tl;dr:"We’ve got distributions of a Go package that includes entirely unlicensed code. We’ve got a host of Go packages that may not be complying with the terms of the license, when the distributions can even agree what the license is. And it’s apparently not limited to just go. Is this normal? Is this legal? I don’t really know."