Most packages do not tell you their licence properly
A missing field, a free text string, a licence file that disagrees with the manifest. Vulnetix works down a cascade and records which step produced the answer, so a surprising result can be traced rather than argued about: the manifest field first, then an SPDX database embedded in the binary with OSI and FSF status attached, then deps.dev, then GitHub and the registry API, then the licence files in the installed package directory.
The exception list is the product
Every organisation ends up allowing something. What matters is whether the allowance is written down, attributed and reviewed before it expires.
Category assignments, severity per category and per project overrides live in a policy file. The built-in default reproduces the behaviour you had before policies existed, so adopting one never turns a build red for a decision nobody made.
An approved exception records who approved it, why, and until when. An expired exception stops applying and says so.
Exception names match at path segment boundaries, so an exception for gpl-lib cannot silently cover agpl-lib. Package identifiers are matched with the version stripped, so an exception survives a dependency bump.
An exempted finding is retained, badged and counted separately. Only the gate ignores it.
Images, providers and flakes have licences too
A base image with a restrictive licence is as much of a distribution question as a library, and it is the one nobody checks. Container image licences are read from image labels through a local inspect and then from the registry API. Terraform provider licences are resolved through the provider registry and then the source repository. Nix flakes are resolved through the Nix CLI when it is available.
Output is written as SPDX and as CycloneDX, so one run answers a licence question and feeds an exchange request.
Licence analysis runs over the same package list produced by software composition analysis, including packages found inside an image by container scanning. The findings feed the framework reports in compliance reporting.