Check Open-Source Licenses Used by a Project

A license review must cover both the project's own license and every direct or transitive dependency distributed with the product.

Start with repository files such as LICENSE, COPYING, NOTICE, source headers, and package metadata. Confirm that the declared license is consistent across them and that third-party code copied into the repository retains its notices.

For Maven projects, generate a dependency tree and use a license-reporting or software-composition-analysis tool. Automated metadata is useful but not authoritative: artifacts may declare missing, ambiguous, or incorrect license information.

For each component, record its exact version, source, license expression, copyright notice, distribution form, modifications, and required attribution or source-offer obligations. Review compatibility with the product's distribution model, especially for copyleft, network copyleft, noncommercial, or custom terms.

Before release, produce a third-party notices file, preserve required license texts, verify source-code obligations, and have uncertain or high-impact cases reviewed by qualified legal counsel. License scanning is an engineering control, not a substitute for legal interpretation.