agree on "well known" part. also, it will depend on particulars, how the developement must be disclosed. e.g. if vendor drops copy of public domain libtom into

agree on "well known" part. also, it will depend on particulars, how the developement must be disclosed. e.g. if vendor drops copy of public domain libtom into its git, changes it up a bit — is that still a separate dependency? what if vendor goes "hey, siri, copilot gpt4, write me tls handshake implementation" and uses whatever is the resulting garbage, is that ok?