Go

ID

go

Links

Home page · Documentation · Repository · Wikipedia

Upstream stars

⭐ 139,303

Last commit

2026-10-06

Version requirement

>= 1.16

Platforms

🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows

Operations

installed · install

purl types

pkg:go/ · pkg:golang/

CLI name

go

Issues and PRs

📦 manager: go-based

Source

go.py

The Go toolchain, wrapped for the binaries go install puts on the machine.

A package here is a command, not a library: go install <path>@<version> compiles one and writes it into the toolchain’s binary directory, where it stays until the file is deleted. Libraries are a module’s own business and are scoped to the module that declares them, so they are outside what a system package manager can address.

What mpm adds to go

mpm reaches across every manager at once, not go alone: mpm installed and mpm outdated cover go alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Operations

Operation

Supported

Notes

installed

✅

outdated

❌

Nothing reports staleness: nao1215/gup is the separate tool built to fill that gap.

orphans

search

install

✅

upgrade

upgrade_all

remove

❌

Go has no uninstall verb in any scope; removing a command means deleting its file.

sync

cleanup

doctor

Configuration

  • Ignore go on the mpm CLI by passing the --no-go option.

  • Ignore it for every run in your configuration:

    [mpm]
go = false

  • Raise the timeout of all go calls:

    [mpm.overrides.go]
timeout = 900

  • Run mpm config-template go to print all overridable settings for your configuration file:

    [mpm.overrides.go]
cli_names = [
    "go",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = []
pre_cmds = []
requirement = ">=1.16.0"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "go\\s+version\\s+go(?P<version>\\S+)\\s",
]

Recipes

A few jobs you would otherwise script around go, one mpm command each:

  • Snapshot and clone a machine: mpm --go dump go.toml, then mpm restore go.toml on the next one.

  • Export a compliance SBOM: mpm --go sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown

State of Go’s release-age gating, from the cooldown support table:

Status: ❌ None (Go module proxy, no publication-date filter)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: Go module proxy (pkg:golang)

  • Retraction: Retraction marker: a version stays served forever, the proxy being an immutable cache, so it is withdrawn by the author adding a retract directive to a newer go.mod that clients then skip

  • Publish date: ❌ no CLI surface prints one, though the proxy does serve a per-version .info timestamp

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know Go well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ go version -m /tmp/mpm-drive/go/bin
/tmp/mpm-drive/go/bin/gup: go1.27.0
        path	github.com/nao1215/gup
        mod	github.com/nao1215/gup	v1.8.1	h1:An1c11EdZ36h40GDhtbx5NSRwbKvaEbjwOODwkBDjw4=
        dep	github.com/adrg/xdg	v0.5.3	h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
        dep	github.com/cpuguy83/go-md2man/v2	v2.0.6	h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
        dep	github.com/fatih/color	v1.19.0	h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
        dep	github.com/gen2brain/beeep	v0.11.2	h1:+KfiKQBbQCuhfJFPANZuJ+oxsSKAYNe88hIpJuyKWDA=
        dep	github.com/hashicorp/go-version	v1.9.0	h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
        dep	github.com/jackmordaunt/icns/v3	v3.0.1	h1:xxot6aNuGrU+lNgxz5I5H0qSeCjNKp8uTXB1j8D4S3o=
        dep	github.com/mattn/go-colorable	v0.1.15	h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
        dep	github.com/mattn/go-isatty	v0.0.20	h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
        dep	github.com/nfnt/resize	v0.0.0-20180221191011-83c6a9932646	h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=
        dep	github.com/russross/blackfriday/v2	v2.1.0	h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
        dep	github.com/spf13/cobra	v1.10.2	h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
        dep	github.com/spf13/pflag	v1.0.9	h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
        dep	go.yaml.in/yaml/v3	v3.0.4	h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
        dep	golang.org/x/sys	v0.42.0	h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
        build	-buildmode=exe
        build	-compiler=gc
        build	DefaultGODEBUG=cryptocustomrand=1,tlssecpmlkem=0,tracebacklabels=0,urlstrictcolons=0,x509sslcertoverrideplatform=0
        build	CGO_ENABLED=1
        build	CGO_CFLAGS=
        build	CGO_CPPFLAGS=
        build	CGO_CXXFLAGS=
        build	CGO_LDFLAGS=
        build	GOARCH=arm64
        build	GOOS=darwin
        build	GOARM64=v8.0
/tmp/mpm-drive/go/bin/hello: go1.27.0
        path	golang.org/x/example/hello
        mod	golang.org/x/example/hello	v0.0.0-20250915201037-7f05d217867b	h1:+gZE2jOdiscYByu0606Uw8Ldir2Cecd39Vq/3IEasRA=
        build	-buildmode=exe
        build	-compiler=gc
        build	DefaultGODEBUG=containermaxprocs=0,cryptocustomrand=1,decoratemappings=0,gotestjsonbuildtext=1,httpcookiemaxnum=0,httplaxcontentlength=1,httpmuxgo121=1,httpservecontentkeepheaders=1,multipathtcp=0,panicnil=1,randseednop=0,rsa1024min=0,tlsmlkem=0,tlssecpmlkem=0,tlssha1=1,tracebacklabels=0,updatemaxprocs=0,urlmaxqueryparams=0,urlstrictcolons=0,winreadlinkvolume=0,winsymlink=0,x509negativeserial=1,x509rsacrt=0,x509sha256skid=0,x509sslcertoverrideplatform=0,x509usepolicies=0
        build	CGO_ENABLED=1
        build	CGO_CFLAGS=
        build	CGO_CPPFLAGS=
        build	CGO_CXXFLAGS=
        build	CGO_LDFLAGS=
        build	GOARCH=arm64
        build	GOOS=darwin
        build	GOARM64=v8.0

Version check

The version is probed by running:

$ go --version
go version go1.27.0 darwin/arm64

and extracted with:

r"go\s+version\s+go(?P<version>\S+)\s"

Upstream project

Metrics

golang/go

Activity

commit activity open issues open pull requests

Popularity

forks watchers contributors

Metadata

latest tag license main language

Changelog

  • 8.0.0 (2026-09-20)

    • Resolve the pkg:conda, pkg:golang, pkg:haxe and pkg:nuget pURL types to these managers, which raised instead of routing.

    • Add the Go package manager, listing and installing the commands go install puts on the machine.