anthonyharrison / lib4sbom

Library to ingest and generate SBOMs
Apache License 2.0
14 stars 10 forks source link

feat: Multiple licenses from CycloneDX files preserved by parser #41

Closed georgkoester closed 3 weeks ago

georgkoester commented 3 weeks ago

Many packages are subject to multiple licenses, e.g. Debian OS packages, and other long-lived packages. To analyse the license situation this information is important. Just using the first license in the list often yields quite wrong results, such as only showing a documentation license instead of a GPL license.