Open-Source Licenses

Maintain a repeatable inventory of third-party packages used by the application, platform API, tool services, retrieval services, build tooling, and deployed images.

Inventory Fields

For each component, capture:

• product area and deployable artifact,
• package manager,
• package name and resolved version,
• direct or transitive scope,
• detected license and source of license metadata,
• copyright or notice requirement,
• review status and owner,
• vulnerability or end-of-life evidence where tracked separately.

Review Workflow

1. Generate inventories from lock files and resolved build outputs, not only manifest files.
2. Normalize license identifiers where possible.
3. Investigate unknown, missing, custom, copyleft, source-available, or conflicting metadata.
4. Review direct dependencies and packages included in distributed artifacts with legal or procurement owners.
5. Produce required notices and attribution.
6. Record approved exceptions and replacement plans.
7. Regenerate the inventory for releases and compare it with the previously approved baseline.

Package count alone does not establish compliance. The distribution model, linking, modification, hosted-service use, model or dataset terms, and customer contract can affect the review.

Customer-Safe Output

A customer-facing inventory may include product area, package, version, license, and scope. Exclude local paths, private repository names, raw engineering logs, credentials, and unrelated build metadata.

Treat unknown license metadata as an item to resolve, not as an acceptable license category. Obtain legal review when obligations or compatibility are unclear.