NOASSERTION means the SBOM creator made no statement, either because they could not determine the license or chose not to say. NONE is a positive statement that no license applies or no license information exists. Reading NOASSERTION as no license, or NONE as unknown, gives you wrong conclusions.
The meanings in the spec
SPDX 2.3.1 defines the two values this way for the license fields:
- NOASSERTION. The creator either tried and could not reach an objective determination, made no attempt, or intentionally provided no information. The spec says no meaning should be implied by doing so.
- NONE. A positive statement. For Concluded License, the creator concludes no license is available. For Declared License, the package contains no license information at all. For license information from files, none was detected in any file.
Absent fields imply NOASSERTION in most cases, so an SBOM with blank license data reads as unknown, not as clear.
Why it matters in reports
A dashboard that counts only packages with a copyleft license will show NOASSERTION packages as clean. They are not clean. They are unreviewed. A figure like "zero GPL packages" is only as good as the share of packages that had license data.
NONE is also a flag, but a different one. A package with no license information is, by default, not something you have permission to reuse. That is a finding to act on, not just a gap in data. See what to do when a repo has no license.
Report both numbers
For any license summary, show:
- Packages with a known license, split by category.
- Packages marked NOASSERTION, as an unknown bucket.
- Packages marked NONE, as a missing license bucket.
A shrinking unknown bucket is a better progress measure than a growing list of approved packages.
Fixing unknowns
- Update the generator or its package metadata sources.
- For private or internal packages, set the license field in the manifest.
- For third party packages with real gaps, read the repository and decide a concluded license, with a comment.
- Block new additions that arrive with no license data, using a gate.
Safeguard's SBOM and dependency scanning give you the inventory. The free scan is a starting point, and policies and gates can act on the results you define.
Quick check
Is NOASSERTION the same as no license?
No. The spec says it implies nothing. It just means no statement was made.
What does NONE assert for a declared license?
That the package contains no license information at all.
Sources
Last reviewed: 19 October 2026.
