golang/go
github.com
observed at c7e6da5c — 2 of 4 criteria failed; LLM audit unavailable
No
.oss-verified/attestation.bundle in this repo. We ran the oss-verify CLI against it ourselves on 2026-05-28.This is our observation, not a signed credential. To publish your own attestation, add the GitHub Action / GitLab include from better-internet-org/oss-verify to this repo.
Criteria (observed)
- ✓ reuse
- 14718 of 14718 source files lack per-file SPDX headers, but a repo-level license declaration (LICENSE file or package.json) is present. Accepted as a blanket declaration.
- ✓ osi_license
- Declared 'BSD-3-Clause' (detected via LICENSE text match) resolves to OSI-approved leaves: BSD-3-Clause
- ✗ dependency_licenses
- No supported ecosystem detected at the repo root. Supported today: JavaScript/Node (package.json) and Cargo (Cargo.lock). Go and Python are tracked as follow-up work and currently fail closed.
- ✗ no_proprietary_blobs
- Found 18 suspect file(s): - lib/fips140/v1.0.0-c2097c7c.zip (binary, 658130 bytes, entropy 7.95 bits/byte) - lib/fips140/v1.26.0.zip (binary, 676132 bytes, entropy 7.95 bits/byte) - src/cmd/compile/default.pgo (binary, 293923 bytes, entropy 8.00 bits/byte) - src/cmd/objdump/testdata/go116.o (proprietary binary extension) - src/compress/bzip2/testdata/Isaac.Newton-Opticks.txt.bz2 (binary, 132469 bytes, entropy 7.99 bits/byte) - src/crypto/internal/fips140/nistec/p256_table.go (avg line length 3276 chars — minified-without-source?) - src/debug/gosym/testdata/pcln115.gz (binary, 124875 bytes, entropy 7.99 bits/byte) - src/go/internal/gccgoimporter/testdata/libimportsar.a (proprietary binary extension) - src/go/internal/gcimporter/testdata/versions/test_go1.11_0i.a (proprietary binary extension) - src/go/internal/gcimporter/testdata/versions/test_go1.11_6b.a (proprietary binary extension) - src/go/internal/gcimporter/testdata/versions/test_go1.11_999b.a (proprietary binary extension) - src/go/internal/gcimporter/testdata/versions/test_go1.11_999i.a (proprietary binary extension) - src/go/internal/gcimporter/testdata/versions/test_go1.7_0.a (proprietary binary extension) - src/go/internal/gcimporter/testdata/versions/test_go1.7_1.a (proprietary binary extension) - src/go/internal/gcimporter/testdata/versions/test_go1.8_4.a (proprietary binary extension) - src/go/internal/gcimporter/testdata/versions/test_go1.8_5.a (proprietary binary extension) - src/internal/trace/traceviewer/static/webcomponents.min.js (minified, no source / sourcemap counterpart) - src/regexp/testdata/re2-exhaustive.txt.bz2 (binary, 428262 bytes, entropy 7.79 bits/byte) Maintainers may exempt files via .oss-verified.toml (not yet wired in this MVP).
Run
- Repository
- https://github.com/golang/go
- Last checked
- 2026-05-28T10:42:53.389Z
- Commit
- c7e6da5ca59645de42e5d28829ff37452fce16ca
- Overall result
- failing
- Deterministic checks
- failed
- LLM audit
- unavailable — API error; will retry on the next watchlist cycle
show raw error
3/3 passes blocked: Anthropic API call failed (429) after 4 attempts: {"type":"error","error":{"type":"rate_limit_error","message":"This request would exceed your organization's rate limit of 30,000 input tokens per minute (org: 62638852-fd7d-4b3c-abb7-9d300e93c6ea, mod | Anthropic API call failed (429) after 4 attempts: {"type":"error","error":{"type":"rate_limit_error","message":"This request would exceed your organization's rate limit of 30,000 input tokens per minute (org: 62638852-fd7d-4b3c-abb7-9d300e93c6ea, mod | Anthropic API call failed (429) after 4 attempts: {"type":"error","error":{"type":"rate_limit_error","message":"This request would exceed your organization's rate limit of 30,000 input tokens per minute (org: 62638852-fd7d-4b3c-abb7-9d300e93c6ea, mod - Recheck interval
- 30 days