Go¶

ID: go
Home page: https://go.dev
Version requirement: >= 1.16
Platforms: 🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows
Operations: installed · install
purl types: pkg:go
CLI name: go
Issues and PRs: 📦 manager: go
Source: meta_package_manager/managers/go.py

The Go toolchain, wrapped for the binaries go install puts on the machine.

A package here is a command, not a library: go install <path>@<version> compiles one and writes it into the toolchain’s binary directory, where it stays until the file is deleted. Libraries are a module’s own business and are scoped to the module that declares them, so they are outside what a system package manager can address.

Note

The inventory is go version -m, not go list. Pointed at a directory, go version walks it recursively and reports the build information Go embeds in every binary it produced, which over the binary directory is exactly the set go install created. go list answers for the module in the working directory instead, so it reports nothing about the host.

Caution

Go has no uninstall verb, in any scope: removing a command means deleting its file, which is not something a wrapper should do behind the tool’s back. Nothing reports staleness either. Both absences are why nao1215/gup exists as a separate tool.

Documentation: go install.

What `mpm` adds to `go`¶

mpm reaches across every manager at once, not go alone: mpm installed and mpm outdated cover go alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Operations¶

Operation	Supported
`installed`	✓
`outdated`
`orphans`
`search`
`install`	✓
`upgrade`
`upgrade_all`
`remove`
`sync`
`cleanup`
`doctor`

Selecting and configuring `go`¶

Deselect go for a single run with --no-go, or persist the choice in your configuration:

[mpm]
go = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.go]
timeout = 900

mpm config-template go prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around go, one mpm command each:

Snapshot and clone a machine: mpm --go dump go.toml, then mpm restore go.toml on the next one.
Export a compliance SBOM: mpm --go sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

State of Go’s release-age gating, from the cooldown support table:

Status: ❌ None (Go module proxy, no publication-date filter)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Go module proxy (pkg:golang)
Retraction: Retraction marker: a version stays served forever, the proxy being an immutable cache, so it is withdrawn by the author adding a retract directive to a newer go.mod that clients then skip
Publish date: ❌ no CLI surface prints one, though the proxy does serve a per-version .info timestamp

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version probe¶

The version is probed by running:

$ go --version
go version go1.27.0 darwin/arm64

and extracted with:

r"go\s+version\s+go(?P<version>\S+)\s"

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Go well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ go version -m /tmp/mpm-drive/go/bin
/tmp/mpm-drive/go/bin/gup: go1.27.0
        path	github.com/nao1215/gup
        mod	github.com/nao1215/gup	v1.8.1	h1:An1c11EdZ36h40GDhtbx5NSRwbKvaEbjwOODwkBDjw4=
        dep	github.com/adrg/xdg	v0.5.3	h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
        dep	github.com/cpuguy83/go-md2man/v2	v2.0.6	h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
        dep	github.com/fatih/color	v1.19.0	h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
        dep	github.com/gen2brain/beeep	v0.11.2	h1:+KfiKQBbQCuhfJFPANZuJ+oxsSKAYNe88hIpJuyKWDA=
        dep	github.com/hashicorp/go-version	v1.9.0	h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
        dep	github.com/jackmordaunt/icns/v3	v3.0.1	h1:xxot6aNuGrU+lNgxz5I5H0qSeCjNKp8uTXB1j8D4S3o=
        dep	github.com/mattn/go-colorable	v0.1.15	h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
        dep	github.com/mattn/go-isatty	v0.0.20	h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
        dep	github.com/nfnt/resize	v0.0.0-20180221191011-83c6a9932646	h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=
        dep	github.com/russross/blackfriday/v2	v2.1.0	h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
        dep	github.com/spf13/cobra	v1.10.2	h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
        dep	github.com/spf13/pflag	v1.0.9	h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
        dep	go.yaml.in/yaml/v3	v3.0.4	h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
        dep	golang.org/x/sys	v0.42.0	h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
        build	-buildmode=exe
        build	-compiler=gc
        build	DefaultGODEBUG=cryptocustomrand=1,tlssecpmlkem=0,tracebacklabels=0,urlstrictcolons=0,x509sslcertoverrideplatform=0
        build	CGO_ENABLED=1
        build	CGO_CFLAGS=
        build	CGO_CPPFLAGS=
        build	CGO_CXXFLAGS=
        build	CGO_LDFLAGS=
        build	GOARCH=arm64
        build	GOOS=darwin
        build	GOARM64=v8.0
/tmp/mpm-drive/go/bin/hello: go1.27.0
        path	golang.org/x/example/hello
        mod	golang.org/x/example/hello	v0.0.0-20250915201037-7f05d217867b	h1:+gZE2jOdiscYByu0606Uw8Ldir2Cecd39Vq/3IEasRA=
        build	-buildmode=exe
        build	-compiler=gc
        build	DefaultGODEBUG=containermaxprocs=0,cryptocustomrand=1,decoratemappings=0,gotestjsonbuildtext=1,httpcookiemaxnum=0,httplaxcontentlength=1,httpmuxgo121=1,httpservecontentkeepheaders=1,multipathtcp=0,panicnil=1,randseednop=0,rsa1024min=0,tlsmlkem=0,tlssecpmlkem=0,tlssha1=1,tracebacklabels=0,updatemaxprocs=0,urlmaxqueryparams=0,urlstrictcolons=0,winreadlinkvolume=0,winsymlink=0,x509negativeserial=1,x509rsacrt=0,x509sha256skid=0,x509sslcertoverrideplatform=0,x509usepolicies=0
        build	CGO_ENABLED=1
        build	CGO_CFLAGS=
        build	CGO_CPPFLAGS=
        build	CGO_CXXFLAGS=
        build	CGO_LDFLAGS=
        build	GOARCH=arm64
        build	GOOS=darwin
        build	GOARM64=v8.0

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --go installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

8.0.0.dev0 (unreleased)
- Add Go package manager, listing and installing the commands go install puts on the machine.