They do have that right. Sometimes the legal office gets requests designed to check our GPL compliance. Every release, we file information on the distributions we use, their versions, which libraries we link to, which compiler versions we use, build instructions for any components that we did a custom compilation of, etc. The CYA paperwork is pretty extensive.