A LicenseRef id is a pointer, not a license. It says the text lives elsewhere in the document, so somebody has to go and read it.
On this page
What it does
LicenseRef is SPDX's escape hatch: a locally defined identifier for a license that is not on the SPDX list. LicenseRef-Acme-Commercial means the wording sits somewhere else in the same document, and a DocumentRef prefix means it sits in a different document altogether. The identifier itself carries no meaning, because whoever produced the file invented it. You will meet these in vendor SDK SBOMs, in internal monorepo components, in defence and government supplier files, and in scanner output that met an unrecognised license.
Details
You cannot infer a single obligation from the identifier. LicenseRef-MIT-ish is not MIT, and LicenseRef-Permissive-Internal is a name a tool wrote, not a grant anyone made. An SBOM that carries a LicenseRef with no extracted license text is an incomplete document, and the fix is to ask the supplier for the text. Three cases account for nearly all of them. The first is a genuinely custom vendor license, which is really a proprietary component. The second is an ordinary SPDX license the producer failed to recognise, and the third is a pointer at a second document you have not received.
Pros
- Naming the situation (no license, dual license, exception, custom text) is better than forcing a nearby SPDX id.
- Once the files are read, the rest of the review looks like any other component.
Cons
- Auto-fetch and SPDX matching will not finish this for you. A person has to read what shipped.
- Wrong SPDX on a dual-license or LicenseRef package is a common attestation error.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Custom text
LicenseRef means the grant is not on the SPDX License List. Permissions live only in that attached text.
Limits
Assume MIT
A nearby SPDX id is not a substitute. Custom text can add field-of-use limits, copyleft, or confidentiality that MIT never had.
Obligations
Attach the text
Keep the actual license file with the component. SourceTrust treats this as text you confirm, not a catalog row you pick.
What licenseref requires when you ship
licenseref is a situation more than a standard grant. Read what is actually on the component, then record that, rather than hoping a nearby SPDX id covers it. The steps below are how to keep the record tied to the text you actually have.
You have the actual license text in hand, not just the identifier, before you approve the component for your page.
You have asked the supplier for the wording when their SBOM carries a LicenseRef and no extracted licensing information to go with it.
You have classified what you read: an ordinary SPDX license under a local name, a vendor agreement, or something genuinely bespoke. The three lead to different reviews.
You have chased the referenced document when the id carries a DocumentRef prefix, because the terms live in an SBOM you do not have yet.
The duties named in licenseref
There is no standard grant to scan. Record the identifier and the text that is actually on the component, then treat nearby SPDX ids as other pages, not as substitutes.
Attach the text
Keep the actual license file with the component. SourceTrust treats this as text you confirm, not a catalog row you pick.
Things to be aware of
- Someone approves a component on the strength of a reassuring identifier. The name was written by whoever produced the file, and it binds nobody.
- Someone reads an SBOM validator's silence as approval. A LicenseRef id is valid by construction, so the validator has nothing to complain about.
- Someone loses the referenced text between an upstream SBOM and their own, and the next reviewer starts the whole search over from nothing.
What the LicenseRef custom identifiers does not do
Search results often flatten LicenseRef custom identifiers into a slogan. These are the usual misreads. licenseref is a grant with conditions, not a permission to skip the paperwork below.
- a LicenseRef custom text is not a single SPDX license with one obligations checklist. Treat the actual files as the source of truth.
- It does not let you skip recording what is in the package. Buyers still want the situation named.
How licenseref differs from nearby licenses
These licenses are often confused with licenseref, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- licenseref
- A LicenseRef id is a pointer, not a license. It says the text lives elsewhere in the document, so somebody has to go and read it.
- proprietary
- Not open source. The agreement you signed sets the terms, so the text you attach and the limits you record are the whole record.
- no-license
- Code published without a license is not free to use. Copyright applies by default and the author keeps every right they did not give away.
- dual-license
- One package, more than one license. OR means you choose an arm and follow that one. AND means every arm binds you at the same time.
Common questions about LicenseRef custom identifiers
Answers to common questions about what LicenseRef custom identifiers requires, when its duties apply, and what evidence belongs with a release.
What is the LicenseRef custom identifiers?
LicenseRef is SPDX's escape hatch: a locally defined identifier for a license that is not on the SPDX list. LicenseRef-Acme-Commercial means the wording sits somewhere else in the same document, and a DocumentRef prefix means it sits in a different document altogether. The identifier itself carries no meaning, because whoever produced the file invented it. You will meet these in vendor SDK SBOMs, in internal monorepo components, in defence and government supplier files, and in scanner output that met an unrecognised license.
What does licenseref require when you ship a product?
You have the actual license text in hand, not just the identifier, before you approve the component for your page. You have asked the supplier for the wording when their SBOM carries a LicenseRef and no extracted licensing information to go with it. You have classified what you read: an ordinary SPDX license under a local name, a vendor agreement, or something genuinely bespoke. The three lead to different reviews. You have chased the referenced document when the id carries a DocumentRef prefix, because the terms live in an SBOM you do not have yet.
Why does licenseref sit under special cases?
licenseref is a situation rather than a standard public grant: no license, a choice between licenses, an exception, a custom identifier, or a text that fits none of the families above. Each one is decided by reading what is actually there.
How is licenseref different from Proprietary and commercial licenses?
licenseref asks this: A LicenseRef id is a pointer, not a license. It says the text lives elsewhere in the document, so somebody has to go and read it. Proprietary and commercial licenses asks this: Not open source. The agreement you signed sets the terms, so the text you attach and the limits you record are the whole record. Open the Proprietary and commercial licenses page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record licenseref for a buyer?
Nothing about a LicenseRef is decided automatically, and that is deliberate. The parser reads LicenseRef and DocumentRef ids as their own kind of node rather than guessing at an SPDX id. Any expression containing one is classified as unsafe, so it is never flattened into a single license and never elected for you. A LicenseRef leaf is also skipped when reference texts are collected for comparison, because there is no reference copy to compare against. Every one of them reaches a person.
Where do I record licenseref for a buyer?
Nothing about a LicenseRef is decided automatically, and that is deliberate. The parser reads LicenseRef and DocumentRef ids as their own kind of node rather than guessing at an SPDX id.
Any expression containing one is classified as unsafe, so it is never flattened into a single license and never elected for you. A LicenseRef leaf is also skipped when reference texts are collected for comparison, because there is no reference copy to compare against.
Every one of them reaches a person. Read /docs/reviewing-component.
- Identifying the license behind the reference upgrades the record to a real SPDX id, and the checklist items for that license start to apply.
- The arbiter has its own verdict for text it cannot match to any SPDX license, and it can never raise a result to confirmed on its own.
- Until somebody attaches the text, the component has nothing to show a buyer, so it stays off the published page.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.