Choose the best matching pom if multiple are found in the jar file

[AlexanderBartash]

For some reason Jaxb has multiple pom.xml files in the jar file. At the moment the plugin chooses the first one, which happens to be an incorrect one, as the result license is not correct as well.

The report says pom license is GNU General Public License, version 2 with the GNU Classpath Exception - https://www.gnu.org/software/classpath/license.html when it is actually EDL-1.0.

https://github.com/eclipse-ee4j/jaxb-ri/blob/b7d1ff7a13cecfaadde733387216b5cad09cc5b5/jaxb-ri/bundles/core/pom.xml#L29

[AlexanderBartash]

Ok, it does choose the wrong file, then it downloads a correct one, because it happens that in the wrong file a license is also not present. But the reason why the license is wrong is that if the license is not found in the pom, it keeps resolving parents until it finds one and it goes up to a completely unrelated relicense in https://repo1.maven.org/maven2/org/eclipse/ee4j/project/1.0.9/project-1.0.9.pom which has that GNU General Public License, version 2 with the GNU Classpath Exception

[AlexanderBartash]

I submitted the fix anyway, since if they have multiple pom.xml files, others might as well, and the logic could misfire, but with this fix it will pick the best match.

[AlexanderBartash]

Is it a but that it fetches parent poms despite unionParentPomLicenses = false ?

[AlexanderBartash]

It looks like no

Gradle-License-Report/src/main/groovy/com/github/jk1/license/reader/PomReader.groovy

Line 237 in 8da16c1

// If we didn't find a license in the root pom, then parent pom always applies (if it has one)

It would be nice to be able to turn that off, it is kind of counter intuitive. And contradicts the documentation https://github.com/jk1/Gradle-License-Report?tab=readme-ov-file#configuration

    // By default this plugin will collect the union of all licenses from 
    // the immediate pom and the parent poms. If your legal team thinks this 
    // is too liberal, you can restrict collected licenses to only include the
    // those found in the immediate pom file
    // Defaults to: true
    unionParentPomLicenses = false

[AlexanderBartash]

Here is a PR for that as well #324 with these changes, the report is much better.

[chadlwilson]

Not released yet, but think this issue can be closed since the PR has been merged.