Skip to main content
SourceTrustSign in

Help center

Guides for SourceTrust: Importing dependencies, reviewing licenses, external obligations, publishing attestation pages, billing, plain-language license explainers, and procurement-oriented explainers for common open-source licenses.

Confirming a license & attaching text

← All articles

Detection is a hint. Confirm the real license from the catalog, then paste or fetch the license text that most permissive licenses require you to preserve.

Open a package to review it. We suggest a license when the imported file or package prefill supplies a real expression, but you confirm the real one from the catalog. Detection is a hint, not a guarantee.

Most permissive licenses (MIT, BSD, Apache-2.0) require you to preserve the license text and copyright notice. When a license requires this, SourceTrust fetches the text for you, and you paste it in the License text box when we could not. That text is what appears on your public page.

Changing a license that was already confirmed opens a warning. Prefer Cancel unless you are correcting a mistake. When the publisher and the license file disagree, you choose between their two licenses under License. On an approved or parked package, or when the change would remove a text you wrote, it asks once more, without the warning. A license that neither of them names keeps the warning, and the dialog says it is neither of them. If you are unsure, use Get in contact to open Support in a new tab without leaving the package.

For the whole package page (the one message, the license text, the manual steps and Approve), see Help center → Reviewing a package (Reviewing a package). For why a package was left to you, see Why did Bulk approve leave this package? (Why did Bulk approve leave this package?).