Resolving Transitive License Obligations in Multi‑Level Vendoring

The hidden liability

Your repository vendors a library. The library pulls three more packages. Those packages each bring two more. The licences of the deepest packages never appear in your lock‑file. You ship code you cannot trace. When an audit asks for the origin of a line, you have no answer. That is the failure mode: transitive vendoring creates undocumented licence obligations. The risk is real, the fix is not “add a disclaimer”.

Surface the tree

First step is to generate a software bill of materials (SBOM) that includes every file that ends up in the build artefact. Use a deterministic scanner that records the exact hash of each file and the version of the package it came from. The SBOM must contain the licence identifier for each entry, not just the top‑level package.

Next, resolve the licence identifiers against a trusted licence catalogue. Do not rely on the licence field in a package’s manifest alone; many packages inherit licences from their own dependencies. A second pass walks the dependency graph, propagates licences, and flags any node that lacks an explicit licence. The result is a flat list of licences that matches the SBOM entries.

Finally, attach the origin hash of each file to the licence entry. This creates a provenance record that survives copy‑and‑paste. The record can be stored alongside the artefact or in a separate compliance database. The key is that the SBOM now tells you exactly which licence applies to which byte of code.

Reconcile and record

With the full licence map in hand, compare it to your organisation’s licence policy. Identify any licence that your policy forbids – for example, strong copyleft that you cannot distribute. For each forbidden licence, decide whether to replace the offending package, request a commercial licence, or remove the vendored code entirely.

Document the decision in a compliance ledger. The ledger should reference the SBOM entry, the origin hash, and the chosen remediation. This creates an audit trail that survives team turnover.

When a new version of a vendored library is introduced, repeat the SBOM generation. Because the process is repeatable, you can detect licence changes automatically. Any new licence that appears in the transitive closure triggers the same reconciliation workflow. This keeps software provenance up to date without manual guesswork.

How SHPBL helps

SHPBL provides a model‑independent library of reusable capability that can be harvested from any repository. Its method extracts a repeatable SBOM, resolves transitive licences, and records provenance without relying on AI‑generated output. Access is via four identical gates – an MCP server, a plain HTTP API, a typed TypeScript client, and an offline file‑based edition – so you can integrate the workflow into CI pipelines or run it locally.

A certification harness can execute the artefacts and return a verdict of CERTIFIED, PROVISIONAL, INCONCLUSIVE, or FAILED, giving you an objective compliance signal. You can try the free repository evaluation at /evaluation to see the output on your codebase. For ongoing use, the Practitioner tier unlocks the full gauntlet, and the Complete Master Library provides outright ownership. All releases are sealed by published checksums at the /root-of-trust.

Monday’s concrete step

Run the free evaluation on the repository that contains your vendored code. Export the generated SBOM, compare the licence list to your policy, and record any mismatches in a compliance ledger. That single action gives you a paper trail for the next audit.

(For more context on why missing provenance is a debt, see the pillar post /blog/vendoring-code-without-a-paper-trail-is-unsecured-debt.)