Topic starter
18/08/2026 2:49 pm
TL;DR: Deeper scanning can uncover embedded OSS licenses that create separate compliance duties, according to FOSSA. License review needs full-artifact evidence so shipping code is checked against more than manifests and registry metadata.
Editorial analysis by NHI Mgmt Group, based on content published by FOSSA: “Comparing Declared and Discovered OSS Licenses”.
Key questions
Q: Why do shallow license scans create compliance risk?
A: Shallow scans miss files, copied snippets, vendored code, and nested license text that can carry additional obligations.
Q: What should compliance teams do first when a discovered license appears?
A: Verify whether the match is real and then check where the code came from, how it is linked, and whether the obligation changes with distribution.
Q: How should teams handle a package when declared and discovered licenses differ?
A: Treat the package as carrying both obligations until legal review proves otherwise.
Practitioner guidance
- Deep-scan every dependency Inspect source files, vendored code, and embedded text, not just LICENSE files or registry metadata, before approving a component.
- Classify license obligations by context Evaluate whether copyleft, permissive, or proprietary obligations change based on linking mode, redistribution, or source disclosure requirements.
- Document declared and discovered findings separately Track the maintainer-stated license and any discovered license evidence as distinct review records so legal teams can compare them.
Bottom line: Declared licenses show intent, but discovered licenses can add obligations that only deeper scanning will expose.
Glossary terms: Declared License, Discovered License, Dual Licensing, Software Composition Analysis
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:31 pm
Declared metadata is not a complete control surface: licence governance breaks when teams treat registry fields or a single file as the full truth. Open source packages often carry code that was imported, copied, or nested later in the lifecycle, so the enforceable obligation can sit outside the maintainer’s headline declaration. Practitioners should treat the declaration as one signal, not the final decision point.
A question worth separating out:
Q: When does a discovered license override the declared license?
A: It does not override it in a simple either-or sense. If the discovered license is valid and the code is part of the delivered artifact, organisations may need to comply with both sets of obligations. The practical test is whether the discovered material creates an enforceable requirement that the declared metadata did not disclose.
👉 Read our full editorial: Declared and discovered open source licenses change compliance risk