Looking for example at git-lfs:
I am afraid that the license field is wrong. Since the Go packages are
statically linked, that means also content of all the BR is part of the
binary packages and therefore should include their licenses. This also
applies to Rust and all other statically linked packages.
I believe the guidelines should be amended to handle this scenario and
all the packages fixed appropriately.