oss-review

To check SBOM dependencies for GPL copyleft contagion risk, parse standard SBOM formats, normalize license identifiers to SPDX, and evaluate static linking, dynamic linking, source code modification, and SaaS interaction scenarios to identify disclosure obligations.

Open source license compliance obligations under China copyright law involve checking the Copyright Law and Computer Software Protection Regulations to verify copyright notices, license copies, source code offers, and patent retaliation clauses in licenses like Apache-2.0.

You generate an open source compliance opinion report by analyzing SBOM dependency lists for copyleft contagion and disclosure obligations, assessing patent retaliation clauses, and producing a structured report with high, medium, and low risk tiers alongside remediation steps.

AGPL copyleft does apply to SaaS and network interaction scenarios. Evaluating open source compliance involves analyzing these specific software use cases to determine if AGPL triggers source code disclosure obligations for distributed or network-served enterprise software.

You can normalize dual license, unknown, and custom license identifiers from an SBOM dependency list. The compliance process parses standard SBOM formats and normalizes these license identifiers to SPDX standards to accurately assess downstream copyleft risks.

Limitations of automated open source license compliance analysis include the complexity of accurately mapping custom or unknown licenses to SPDX identifiers and determining exact contagion paths for heavily modified code within dynamic SaaS environments without manual legal interpretation.