Agent WranglersTDD-6Recommended
List the licences of the code and every dependency
Produce a bill of materials with an SPDX licence identifier for every package, and assess each copyleft, unknown or missing licence in writing.
How to do it
A strong copyleft licence such as the GPL or AGPL can oblige the company to publish its own code. It depends on how the product is shipped or served. A package with no licence gives no right to use it at all. Generate the list with an SBOM tool, as Publish what is in each release says. The Trivy setup in Use cosign to sign release images and their bill of materials already writes one. Generated code can copy licensed code, so check Check where generated code came from too. A lawyer judges the findings. The review lists them.
How to check
The bill of materials, in SPDX or CycloneDX format, gives a licence for every package. Every copyleft, unknown or missing licence has a written assessment in the report.
Sources
Related rules
- OSS-2 Writing your own licence or changing a standard one in Open source maintenance
- OSS-4 Declare the licence in the package metadata in Open source maintenance
- OSS-42 Check every dependency licence against an allow list in CI in Open source maintenance
- TDD-5 Confirm the company owns the code in Technical due diligence
- APS-75 Publish what is in each release in Application security
- STK-95 Use cosign to sign release images and their bill of materials in Software choices
- AID-21 Check where generated code came from in AI-assisted development
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/due-diligence/code-and-ownership/licence-inventory">Agent Wranglers technical due diligence playbook</a>. In code you write, add a comment next to it with the same link.