SourceTrust turns the dependency list you already have into a reviewed, public compliance page: every open-source package you ship, its license, and what you did about each obligation.