License Summary

Governance Summary (Recommended)

Recommended Actions

• Mixed licenses detected (Apache-2.0, GPL-3.0-only, LicenseRef-fossology-GPL, LicenseRef-fossology-See-URL). Confirm third-party/vendor directories and ensure corresponding license texts are present in THIRD_PARTY_NOTICES/NOTICE.
• 9/15 files (60.0%) are NOASSERTION (no detectable header/text). Focus cleanup on these directories first: deepsea-frameextractor-1ad2b042b8d9.tar/github-deepsea-frameextractor-1ad2b042b8d9 (7), deepsea-frameextractor-1ad2b042b8d9.tar/github-deepsea-frameextractor-1ad2b042b8d9/src/main (2). For first-party source files, add SPDX-License-Identifier headers. For assets/minified bundles, ensure license comments are preserved or add a directory-level notice.
• Repository appears intended to be Apache-2.0, but many files lack detectable headers. Add 'SPDX-License-Identifier: Apache-2.0' to first-party source files, and preserve license banners in minified outputs.
• Custom/unknown license references (LicenseRef-*) detected. Review those files and map them to standard SPDX identifiers where possible.

SPDX Package Fields (May be NOASSERTION)

Document Metadata

Unique Licenses

File License Inventory

Note: If package-level fields show NOASSERTION while file-level detected licenses are present, scanning likely succeeded but conclusions were not produced or could not be safely inferred.