What this license is
LicenseRef is SPDX's escape hatch: a locally defined identifier for a license that is not on the SPDX list. LicenseRef-Acme-Commercial means the wording sits somewhere else in the same document, and a DocumentRef prefix means it sits in a different document altogether. The identifier itself carries no meaning, because whoever produced the file invented it. You will meet these in vendor SDK SBOMs, in internal monorepo components, in defence and government supplier files, and in scanner output that met an unrecognised license.
Why it matters for your product
You cannot infer a single obligation from the identifier. LicenseRef-MIT-ish is not MIT, and LicenseRef-Permissive-Internal is a name a tool wrote, not a grant anyone made. An SBOM that carries a LicenseRef with no extracted license text is an incomplete document, and the fix is to ask the supplier for the text. Three cases account for nearly all of them. The first is a genuinely custom vendor license, which is really a proprietary component. The second is an ordinary SPDX license the producer failed to recognise, and the third is a pointer at a second document you have not received.
You are meeting the terms when
- You have the actual license text in hand, not just the identifier, before you approve the component for your page.
- You have asked the supplier for the wording when their SBOM carries a LicenseRef and no extracted licensing information to go with it.
- You have classified what you read: an ordinary SPDX license under a local name, a vendor agreement, or something genuinely bespoke. The three lead to different reviews.
- You have chased the referenced document when the id carries a DocumentRef prefix, because the terms live in an SBOM you do not have yet.
Where teams get it wrong
- Someone approves a component on the strength of a reassuring identifier. The name was written by whoever produced the file, and it binds nobody.
- Someone reads an SBOM validator's silence as approval. A LicenseRef id is valid by construction, so the validator has nothing to complain about.
- Someone loses the referenced text between an upstream SBOM and their own, and the next reviewer starts the whole search over from nothing.
How SourceTrust handles this license
Nothing about a LicenseRef is decided automatically, and that is deliberate. The parser reads LicenseRef and DocumentRef ids as their own kind of node rather than guessing at an SPDX id. Any expression containing one is classified as unsafe, so it is never flattened into a single license and never elected for you. A LicenseRef leaf is also skipped when reference texts are collected for comparison, because there is no reference copy to compare against. Every one of them reaches a person. Read Reviewing a component.
- Identifying the license behind the reference upgrades the record to a real SPDX id, and the checklist items for that license start to apply.
- The arbiter has its own verdict for text it cannot match to any SPDX license, and it can never raise a result to confirmed on its own.
- Until somebody attaches the text, the component has nothing to show a buyer, so it stays off the published page.