Allow logical OR separated licenses to be whitelisted

[Nikkulin3]

What would you like to be added:

Currently, there is no possibility to chose one license over another if multiple licenses are supplied via SBOM.

There should be a mode where you can allow any package which has a whitelisted license, disregarding blacklisted licenses of the same package.

Example:

Snippet from cyclonedx SBOM

"licenses": [
  {
    "license": {
      "id": "EPL-2.0"
    }
  },
  {
    "license": {
      "id": "GPL-2.0-with-classpath-exception"
    }
  }
],

Or similar in this other package of the same SBOM with an OR expression

"licenses": [
  {
    "expression": "MIT OR Apache-2.0 OR LGPL-2.1-or-later"
  }
],

grant.yaml

rules:
  - pattern: "EPL-*"
    name: "EPL"
    mode: "allow"
    reason: "EPL is compatible with our project"
  - pattern: "*"
    name: "reject everything else"
    mode: "deny"
    reason: "All licenses need to be explicitly allowed"

Why is this needed:
Some packages have an OR in there license and I would like to pick the one suited to my needs without whitelisting the other license or excluding the package manually.

[kzantow]

This sounds like a great enhancement, I don't know if we could assume having multiple licenses to imply an "OR" operation, as your first example shows but if we have a complex expression with OR operators, it would be great to allow whitelisted licenses to cause the entire expression to be satisfied.

[Nikkulin3]

Maybe you could add a global option in the config file to either treat a list of licenses as AND or OR (in case not explicitly stated as in example 2).

You could also add an escalation parameter to a blacklisted license. E.g. "this license overrides any OR condition and marks any package with it as forbidden"

Example:

multi_license_mode: "OR"
rules:
  - pattern: "A-*"
    name: "A"
    mode: "allow"
  - pattern: "B-*"
    name: "B"
    mode: "deny"
    escalate: true  # to escalate, dismiss OR and use AND instead
  - pattern: "C-*"
    name: "C"
    mode: "deny"
    escalate: false  # use global behavior

packageA: licenses=[A,B,C] -> deny
packageB: licenses=[A,C] -> allow
packageC: licenses=[A,B] -> deny

I am not sure how you would have to handle it if you have a license D which is not mentioned by any rule.