We (small team in large organisation, in Germany/EU) have the following situation:
- we use OSS libraries within our commercial products, licenses are checked and we are sure that we're complying (LGPL, BSD, MIT etc.., no copyleft)
- these libraries do contain/link other OSS libraries, sometimes using other licenses
Now, our legal department has a very elaborate/expensive/time consuming process to check new libraries that we want to use. Part of the process manually checks every single file, including those of transitive dependencies in source form.
My question is: Are we really liable for license problems posed by transitive dependencies of our dependencies? My feeling is that the legal department (which is external) designed the process to take as many billable hours as possible...