, to pull a vendor out of a hat, offers support contracts for their distribution of Perl. That should satisfy your legal folks as far as the actual Perl environment is concerned. It's not a large leap to make the developer liable for the code used in the 3rd-party modules themselves, but that seems like an imperfect solution.