/warnings/blob/v0.1.2/LICENSE,BSD-2-Clause\n```\n\nThis command prints out a comma-separated report (CSV) listing the libraries\nused by a binary/package, the URL where their licenses can be viewed and the\ntype of license. A library is considered to be one or more Go packages that\nshare a license file.\n\nURLs are versioned based on go modules metadata.\n\n**Tip**: go-licenses writes the report to stdout and info/warnings/errors logs\nto stderr. To save the CSV to a file `licenses.csv` in bash, run:\n\n```bash\ngo-licenses report github.com/google/go-licenses \u003e licenses.csv\n```\n\nOr, to also save error logs to an `errors` file, run:\n\n```bash\ngo-licenses report github.com/google/go-licenses \u003e licenses.csv 2\u003e errors\n```\n\n**Note**: some warnings and errors may be expected, refer to [Warnings and Errors](#warnings-and-errors) for more information.\n\n## Reports with Custom Templates\n\n```shell\ngo-licenses report github.com/google/go-licenses --template testdata/modules/hello01/licenses.tpl\nW0822 16:56:50.696198   10200 library.go:94] \"golang.org/x/sys/unix\" contains non-Go code that can't be inspected for further dependencies:\n/Users/willnorris/go/pkg/mod/golang.org/x/sys@v0.0.0-20220722155257-8c9f86f7a55f/unix/asm_bsd_arm64.s\n/Users/willnorris/go/pkg/mod/golang.org/x/sys@v0.0.0-20220722155257-8c9f86f7a55f/unix/zsyscall_darwin_arm64.1_13.s\n/Users/willnorris/go/pkg/mod/golang.org/x/sys@v0.0.0-20220722155257-8c9f86f7a55f/unix/zsyscall_darwin_arm64.s\nW0822 16:56:51.466449   10200 library.go:94] \"golang.org/x/crypto/chacha20\" contains non-Go code that can't be inspected for further dependencies:\n/Users/willnorris/go/pkg/mod/golang.org/x/crypto@v0.0.0-20220112180741-5e0467b6c7ce/chacha20/chacha_arm64.s\nW0822 16:56:51.475139   10200 library.go:94] \"golang.org/x/crypto/curve25519/internal/field\" contains non-Go code that can't be inspected for further dependencies:\n/Users/willnorris/go/pkg/mod/golang.org/x/crypto@v0.0.0-20220112180741-5e0467b6c7ce/curve25519/internal/field/fe_arm64.s\nW0822 16:56:51.602250   10200 library.go:269] module github.com/google/go-licenses has empty version, defaults to HEAD. The license URL may be incorrect. Please verify!\nW0822 16:56:51.605074   10200 library.go:269] module github.com/google/go-licenses has empty version, defaults to HEAD. The license URL may be incorrect. Please verify!\n\n - github.com/emirpasic/gods ([BSD-2-Clause](https://github.com/emirpasic/gods/blob/v1.12.0/LICENSE))\n - github.com/golang/glog ([Apache-2.0](https://github.com/golang/glog/blob/23def4e6c14b/LICENSE))\n - github.com/golang/groupcache/lru ([Apache-2.0](https://github.com/golang/groupcache/blob/41bb18bfe9da/LICENSE))\n - github.com/google/go-licenses ([Apache-2.0](https://github.com/google/go-licenses/blob/HEAD/LICENSE))\n - github.com/google/go-licenses/internal/third_party/pkgsite ([BSD-3-Clause](https://github.com/google/go-licenses/blob/HEAD/internal/third_party/pkgsite/LICENSE))\n - github.com/google/licenseclassifier ([Apache-2.0](https://github.com/google/licenseclassifier/blob/3043a050f148/LICENSE))\n - github.com/google/licenseclassifier/licenses ([Unlicense](https://github.com/google/licenseclassifier/blob/3043a050f148/licenses/Unlicense.txt))\n - github.com/google/licenseclassifier/stringclassifier ([Apache-2.0](https://github.com/google/licenseclassifier/blob/3043a050f148/stringclassifier/LICENSE))\n - github.com/jbenet/go-context/io ([MIT](https://github.com/jbenet/go-context/blob/d14ea06fba99/LICENSE))\n - github.com/kevinburke/ssh_config ([MIT](https://github.com/kevinburke/ssh_config/blob/01f96b0aa0cd/LICENSE))\n - github.com/mitchellh/go-homedir ([MIT](https://github.com/mitchellh/go-homedir/blob/v1.1.0/LICENSE))\n - github.com/otiai10/copy ([MIT](https://github.com/otiai10/copy/blob/v1.6.0/LICENSE))\n - github.com/sergi/go-diff/diffmatchpatch ([MIT](https://github.com/sergi/go-diff/blob/v1.2.0/LICENSE))\n - github.com/spf13/cobra ([Apache-2.0](https://github.com/spf13/cobra/blob/v1.5.0/LICENSE.txt))\n - github.com/spf13/pflag ([BSD-3-Clause](https://github.com/spf13/pflag/blob/v1.0.5/LICENSE))\n - github.com/src-d/gcfg ([BSD-3-Clause](https://github.com/src-d/gcfg/blob/v1.4.0/LICENSE))\n - github.com/xanzy/ssh-agent ([Apache-2.0](https://github.com/xanzy/ssh-agent/blob/v0.2.1/LICENSE))\n - go.opencensus.io ([Apache-2.0](https://github.com/census-instrumentation/opencensus-go/blob/v0.23.0/LICENSE))\n - golang.org/x/crypto ([BSD-3-Clause](https://cs.opensource.google/go/x/crypto/+/5e0467b6:LICENSE))\n - golang.org/x/mod/semver ([BSD-3-Clause](https://cs.opensource.google/go/x/mod/+/86c51ed2:LICENSE))\n - golang.org/x/net ([BSD-3-Clause](https://cs.opensource.google/go/x/net/+/a158d28d:LICENSE))\n - golang.org/x/sys ([BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/8c9f86f7:LICENSE))\n - golang.org/x/tools ([BSD-3-Clause](https://cs.opensource.google/go/x/tools/+/v0.1.12:LICENSE))\n - gopkg.in/src-d/go-billy.v4 ([Apache-2.0](https://github.com/src-d/go-billy/blob/v4.3.2/LICENSE))\n - gopkg.in/src-d/go-git.v4 ([Apache-2.0](https://github.com/src-d/go-git/blob/v4.13.1/LICENSE))\n - gopkg.in/warnings.v0 ([BSD-2-Clause](https://github.com/go-warnings/warnings/blob/v0.1.2/LICENSE))\n```\n\nThis command executes a specified Go template file to generate a report of\nlicenses.  The template file is passed a slice of structs containing license\ndata:\n\n```go\n[]struct {\n  Name        string\n  Version     string\n  LicenseURL  string\n  LicenseName string\n  LicensePath string\n}\n```\n\nEach struct also has a `LicenseText` method which will return the text of the license stored at `LicensePath` if present,\nor an empty string if not.\n\nExample template rendering licenses as markdown:\n\n````\n{{ range . }}\n## {{ .Name }}\n\n* Name: {{ .Name }}\n* Version: {{ .Version }}\n* License: [{{ .LicenseName }}]({{ .LicenseURL }})\n\n```\n{{ .LicenseText }}\n```\n{{ end }}\n````\n\n## Save licenses, copyright notices and source code (depending on license type)\n\n```shell\ngo-licenses save \"github.com/google/go-licenses\" --save_path=\"/tmp/go-licenses-cli\"\n```\n\nThis command analyzes a binary/package's dependencies and determines what needs\nto be redistributed alongside that binary/package in order to comply with the\nlicense terms. This typically includes the license itself and a copyright\nnotice, but may also include the dependency's source code. All of the required\nartifacts will be saved in the directory indicated by `--save_path`.\n\n## Checking for forbidden licenses\n\n```shell\n$ go-licenses check github.com/logrusorgru/aurora\nForbidden license type WTFPL for library github.com/logrusorgru/auroraexit status 1\n```\n\nThis command analyzes a package's dependencies and determines if any are\nconsidered forbidden by the license classifer. See\n[github.com/google/licenseclassifier](https://github.com/google/licenseclassifier/blob/842c0d70d7027215932deb13801890992c9ba364/license_type.go#L323)\nfor licenses considered forbidden.\n\n## Usages\n\n### Global\nTypically, specify the Go package that builds your Go binary.\ngo-licenses expects the same package argument format as `go build`.  For examples:\n\n* A rooted import path like `github.com/google/go-licenses` or `github.com/google/go-licenses/licenses`.\n* A relative path that denotes the package in that directory, like `.` or `./cmd/some-command`.\n\nTo learn more about package argument, run `go help packages`.\n\nTo learn more about go-licenses usages, run `go-licenses help`.\n\n### Report\n\nReport usage (default csv output):\n\n```shell\ngo-licenses report \u003cpackage\u003e [package...]\n```\n\nReport usage (using custom template file):\n\n```shell\ngo-licenses report \u003cpackage\u003e [package...] --template=\u003ctemplate_file\u003e\n```\n\n### Save\n\nSave licenses, copyright notices and source code (depending on license type):\n\n```shell\ngo-licenses save \u003cpackage\u003e [package...] --save_path=\u003csave_path\u003e\n```\n\n### Check\n\nChecking for forbidden and unknown licenses usage:\n\n```shell\ngo-licenses check \u003cpackage\u003e [package...]\n```\n\n**Tip**: Usually you'll want to\n\n* append `/...` to the end of an import path prefix (e.g., your repo path) to include all packages matching that pattern\n* add `--include_tests` to also check packages only imported by testing code (e.g., testing libraries/frameworks)\n\n```shell\ngo-licenses check --include_tests github.com/google/go-licenses/...\n```\n\nChecking for disallowed license types:\n\n```shell\ngo-licenses check \u003cpackage\u003e [package...] --disallowed_types=\u003ccomma separated license types\u003e \n```\n\nSupported license types:\n\n* See `forbidden` list: [github.com/google/licenseclassifier](https://github.com/google/licenseclassifier/blob/e6a9bb99b5a6f71d5a34336b8245e305f5430f99/license_type.go#L341)\n* See `notice` list:  [github.com/google/licenseclassifier](https://github.com/google/licenseclassifier/blob/e6a9bb99b5a6f71d5a34336b8245e305f5430f99/license_type.go#L249)\n* See `permissive` list:  [github.com/google/licenseclassifier](https://github.com/google/licenseclassifier/blob/e6a9bb99b5a6f71d5a34336b8245e305f5430f99/license_type.go#L321)\n* See `reciprocal` list:  [github.com/google/licenseclassifier](https://github.com/google/licenseclassifier/blob/e6a9bb99b5a6f71d5a34336b8245e305f5430f99/license_type.go#L225)\n* See `restricted` list:  [github.com/google/licenseclassifier](https://github.com/google/licenseclassifier/blob/e6a9bb99b5a6f71d5a34336b8245e305f5430f99/license_type.go#L185)\n* See `unencumbered` list:  [github.com/google/licenseclassifier](https://github.com/google/licenseclassifier/blob/e6a9bb99b5a6f71d5a34336b8245e305f5430f99/license_type.go#L324)\n* `unknown`\n\nAllow only specific license names:\n\n```shell\ngo-licenses check \u003cpackage\u003e [package...] --allowed_licenses=\u003ccomma separated license names\u003e \n```\n\n* See supported license names: [github.com/google/licenseclassifier](https://github.com/google/licenseclassifier/blob/e6a9bb99b5a6f71d5a34336b8245e305f5430f99/license_type.go#L28)\n\n### Build tags\n\nTo read dependencies from packages with\n[build tags](https://golang.org/pkg/go/build/#hdr-Build_Constraints). Use the\n`$GOFLAGS` environment variable.\n\n```shell\n$ GOFLAGS=\"-tags=tools\" go-licenses report google.golang.org/grpc/test/tools\ngithub.com/BurntSushi/toml,https://github.com/BurntSushi/toml/blob/master/COPYING,MIT\ngoogle.golang.org/grpc/test/tools,Unknown,Apache-2.0\nhonnef.co/go/tools/lint,Unknown,BSD-3-Clause\ngolang.org/x/lint,Unknown,BSD-3-Clause\ngolang.org/x/tools,Unknown,BSD-3-Clause\nhonnef.co/go/tools,Unknown,MIT\nhonnef.co/go/tools/ssa,Unknown,BSD-3-Clause\ngithub.com/client9/misspell,https://github.com/client9/misspell/blob/master/LICENSE,MIT\ngithub.com/golang/protobuf/proto,https://github.com/golang/protobuf/blob/master/proto/LICENSE,BSD-3-Clause\n```\n\n### Ignoring packages\n\nUse the `--ignore` global flag to specify package path prefixes to be ignored.\nFor example, to ignore your organization's internal packages under `github.com/example-corporation`:\n\n```shell\n$ go-licenses check \\\n    github.com/example-corporation/example-product \\\n    --ignore github.com/example-corporation\n```\n\nNote that dependencies from the ignored packages are still resolved and checked.\nThis flag makes effect to `check`, `report` and `save` commands.\n\n### Include testing packages\n\nUse the `--include_tests` global flag to include packages only imported by testing code (e.g., testing libraries/frameworks).\nExample command:\n\n```shell\ngo-licenses check --include_tests \"github.com/google/go-licenses/...\"\n```\n\nThis flag makes effect to `check`, `report` and `save` commands.\n\n## Warnings and errors\n\nThe tool will log warnings and errors in some scenarios. This section provides\nguidance on addressing them.\n\n### Dependency contains non-Go code\n\nA warning will be logged when a dependency contains non-Go code. This is because\nit is not possible to check the non-Go code for further dependencies, which may\nconceal additional license requirements. You should investigate this code to\ndetermine whether it has dependencies and take action to comply with their\nlicense terms.\n\n### Error discovering URL\n\nIn order to determine the URL where a license file can be viewed, this tool\ngenerally performs the following steps:\n\n1. Locates the license file on disk.\n2. Parses go module metadata and finds the remote repo and version.\n3. Adds the license file path to this URL.\n\nThere are cases this tool finds an invalid/incorrect URL or fails to find the URL.\nWelcome [creating an issue](https://github.com/google/go-licenses/issues).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoogle%2Fgo-licenses","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgoogle%2Fgo-licenses","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoogle%2Fgo-licenses/lists"}