It's pretty rare there are parts with "unclear" licensing. Does it happen? Sure. But "often"? I'm fairly sure that almost all projects are receptive to updates

It's pretty rare there are parts with "unclear" licensing. Does it happen? Sure. But "often"? I'm fairly sure that almost all projects are receptive to updates for dependencies with security issues; I don't see why a distro needs to "untangle" anything for them. > with system wide dependency you just update that and you are done Unless the system-wide update won't work with your program. The entire point of the Go tooling is that you can reliably and consistently build your software, and replacing random parts to create a weird unsupported (by the actual developers anyway) version is something the Go tooling was never designed to support: it goes exactly against what it was designed to do. Hence my previous comment: perhaps this isn't the best of ideas.