List OSS components included in a product and include the required notices in the distribution.
Which inventory is appropriate?
Track components, versions, licenses, copyright notices, NOTICE files, and how source obligations will be met.
Detailed explanation
Incorrect. Licensing must be checked before distribution, not after.
Incorrect. Licensing must be checked before distribution, not after.
Incorrect. Each dependency can have different license terms.
Incorrect. Each dependency can have different license terms.
Correct. These fields make dependencies and distribution obligations traceable.
Correct. These fields make dependencies and distribution obligations traceable.
Incorrect. Some licenses impose source-related conditions even for binary distribution.
Incorrect. Some licenses impose source-related conditions even for binary distribution.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s\n' 'name version license notices and source offer'Expected result
name version license notices and source offerKey points
- SBOM
- NOTICE
- Source provision
Notes
- Environment: OSSコンプライアンス運用の概念確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.