Because license detection from files is a guess, not a declaration. The CycloneDX gomod tool records detected licenses as evidence by default, since it cannot guarantee they are correct. You can turn them into asserted licenses with a flag, but you should review them first.
Evidence versus assertion
In the CycloneDX format, a component can carry licenses in two ways. A declared license is a statement that the component is under that license. Evidence is a record of what a tool observed, with the understanding that the observation may be incomplete or mistaken.
Go modules rarely declare a license in metadata. The tool therefore scans files for license text and matches it against known licenses. A match can be wrong: a license file may be modified, a file may mention a license without applying to the module, or the text may be unusual.
The README explains the choice. Detected licenses are reported as evidence by default because the tool cannot be sure they are right. If software that reads your SBOM cannot yet handle evidence, you can assert them with the assert-licenses flag.
The controls
| Flag | Effect |
|---|---|
| licenses | Turn on license detection |
| assert-licenses | Report detected licenses as asserted instead of evidence |
| license-confidence-threshold | Minimum confidence, default 0.85, for a detected license to be included |
The threshold runs from 0.0 to 1.0. Lowering it lets more uncertain matches through, which means more entries and more chances of an incorrect one. Raising it does the opposite.
Why this matters to a reader
A procurement team or legal reviewer may read a license field as a fact. If your file asserts a detected license that is wrong, you have made a statement you cannot back up. If it sits as evidence, a careful reader knows it is a tool observation.
This is not legal advice, and an SBOM license field does not settle a licensing question. It is a starting point for review.
A review process
- Generate the SBOM with license detection on and evidence mode, the default.
- List every component whose license is missing, or whose detected license is unusual or a copyleft type.
- Open the license file of those modules and read it. A person should confirm anything that affects a decision.
- Record the outcome in your own license register, with the date and reviewer.
- Only assert licenses in the SBOM once you have reviewed them, or when a downstream tool requires it and you accept the risk.
Which tools can read evidence
Some SBOM consumers ignore the evidence block and show an empty license column. If a customer reports "no license data", check whether the tool reads evidence before assuming the file is incomplete. Offering a version with asserted licenses for such a consumer is reasonable, if you have reviewed them.
Do not confuse with vulnerabilities
License data and vulnerability data are separate. A clean license result says nothing about security. Safeguard's SBOM and dependency scanning handles both from the same inventory, and the free scan shows how a Go module list is read.
Quick check
Should I always assert detected licenses?
No. Assert only after review, or when a downstream tool needs it and you accept that the detection may be wrong.
What does the 0.85 threshold mean?
It is the default minimum confidence for a detected license to be included. Lowering it adds more uncertain matches.
Sources
Last reviewed: 19 October 2026.
