`go-licenses` fails with newer Go versions, also unmaintained.

[ringods]

After upgrading the Go version, the go-licenses based license checker fails to install:

https://github.com/pulumiverse/pulumi-talos/actions/runs/17488569455/job/49672936606

I was also looking upstream for possible fixes, but bumped into this issue mentioning go-licenses is no longer maintained:

google/go-licenses#332

Should we search for a new license compliance tool?

[Graham-Pedersen]

Hmmmm yeah it does seem like we should probably switch. Support only ended like last week based on the linked post. Should we possibly wait to see if community support gets picked up? If this is blocking our builds in the meantime obviously we will need a short term fix.

Also what urgency do we think we should approach finding a new license checker? It is unclear to me how much value this adds. Let me reach out to Matt

[mjeffryes]

We're actually already using a fork of this project: pulumi/go-licenses I noticed there's some changes from the upstream we could try picking up there (uses some newer github actions, bumps the go version). We could try picking those up to see if that's enough to resolve.

[ringods]

@mjeffryes I'm assuming that picking some commits from upstream will only save us a bit of time now, but defers the actual problem of this tool being unmaintained.

While the Github issue mentioning the tool is unmaintained is only created 3 weeks ago, the last actual commit is already from August 2023.

@Graham-Pedersen the main reason for the fork is to add checking for the BSL license, which was needed when Hashicorp changed their product licenses. go-licenses takes license information from the licenseclassifier repo. Months ago, I submitted the info for the BSL license to that project, but that also seems to be not or hardly maintained as my PR is still open:

google/licenseclassifier#68

[Graham-Pedersen]

Sounds good. I will both take a look at pulling over the latest commits on the fork and starting to see if there is a better long term prospect to do this work.

[Graham-Pedersen]

Well there have been 3 recent commits upstream. As long as the community continues to update it (and we can also contribute upstream commits) I would recommend we continue to use this.

Also, a quick google search to find a similar tool was not promising. I think this is further reason to stay on this, and to strongly suspect that the community will support this package (on account of there is not another good option to coalesce around).

I will close this issue once I get the latest and greatest running with the newer go versions.

[Graham-Pedersen]

New updated version is in prod and passing tests.