SECNET / FIELD GUIDE · Engineering

Software licensing: make the shipped artifact explainable

Open-source and commercial software licensing is separate from export authorization. An SBOM records components; it does not automatically prove license compliance, absence of vulnerabilities or safe provenance. This original release workflow uses SPDX as a reference for structured component/license information.

SecNet learning series · 1.0 · Source check: 2026-10-11

Original SecNet educational content. Examples are fictional; this is not a publication or endorsement by the referenced organizations.

An exploded software assembly matches dependency blocks and license cards to a shipping package.
Original AI-assisted educational illustration; not an incident photograph or technical architecture.
SECNET / VISUAL LAB · INFORMATION / RISK

Information security · three objectives

Controls protect different properties of an information asset.

INTERACTIVE
Confidentiality
01 / 01 · Confidentiality

Limit access, protect stored/transmitted data, and review sharing decisions.

Show process diagram
Inventory → Evidence → Obligations → Package → Reconcile
A summary of the workflow; detailed steps follow below.

How to plan and execute

  1. Inventory the actual shipped build, transitive dependencies, embedded assets and copied code. Distinguish development-only components from what customers receive or access.
  2. Collect license expressions, notices, origin and versions with evidence. Treat unknown, conflicting or custom license text as a review item rather than guessing a familiar license.
  3. Review obligations against distribution, modification, linking and network-service use with qualified license review. Do not assume all copyleft licenses have identical conditions.
  4. Prepare the required notices, license texts and any applicable source/offers or other artifacts. Verify that the delivered package contains the approved materials.
  5. Assess dependency security and provenance in parallel but keep conclusions distinct. A vulnerability patch can introduce a new license or component requiring review.
  6. Link the approved SBOM and review record to the immutable release digest. Reconcile changes on upgrades and route unresolved obligations to an accountable decision.

Tools & work records

  • SPDX — structured component/license representation; record document version and artifact relationship.
  • ScanCode Toolkit — detect license/copyright evidence; detections require review and do not issue a legal verdict.
  • Trivy — dependency/SBOM and license-related inspection where supported; reconcile output against the actual release.

What reports are produced?

  • Release-linked component inventory/SBOM and provenance gaps.
  • License-obligation matrix with review decisions and evidence.
  • Delivered notices/source artifacts and exception/change record.
FICTIONAL WORKED EXAMPLE

Connect the decision to evidence

Fictional release: the source repository has an SBOM, but the container includes another dependency added during packaging. The team compares the image inventory with the repository inventory, reviews the extra component’s license and updates the delivered notices. The release record refers to the container digest, preventing approval of one artifact from being silently reused for another.

Closure check

  • Actual shipped artifact inventoried?
  • Unknown licenses and obligations reviewed?
  • Notices and review match the release digest?
Download report workpaper (.md) ↓

Official sources

Use these sources for criteria, tools and regulations; verify applicability and version for the actual assessment.