🚀 go-pugleaf

Your legal obligations are spelled out by any written contract between
you and the firm, or by any oral contract witnessed by a third party
(the oral contract is much harder to enforce).

I doubt that this firm has much of a chance against you. The lack of a 
written contract works in your favor in the case of the source license. 
The fact that they have let such a long time lapse before asking for the 
source would indicate that they believed they received at delivery time 
everything for which they had orally contracted.

The lack of a written contract works against you in the case of subsidiary 
licensing, because you have no documentation that there was an agreement
to restrict such licensing.

The point: when you do business, make sure that there is a legal written 
contract. If you have any doubt about what constitutes a legal contract,
hire a lawyer; it's worth it in the long run. Even in this case, with no 
written contract, you will need a lawyer to know your legal obligations; 
the difference is that his job is much tougher without the contract.