Ask a desktop engineering team about open-source licensing and you will hear about GPL. It is the question in every acquisition checklist and every security review: are we shipping copyleft code, and does it force us to publish ours?
It is a reasonable question. It is also, for the overwhelming majority of desktop software, the wrong one to spend the review budget on. Copyleft of any kind accounts for 2.8% of what we found.
The other 95.7% carries an attribution obligation: MIT, BSD, Apache-2.0, ISC. Every one of them requires you to reproduce a copyright notice and licence text in your distribution. That obligation is unconditional, it applies to software already shipping today, and it is the one nobody has a process for.
The obligation you already have
Attribution sounds trivial until you count it. 17,444 applications ship at least one component whose licence requires a notice. Among those, the corpus-wide median is 23 distinct components. Four thousand owe more than a hundred.
The burden tracks how the app was built far more than what the app does.
The heaviest single application in the corpus owes attribution to 1,767 distinct components. A native Swift or C++ app frequently owes none we can identify, which is a statement about visibility as much as about content.
An Electron or Flutter build cannot satisfy this by hand; it needs to be generated at build time or it will not be correct. And the obligation is per-distribution, so it moves when your dependency tree moves. A notice file assembled once at launch is stale by the next release.
Copyleft is the risk you get asked about. Attribution is the obligation you are accruing, on every build, right now.
The risk you watch for
The good news: copyleft is not diffuse. It concentrates in a small number of well-known libraries. If you check nothing else, check these.
Three families account for almost all of it: video encoding (the FFmpeg family, x264, x265), Qt bindings for Python, and a tail of document and numerical libraries.
Several of these are dual-licensed, and a binary cannot tell you which branch a vendor took. PyQt is GPL or a Riverbank commercial licence. Qt is LGPL, GPL, or commercial. iText is AGPL or commercial. Finding the component tells you an obligation exists; it does not tell you the vendor is out of compliance, because paying for the alternative licence leaves no trace in the shipped bytes. Any tool that reports these as violations is overreaching.
An app shipping its own copyleft code is not contamination. A GPL-licensed product bundling its own GPL modules is itself. Prevalence figures that do not separate first-party from third-party inflate the scary number.
The part that is invisible
How much of an application's licence surface is even legible from the binary depends on how it was built. Ecosystems that embed dependency metadata in the shipped artifact are readable. Ecosystems that compile it away are not. This has nothing to do with the diligence of the vendor and everything to do with the toolchain.
Unity is the extreme case: of 12,393 components detected across 193 Unity applications, we can resolve 158. A clean licence report on a Unity title means almost nothing.
If your estate is Rust and Electron, a binary-derived licence inventory is close to complete and you can attest from it. If it is .NET, Java, or native C++, roughly half the surface is dark, and a report showing no copyleft is reporting the limits of the scan rather than the contents of the binary.
This is the question buyers should ask any SCA vendor, us included: what fraction of this artifact did you actually resolve, and what did you do with the rest? A tool that returns a confident licence for everything has quietly converted its unknowns into assertions.
What we count as evidence
Licence data derived from binaries is only as good as the standard behind it. Ours follows the SBOM specifications rather than inventing a house rule.
A licence claim must be anchored to the version that shipped. Package registries answer about the present. Ask one about a package without pinning a version and it will tell you what that project is licensed under today. That is how a library that relicensed in 2024 gets attributed to a binary built in 2022. SPDX 3.0.1 is explicit that a declared licence is one found with the artifact, not one retrieved from a website.
Where a registry reports several licences with no stated relationship, we do not invent one. Joining them with AND manufactures the most restrictive reading; joining with OR manufactures the most permissive. The Maven specification says multiple entries mean the user may select any of them; PEP 639 forbids deriving a licence expression from Python's classifiers without human confirmation. Where the relationship is unspecified, the honest output is an ambiguity flag.
Unresolved is reported as unresolved. SPDX distinguishes the author's declaration from a scanner's conclusion, and provides NOASSERTION for exactly this case. We would rather under-report a real finding than assert one we cannot substantiate.
If you review one desktop application this quarter
- Generate your notice file from the build, not by hand. If the app is Electron, Flutter, or Rust, assume three figures of attribution obligations and automate it.
- Grep for the short list. FFmpeg and friends, x264, x265, PyQt, Poppler, FFTW, iText. That covers the large majority of real copyleft exposure on the desktop.
- For anything dual-licensed, find the purchase order, not the binary. Qt, PyQt, iText and JUCE compliance is a procurement question. No scan can answer it.
- Ask what fraction of the artifact was resolved. On .NET, JVM and native C++ estates, treat a clean report as unproven rather than as a pass.
Corpus: 28,754 applications (12,055 macOS, 16,661 Windows) and 1,361,077 resolved dependency instances, measured August 2026.