vendored dep licenses to include (or skip) in binary rpms

When you ship a Go binary like cri-o, do you need to include the licenses of all vendored dependencies at %license? Or does it suffice to specify just the license file of the main package itself? For BSD-2-Clause, there seems to be https://github.com/spdx/license-list-XML/blob/v3.0/src/BSD-2-Clause.xml#L23-... which, IIUC, needs this file to be provided as well when distributed in binary form. Correct me if I'm wrong.

This was brought to my atention when trying to upstream ubuntu packaging files for cri-o, but it seems relevant to fedora packaging as well. https://github.com/kubernetes-incubator/cri-o/pull/1380#discussion_r17159933...

Thanks,