Incorrect licenseConcluded (OR instead of AND) for pkg:golang/github.com/klauspost/[email protected]

[nodet]

For package pkg:golang/github.com/klauspost/[email protected], Parlay incorrectly returns

"licenseConcluded": "(Apache-2.0 OR BSD-3-Clause OR MIT)",

where it should be

"licenseConcluded": "(Apache-2.0 AND BSD-3-Clause AND MIT)",

The license text for this package is at https://github.com/klauspost/compress/blob/v1.17.8/LICENSE. This file is organised as such:

[default copyright and license]

------------------

Files: gzhttp/*

[Another copyright and license]

------------------

Files: s2/cmd/internal/readahead/*

[Yet another copyright and license]

etc.

The Parlay output is incorrect, as it should be an 'AND' clause because we have to comply with all of the licenses, not an 'OR' clause that lets us choose. See https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/#d4-composite-license-expressions.

Here's how to reproduce.

$ cat klauspost-compress-1.17.8.json
{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "creationInfo": {
    "licenseListVersion": "3.19"
  },
  "packages": [
    {
        "name": "github.com/klauspost/compress",
        "SPDXID": "SPDXRef-295-github.com-klauspost-compress-1.17.8",
        "versionInfo": "1.17.8",
        "externalRefs": [
          {
            "referenceCategory": "PACKAGE-MANAGER",
            "referenceType": "purl",
            "referenceLocator": "pkg:golang/github.com/klauspost/[email protected]"
          }
        ]
      }
  ]
}
$ parlay ecosystems enrich klauspost-compress-1.17.8.json | jq
{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "",
  "documentNamespace": "",
  "creationInfo": {
    "licenseListVersion": "3.19",
    "creators": null,
    "created": ""
  },
  "packages": [
    {
      "name": "github.com/klauspost/compress",
      "SPDXID": "SPDXRef-295-github.com-klauspost-compress-1.17.8",
      "versionInfo": "1.17.8",
      "downloadLocation": "",
      "filesAnalyzed": true,
      "homepage": "https://github.com/klauspost/compress",
      "licenseConcluded": "(Apache-2.0 OR BSD-3-Clause OR MIT)",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:golang/github.com/klauspost/[email protected]"
        }
      ]
    }
  ]
}