3 ms·
It goes transitively though. Some popular go packages grab tens (sometimes over hundres, but not as much as in node world) dependencies. NOBODY checks the lic
by shp0ngle 3y ago
It goes transitively though.
Some popular go packages grab tens (sometimes over hundres, but not as much as in node world) dependencies.
NOBODY checks the license all the transitive dependencies in go world.
What should or should not happen is one thing, this is the reality
edit: oh but that lead me to google this
neat
https://github.com/google/go-licenses https://github.com/google/go-licenses
- Tomte 3y agoYes, that's why (apart from the Cyber Resilience Act) license scanners and SBOMs are a thing.