SourceTrust fetches license text on its own. Check again appears on a component page only when another check can help: the automatic checks are used up, or the package changed after its last check. SourceTrust checks the origin recorded by the lockfile before any lookup. Registry dependencies may use the matching package registry. That includes Go modules from the module proxy, Yarn Berry packages resolved from npm, and Composer packages whose lock names a Packagist or GitHub archive. Composer evidence also requires the release to name the same source repository and immutable revision as the lockfile. A same-name fork or a differing revision stays for manual review. A pnpm lockfile that omits the tarball URL is still a default-registry package. A Swift Git dependency requires an immutable revision. Other Git, path, and direct URL origins stop for manual review, so SourceTrust never substitutes a registry package with the same name. A GitHub repository LICENSE page is not used as a substitute for the installed artifact.
On the project overview, a package that hit a busy moment is tried again inside the same run, and its row simply says the check is still running. There is nothing for you to start and nothing to wait for. Only packages installed from a registry are fetched again. Confirmed licenses are left alone. Git, path, and URL installs stay for manual review. When the run ends, a package we could not check says so on its row, and the notice states how many there were. Open such a package to try again or to add the license yourself. In the packages table, the License column says in the same words as the filter what a package still needs: Needs your text, Needs a decision, or Could not be checked.
Checking one package again from its component page re-runs the check for that package now and answers within a minute: you get the license text, or a plain message that we could not get it and what you can do instead. It is never handed on to a later automatic attempt. It updates that row only. It does not move the project's progress numbers, and it never puts a finished project back to checking.
For an eligible dependency, SourceTrust fetches the exact version's distribution artifact. If the lockfile provides a digest, the downloaded bytes must match before license evidence can be read or kept. Curated SPDX text is used only for comparison, never as replacement package text.
That comparison ignores differences that cannot change what you may do or must do with the package: how the lines are wrapped, a title line, a year, the name of a copyright holder, or a credit line under it. A text that differs from the standard license in only those ways counts as that standard license and can be confirmed for you. When the difference is a name or a wording our rules cannot place on their own, we also ask our AI reader whether it asks more of you, and confirm the text only if it says no. Added sentences that ask nothing more of you, such as a note on where some code came from, are confirmed too, and the package keeps a short line that says so. When an addition points to other license notices, or several different things were added, the text waits for a person. A text that asks more of you, or lets you do less, is not the same license, so it always waits for a person to decide.
Some npm packages, typically platform binaries, are too large to download whole. For those, SourceTrust reads the exact version's LICENSE file from copies of the published package. When a package ships no LICENSE at all, SourceTrust reads the license section of its README, then the license file at the exact commit or version tag the package was published from in its source repository, and then the license file on the project's default branch. A text that matches a standard license word for word is used, and we say where it came from. A text that does not is offered for you to read, named as coming from the README or the source code, and is never confirmed for you. A README section is offered only when it reads as the license the publisher names. The View the license file link opens the file the text came from. When there is no license file at any of them, SourceTrust makes one last check of whether the project has a license file at all today. That check reads no text and attaches nothing. It is there so a package whose source code does have a license is never wrongly marked all rights reserved.
For NuGet, the contentHash in packages.lock.json excludes signing metadata and is not a digest of the downloaded package bytes. SourceTrust therefore does not use it for that comparison. A checksum supplied by an SBOM is still checked. A license URL alone is not an SPDX declaration: when no expression is supplied, the exact package's .nuspec can provide it. Empty values, NOASSERTION, and NONE in package prefills mean no declaration.
Fetch outcomes
- Confirmed: Authoritative text from the permitted origin matches the declared license and any recorded digest.
- Origin check failed: Nothing is verified. Review evidence from the dependency's actual source.
- Downloaded copy did not match: Nothing is verified. SourceTrust checks it again on its own.
- Could not be checked: Something took longer than usual (a busy source, a slow download, or a check that did not finish). We try again by ourselves while the run is going, and the row says the check is still running. If it still has no answer when the run ends, the row says Could not be checked and the notice counts it. The row updates itself if a late answer lands. You can paste the LICENSE text from your installed copy at any time. When we read the text but could not finish checking it, the text is shown on the package for you to read and approve.
- Not found: For NuGet or Maven without a recorded origin or checksum, SourceTrust reports only that the exact version was unavailable in the public source checked. This does not establish absence from a private source. Check the lockfile, or paste the license text from your installed copy.
- No license text published: We found no license file for this exact version, in the package or in its source code. When the publisher names a license that asks for its text to go with the package, such as MIT, and we can offer its standard text, that standard text is the way on: check for yourselves for good measure, then approve it, and your public page says in one line that it is the standard text because the publisher publishes none. When we cannot offer a standard text for such a license, paste the text you find, or tick that you understand the package will have none and press Accept the license without a text. When the license asks for no text, such as 0BSD or MIT-0, you can press Accept the license without a text as well. Your public page then says no text was published for this version. A package accepted without a text earlier keeps that choice, and where its license asks for its text, the license text card offers the standard text to put it right. Until such a package is approved again, that standard text is the way on. When the source code holds a text that is not exactly the standard one, or the README holds one that reads as the license the publisher names, we offer that text for you to read instead. Otherwise choose the license and paste the text you accept.
- Custom: The text we found is not a standard open source license. This is never a dead end: SourceTrust can check the package again, and you can settle it at any time by pasting the license text you accept.
- Mismatch or modified: Text found but differs from the SPDX id. Review before approving.
- Unconfirmed or not found: Once the automatic checks are over, paste manually from the package or upstream repo.