A company plans to distribute a proprietary application that embeds an open-source library released under a strong copyleft license. Which supply-chain risk should be raised before the product is released?

Licensing is one of the supply-chain concerns named in the 2026 outline alongside integrity and authenticity. Open-source licenses grant rights subject to conditions. Permissive licenses mainly require attribution, while strong copyleft licenses require that derivative or combined works distributed to others be made available under the same license terms, including source code. Embedding such a library in a proprietary product that is distributed can therefore oblige the company to publish its own source or change its licensing, which may conflict with its business model and contracts. The risk is managed by inventorying licenses through software composition analysis and legal review before release. Copyleft has no bearing on digital signatures; any software can be signed regardless of its license, so integrity is not inherently compromised. Open-source licenses are generally granted irrevocably as long as the conditions are met, so the claimed revocation risk misdescribes how these licenses work. Copyleft obligations concern source code and license terms, not customer data, so there is no requirement to share data with the author. Exam caveat: how copyleft applies to software offered as a service rather than distributed depends on the specific license, so the exam tests the concept of license obligations, not legal fine print. Operational check: confirm the build's SBOM lists every component's license and that the license policy check passes before release.