License policies & attestation

Vulnerabilities aren’t the only supply-chain risk — the licenses your components carry have legal and compliance implications, and you need confidence that a component is genuinely what it claims to be. License policy and attestation cover both.

Licenses on every component

Each component records the license it’s distributed under, captured as a standard SPDX license identifier. With licenses recorded across the whole inventory, you get a license breakdown — a clear picture of what your software is governed by, from permissive licenses to copyleft ones that carry obligations.

License policy

A license policy defines which licenses are acceptable for your product and which aren’t. Against that policy, the platform highlights components whose licenses fall outside what you allow — so a license that would create an obligation or conflict you can’t accept is surfaced as an issue rather than discovered late. License compliance can then be reported alongside the rest of your evidence.

Attestation reports and recorded hashes

SBOM components can carry integrity hashes (format and length checked when recorded). Attestation in the product means CycloneDX / SPDX attestation reports you can review and e-sign — exports of the governed inventory, not an automatic comparison of a live build artifact against those hashes at ingest time. Recorded hashes travel with the inventory; standing behind a specific build still depends on your pipeline capturing and relating the right digest.

Part of your compliance posture

License compliance and component integrity feed the same evidence story as everything else. They roll up into the SBOM views and into the reports that compile supply-chain compliance for a submission, so governing your supply chain is part of the connected record rather than a separate spreadsheet.