Discussion: Enhanced License Compliance for crates.io

tools and infrastructure cargo
21

100 % agreed on this, as someone working in the sector of medical software.

In my experience it is not strictly like that. The Notified Body auditing your product may raise an NC for a problem they have noticed, but generally you then get to handle the specific problem they found, instead of having to go through the whole certification process from the beginning.

22

FWIW, there's also ScanCode, which:

detects licenses, copyrights, package manifests, direct dependencies, and more both in source code and binary files

(I don't know if it can detect if conflicting licenses are included in the same software.)