Skip to main content
SourceTrustSign in

Help center

Guides for SourceTrust: Importing dependencies, reviewing licenses, external obligations, publishing attestation pages, billing, plain-language license explainers, and procurement-oriented explainers for common open-source licenses.

Reviewing a package

← All articles

Open a package to read one message that says why it needs you, then let the one button at the end carry you through the license, the text and the approval.

Open any row in the package list to review one package. The page tells you one thing: why this package is waiting for a person, how to relate to it and what the next step is. One message says it, and one button carries you through the steps.

What you see, in order

  • The name and version, whether the package is direct or came in with another package, and the links to the package's own pages.
  • The message: a title, a short explanation, the words we found when they matter, and up to three numbered steps.
  • The license, in one row, with the control that changes it.
  • The license text. It sits high on the page, because it is what you came to read.
  • How to use the license correctly, then any warnings, then where the package came from, comments and history.

The one button

The filled button at the end of the page carries the next step. Press it and it takes you to the license text. Press it again and it saves or approves that text, with the same rules as the button inside the text card. Then it reads Approve the package, and then Next package. Your hand stays in one place for a whole review. When we find no license text for the version you use, in the package or in its source code, and we do not offer the standard text of its license, the next step is up to you. The end of the page then names your choices instead of a filled button, and the message says where to find each of them.

  • The buttons inside the license text card stay where they are. They go quiet while the one button carries their action, so there is never more than one filled button on the screen.
  • Park for later is still there for a package you cannot finish yet, for example while you wait for an answer about how you use it.
  • With read access the button is gone and the page says which step is left and that someone with edit access has to do it.

The license text

When we found a text, it is already in the box and waiting for your yes. Read it before you rely on it. A text you do not change is saved exactly as it came to us, down to the line breaks, so what your buyers see is what the package ships. If we found nothing, paste the text from your installed copy of the package and save it. When a package is under several licenses at the same time, there is one box per license and all of them need a text.

Review fetched text opens another copy we found without saving it. Approve saves it in place of yours, and Cancel puts your saved text back. When the publisher lets you choose between two licenses, each option names the license it comes from, and your choice decides which text applies.

Changing a confirmed license, a confirmed choice between two licenses or the saved license text puts the package back to Needs review and clears its manual steps. Confirming the same license again keeps the approval. License text saved before the first manual license confirmation is kept.

What happens after Approve

The next package that needs you in the same list opens by itself, and the walk goes back to the top of that list once it reaches the end, so nothing is left behind. This view is done appears only when nothing in the list needs you, and it tells you how many packages on the branch are still waiting, with a button that shows them. If the list is too long for us to look through it all, the page says that more packages still need you and offers the way back to the list. A step that could not find the next package is never shown as an error on work that was saved.

  • The row, the package page and the button use the same words for how far a package has come. Approval and publishing are two steps: Ready to publish means approved for the next publish, and Live means already on the public page.
  • Tick a manual step only when the real step is done, or when you are sure it does not apply to you. The ticks are your record, and they block publishing until they are there.
  • Approved one by mistake? Open it again and press Take the approval back. The package goes back to Needs review, the reuse of that decision is forgotten, and the same package in your other branches opens again too.
See Help center → Why did Bulk approve leave this package? (Why did Bulk approve leave this package?), What the statuses mean (What the statuses mean), Auto-fetch license text (Auto-fetch license text), and External obligations overview (External obligations overview).