one license chosen when multiple license expressions found

[guyscher2]

Environment:
Java 21.0.3
Node v22.2.0
cdxgen 10.5.2
Gradle Project

Runtime:
export CDXGEN_DEBUG_MODE=debug
export FETCH_LICENSE=true
export DEP_TRACK_API_KEY=****************
export GITHUB_TOKEN=**************

cdxgen -o sbom.json --exclude "/.git/**"

Current behavior:
While fetching licenses from mvn repository for a dependency with multiple licenses, cdxgen prints "multiple license expressions found".
Then, one license is picked and saved in sbom.

Problem:
This causes inaccurate data, we get a wrong overview of our licenses and dep-track analyzes the dependency wrongly.

Expected behavior:
cdxgen will merge all the expressions using OR statement between them.
for example:
'EDL 1.0 OR Apache License, 2.0 OR Public Domain OR Modified BSD OR jQuery license OR W3C license'

Question:
Can I reach the Expected behavior now or is it a feature request?

[guyscher2]

@prabhu your assistance please 🙏

[prabhu]

The offending line is here. Could you try coming up with a PR that replaces this line with something like below.

return [{expression: expressions.map((e) => e.expression || "").join(" OR ")}]

[guyscher2]

I have the code ready.
it seems like I don't have permission to push new branches :)

[prabhu]

Could you fork and raise a pull request? There are docs available on github that can help with this.

[guyscher2]

done :)
PR open