go license scanning

did i accidentally use any GPL things...

license scan

Open source is fun, but also kinda annoying. See that thing? It's free and available to use, except it has an incompatible license....

Anyway, find out if you're accidentally violating any today

tools

go-licenses is probably your best bet right now.

i tried

go-licenses

This one also tried to discover the url for the licenses, drop stderr to ignore the errors from it not understanding vanity imports.

 1$ git clone https://github.com/google/go-licenses
 2$ cd go-licenses
 3$ go install
 4
 5$ cd ~/w
 6$ go-licenses csv ./... 2>/dev/null
 7go.opentelemetry.io/contrib/instrumentation/host,Unknown,Apache-2.0
 8go.opentelemetry.io/otel/metric,Unknown,Apache-2.0
 9github.com/felixge/httpsnoop,https://github.com/felixge/httpsnoop/blob/master/LICENSE.txt,MIT
10github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg,https://github.com/prometheus/common/blob/master/internal/bitbucket.org/ww/goautoneg/README.txt,BSD-3-Clause
11go.opentelemetry.io/otel/exporters/metric/prometheus,Unknown,Apache-2.0
12github.com/golang/protobuf,https://github.com/golang/protobuf/blob/master/LICENSE,BSD-3-Clause
13github.com/matttproud/golang_protobuf_extensions/pbutil,https://github.com/matttproud/golang_protobuf_extensions/blob/master/pbutil/LICENSE,Apache-2.0
14github.com/prometheus/procfs,https://github.com/prometheus/procfs/blob/master/LICENSE,Apache-2.0
15go.opentelemetry.io/otel,Unknown,Apache-2.0
16github.com/cespare/xxhash/v2,https://github.com/cespare/xxhash/blob/master/v2/LICENSE.txt,MIT
17github.com/prometheus/common,https://github.com/prometheus/common/blob/master/LICENSE,Apache-2.0
18go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp,Unknown,Apache-2.0
19github.com/prometheus/client_golang/prometheus,https://github.com/prometheus/client_golang/blob/master/prometheus/LICENSE,Apache-2.0
20github.com/beorn7/perks/quantile,https://github.com/beorn7/perks/blob/master/quantile/LICENSE,MIT
21go.opentelemetry.io/otel/sdk/export/metric,Unknown,Apache-2.0
22go.opentelemetry.io/otel/sdk,Unknown,Apache-2.0
23github.com/yuin/goldmark-meta,https://github.com/yuin/goldmark-meta/blob/master/LICENSE,MIT
24gopkg.in/yaml.v2,Unknown,Apache-2.0
25github.com/shirou/gopsutil,https://github.com/shirou/gopsutil/blob/master/LICENSE,BSD-3-Clause
26go.opentelemetry.io/contrib,Unknown,Apache-2.0
27github.com/prometheus/client_model/go,https://github.com/prometheus/client_model/blob/master/go/LICENSE,Apache-2.0
28golang.org/x/sys,Unknown,BSD-3-Clause
29go.opentelemetry.io/otel/trace,Unknown,Apache-2.0
30go.opentelemetry.io/contrib/instrumentation/runtime,Unknown,Apache-2.0
31go.opentelemetry.io/otel/sdk/metric,Unknown,Apache-2.0
32go.seankhliao.com/w/v15,Unknown,MIT
33github.com/go-logr/logr,https://github.com/go-logr/logr/blob/master/LICENSE,Apache-2.0
34google.golang.org/protobuf,Unknown,BSD-3-Clause
35k8s.io/klog/v2,Unknown,Apache-2.0
36github.com/yuin/goldmark,https://github.com/yuin/goldmark/blob/master/LICENSE,MIT

wwhrd

I think it's too fine grained? working on the package instead of the module/repo level.

  1$ git clone https://github.com/frapposelli/wwhrd
  2$ cd wwhrc
  3$ go install .
  4
  5$ cd ~/w
  6$ go mod vendor
  7$ wwhrd list
  8INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  9INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/trace
 10INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/set
 11INFO[0001] Found License                                 license=MIT package=github.com/yuin/goldmark/extension
 12INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/metric/controller/time
 13INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/instrumentation
 14INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/encoding/protowire
 15INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/genname
 16INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/filetype
 17INFO[0001] Found License                                 license=MIT package=github.com/beorn7/perks/quantile
 18INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/metric/controller/basic
 19INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/semconv
 20INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/encoding/prototext
 21INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/reflect/protoregistry
 22INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/descfmt
 23INFO[0001] Found License                                 license=MIT package=github.com/go-ole/go-ole
 24INFO[0001] Found License                                 license=Apache-2.0 package=github.com/prometheus/procfs/internal/util
 25INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel
 26INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/trace
 27INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/fieldsort
 28INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/internal/global
 29INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/detrand
 30INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/encoding/tag
 31INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/encoding/messageset
 32INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/metric/aggregator/sum
 33INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/internal/trace/parent
 34INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/pragma
 35INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/internal/baggage
 36INFO[0001] Found License                                 license=Apache-2.0 package=github.com/prometheus/common/model
 37INFO[0001] Found License                                 license=MIT package=github.com/StackExchange/wmi
 38INFO[0001] Found License                                 license=Apache-2.0 package=github.com/prometheus/procfs/internal/fs
 39INFO[0001] Found License                                 license=MIT package=github.com/yuin/goldmark-meta
 40INFO[0001] Found License                                 license=BSD-3-Clause package=github.com/golang/protobuf/ptypes/duration
 41INFO[0001] Found License                                 license=MIT package=github.com/yuin/goldmark/extension/ast
 42INFO[0001] Found License                                 license=Apache-2.0 package=github.com/prometheus/client_golang/prometheus/internal
 43INFO[0001] Found License                                 license=BSD-3-Clause package=github.com/shirou/gopsutil/cpu
 44INFO[0001] Found License                                 license=Apache-2.0 package=github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg
 45INFO[0001] Found License                                 license=BSD-3-Clause package=github.com/shirou/gopsutil/internal/common
 46INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/metric/aggregator/minmaxsumcount
 47INFO[0001] Found License                                 license=Apache-2.0 package=gopkg.in/yaml.v2
 48INFO[0001] Found License                                 license=BSD-3-Clause package=github.com/shirou/gopsutil/mem
 49INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/errors
 50INFO[0001] Found License                                 license=MIT package=github.com/yuin/goldmark/text
 51INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/runtime/protoimpl
 52INFO[0001] Found License                                 license=BSD-3-Clause package=github.com/golang/protobuf/ptypes/any
 53INFO[0001] Found License                                 license=BSD-3-Clause package=golang.org/x/sys/unix
 54INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/internal
 55INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/export/trace
 56INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/encoding/text
 57INFO[0001] Found License                                 license=MIT package=github.com/felixge/httpsnoop
 58INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/flags
 59INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/propagation
 60INFO[0001] Found License                                 license=BSD-3-Clause package=github.com/shirou/gopsutil/process
 61INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/attribute
 62INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/metric/global
 63INFO[0001] Found License                                 license=Apache-2.0 package=github.com/prometheus/procfs
 64INFO[0001] Found License                                 license=Apache-2.0 package=github.com/prometheus/client_golang/prometheus/promhttp
 65INFO[0001] Found License                                 license=MIT package=github.com/yuin/goldmark/ast
 66INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/metric
 67INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/internal
 68INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/unit
 69INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/internal/metric
 70INFO[0001] Found License                                 license=MIT package=github.com/yuin/goldmark/util
 71INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/metric
 72INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/metric/registry
 73INFO[0001] Found License                                 license=BSD-3-Clause package=golang.org/x/sys/internal/unsafeheader
 74INFO[0001] Found License                                 license=BSD-3-Clause package=github.com/golang/protobuf/ptypes/timestamp
 75INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/version
 76INFO[0001] Found License                                 license=Apache-2.0 package=k8s.io/klog/v2/klogr
 77INFO[0001] Found License                                 license=Apache-2.0 package=github.com/prometheus/client_golang/prometheus
 78INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/types/known/anypb
 79INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/runtime/protoiface
 80INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/export/metric
 81INFO[0001] Found License                                 license=Apache-2.0 package=github.com/prometheus/common/expfmt
 82INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/fieldnum
 83INFO[0001] Found License                                 license=MIT package=github.com/yuin/goldmark/renderer
 84INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/encoding/defval
 85INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/metric/selector/simple
 86INFO[0001] Found License                                 license=MIT package=github.com/cespare/xxhash/v2
 87INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/metric/aggregator/exact
 88INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/strs
 89INFO[0001] Found License                                 license=BSD-3-Clause package=github.com/shirou/gopsutil/net
 90INFO[0001] Found License                                 license=MIT package=github.com/yuin/goldmark/parser
 91INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/contrib
 92INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/resource
 93INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/contrib/instrumentation/runtime
 94INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/filedesc
 95INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/proto
 96INFO[0001] Found License                                 license=MIT package=github.com/go-ole/go-ole/oleutil
 97INFO[0001] Found License                                 license=Apache-2.0 package=github.com/prometheus/client_model/go
 98INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/metric/aggregator
 99INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/impl
100INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/metric/aggregator/histogram
101INFO[0001] Found License                                 license=Apache-2.0 package=github.com/matttproud/golang_protobuf_extensions/pbutil
102INFO[0001] Found License                                 license=BSD-3-Clause package=golang.org/x/sys/windows
103INFO[0001] Found License                                 license=MIT package=github.com/yuin/goldmark/renderer/html
104INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/descopts
105INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/types/known/durationpb
106INFO[0001] Found License                                 license=BSD-3-Clause package=github.com/golang/protobuf/proto
107INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/internal/mapsort
108INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/metric/aggregator/lastvalue
109INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/exporters/metric/prometheus
110INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/metric/processor/basic
111INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/internal/trace/noop
112INFO[0001] Found License                                 license=Apache-2.0 package=k8s.io/klog/v2
113INFO[0001] Found License                                 license=Apache-2.0 package=github.com/go-logr/logr
114INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/types/known/timestamppb
115INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/codes
116INFO[0001] Found License                                 license=MIT package=github.com/yuin/goldmark
117INFO[0001] Found License                                 license=BSD-3-Clause package=google.golang.org/protobuf/reflect/protoreflect
118INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/metric/number
119INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/contrib/instrumentation/host
120INFO[0001] Found License                                 license=BSD-3-Clause package=github.com/golang/protobuf/ptypes
121INFO[0001] Found License                                 license=Apache-2.0 package=go.opentelemetry.io/otel/sdk/export/metric/aggregation

golicense

This works on final binaries, so no test dependencies included...

also reaches out to github.

 1$ git clone https://github.com/mitchellh/golicense
 2$ cd golicense
 3$ go install .
 4
 5$ cd ~/w
 6$ go build ./cmd/w
 7$ golicense -plain w
 8github.com/beorn7/perks                                       MIT License
 9github.com/prometheus/common                                  Apache License 2.0
10github.com/cespare/xxhash                                     MIT License
11github.com/golang/protobuf                                    BSD 3-Clause "New" or "Revised" License
12github.com/shirou/gopsutil                                    BSD 3-Clause "New" or "Revised" License
13github.com/prometheus/client_golang                           Apache License 2.0
14github.com/prometheus/client_model                            Apache License 2.0
15go.opentelemetry.io/contrib                                   Apache License 2.0
16go.opentelemetry.io/otel                                      Apache License 2.0
17go.opentelemetry.io/contrib/instrumentation/runtime           Apache License 2.0
18github.com/felixge/httpsnoop                                  MIT License
19github.com/go-logr/logr                                       Apache License 2.0
20github.com/prometheus/procfs                                  Apache License 2.0
21golang.org/x/sys                                              BSD 3-Clause "New" or "Revised" License
22go.opentelemetry.io/otel/trace                                Apache License 2.0
23google.golang.org/protobuf                                    BSD 3-Clause "New" or "Revised" License
24go.opentelemetry.io/otel/metric                               Apache License 2.0
25go.opentelemetry.io/contrib/instrumentation/host              Apache License 2.0
26go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp Apache License 2.0
27go.opentelemetry.io/otel/exporters/metric/prometheus          Apache License 2.0
28k8s.io/klog                                                   Apache License 2.0
29github.com/matttproud/golang_protobuf_extensions              Apache License 2.0
30go.opentelemetry.io/otel/sdk                                  Apache License 2.0
31go.opentelemetry.io/otel/sdk/metric                           Apache License 2.0
32go.opentelemetry.io/otel/sdk/export/metric                    Apache License 2.0

lc

only walks filesystem paths (works better if you vendor all your deps)

 1$ git clone https://github.com/boyter/lc
 2$ cd lc
 3$ ./generate_database.sh
 4$ go install .
 5
 6$ cd ~/w
 7$ go mod vendor
 8$ lc
 9LICENSE
10 likely licence; unable to identify
11content/blog/12019-06-18-license-to-hack.md
12 likely licence; unable to identify
13content/blog/12021-04-13-go-license-scanning.md
14 likely licence; unable to identify
15vendor/github.com/StackExchange/wmi/LICENSE
16 likely licence; unable to identify
17vendor/github.com/beorn7/perks/LICENSE
18 likely licence; unable to identify
19vendor/github.com/cespare/xxhash/v2/LICENSE.txt
20 likely licence; unable to identify
21vendor/github.com/felixge/httpsnoop/LICENSE.txt
22 likely licence; unable to identify
23vendor/github.com/go-logr/logr/LICENSE
24 Blended Apache-2.0 82.67973856209152
25vendor/github.com/go-ole/go-ole/LICENSE
26 likely licence; unable to identify
27vendor/github.com/golang/protobuf/LICENSE
28 Blended BSD-3-Clause 79.60701512785884
29vendor/github.com/matttproud/golang_protobuf_extensions/LICENSE
30 Blended Apache-2.0 82.67973856209152
31vendor/github.com/prometheus/client_golang/LICENSE
32 Blended Apache-2.0 82.67973856209152
33vendor/github.com/prometheus/client_model/LICENSE
34 Blended Apache-2.0 82.67973856209152
35vendor/github.com/prometheus/common/LICENSE
36 Blended Apache-2.0 82.67973856209152
37vendor/github.com/prometheus/procfs/LICENSE
38 Blended Apache-2.0 82.67973856209152
39vendor/github.com/shirou/gopsutil/LICENSE
40 Blended BSD-3-Clause 79.44269573919561
41vendor/github.com/yuin/goldmark/LICENSE
42 likely licence; unable to identify
43vendor/github.com/yuin/goldmark-meta/LICENSE
44 likely licence; unable to identify
45vendor/go.opentelemetry.io/contrib/LICENSE
46 Blended Apache-2.0 82.67973856209152
47vendor/go.opentelemetry.io/contrib/instrumentation/host/LICENSE
48 Blended Apache-2.0 82.67973856209152
49vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/LICENSE
50 Blended Apache-2.0 82.67973856209152
51vendor/go.opentelemetry.io/contrib/instrumentation/runtime/LICENSE
52 Blended Apache-2.0 82.67973856209152
53vendor/go.opentelemetry.io/otel/LICENSE
54 Blended Apache-2.0 82.67973856209152
55vendor/go.opentelemetry.io/otel/exporters/metric/prometheus/LICENSE
56 Blended Apache-2.0 82.67973856209152
57vendor/go.opentelemetry.io/otel/metric/LICENSE
58 Blended Apache-2.0 82.67973856209152
59vendor/go.opentelemetry.io/otel/sdk/LICENSE
60 Blended Apache-2.0 82.67973856209152
61vendor/go.opentelemetry.io/otel/sdk/export/metric/LICENSE
62 Blended Apache-2.0 82.67973856209152
63vendor/go.opentelemetry.io/otel/sdk/metric/LICENSE
64 Blended Apache-2.0 82.67973856209152
65vendor/go.opentelemetry.io/otel/trace/LICENSE
66 Blended Apache-2.0 82.67973856209152
67vendor/golang.org/x/sys/LICENSE
68 Blended BSD-3-Clause 79.63331092357137
69vendor/golang.org/x/sys/unix/syscall_bsd.go
70 likely licence; unable to identify
71vendor/golang.org/x/sys/unix/xattr_bsd.go
72 likely licence; unable to identify
73vendor/google.golang.org/protobuf/LICENSE
74 likely licence; unable to identify
75vendor/gopkg.in/yaml.v2/LICENSE
76 Blended Apache-2.0 82.67973856209152
77vendor/gopkg.in/yaml.v2/LICENSE.libyaml
78 likely licence; unable to identify
79vendor/k8s.io/klog/v2/LICENSE
80 likely licence; unable to identify

go-license-detector

Doesn't seem to find anything from my dependencies?

1$ git clone https://github.com/go-enry/go-license-detector
2$ cd go-license-detector
3$ go install ./cmd/license-detector
4
5$ cd ~/w
6$ license-detector .
7.
8        95%        MIT
9        82%        MIT-0

other tools

snyk

apparently it can do this? but I think you have to link your source code to their online service...

licensed

don't know how to run ruby, also works on file paths only (vendor)