Topic starter
18/08/2026 2:49 pm
TL;DR: Declared licenses show what maintainers intend, but discovered licenses reveal what is actually embedded in the codebase, and both can create enforceable obligations according to FOSSA. That distinction matters because compliance failures often start with shallow scanning, not with missing policy language, so license governance must extend beyond manifests and registry metadata.
Editorial analysis by NHI Mgmt Group, based on content published by FOSSA: “Comparing Declared and Discovered OSS Licenses”.
Key questions
Q: How should teams handle a package when declared and discovered licenses differ?
A: Treat the package as carrying both obligations until legal review proves otherwise.
Q: Why do shallow license scans create compliance risk?
A: Shallow scans miss files, copied snippets, vendored code, and nested license text that can carry additional obligations.
Q: What should compliance teams do first when a discovered license appears?
A: Verify whether the match is real and then check where the code came from, how it is linked, and whether the obligation changes with distribution.
Practitioner guidance
- Deep-scan every dependency Inspect source files, vendored code, and embedded text, not just LICENSE files or registry metadata, before approving a component.
- Classify license obligations by context Evaluate whether copyleft, permissive, or proprietary obligations change based on linking mode, redistribution, or source disclosure requirements.
- Document declared and discovered findings separately Track the maintainer-stated license and any discovered license evidence as distinct review records so legal teams can compare them.
Bottom line: Declared licenses show intent, but discovered licenses can add obligations that only deeper scanning will expose.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:31 pm
Declared metadata is not a complete control surface: licence governance breaks when teams treat registry fields or a single file as the full truth. Open source packages often carry code that was imported, copied, or nested later in the lifecycle, so the enforceable obligation can sit outside the maintainer’s headline declaration. Practitioners should treat the declaration as one signal, not the final decision point.
A question worth separating out:
Q: When does a discovered license override the declared license?
A: It does not override it in a simple either-or sense. If the discovered license is valid and the code is part of the delivered artifact, organisations may need to comply with both sets of obligations. The practical test is whether the discovered material creates an enforceable requirement that the declared metadata did not disclose.
👉 Read our full editorial: Declared and discovered open source licenses change compliance risk