# Automatically choose whitelisted license in an "or" clause

**URL:** <https://community.sonatype.com/t/automatically-choose-whitelisted-license-in-an-or-clause/6029>\
**Category:** Sonatype Lifecycle & Firewall\
**Created:** [March 8, 2021, 8:20pm UTC](https://community.sonatype.com/t/automatically-choose-whitelisted-license-in-an-or-clause/6029 "2021-03-08T20:20:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jitendra.rai](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@jitendra.rai](https://community.sonatype.com/u/jitendra.rai)\
**Post date:** [March 8, 2021, 8:20pm UTC](https://community.sonatype.com/t/automatically-choose-whitelisted-license-in-an-or-clause/6029/1 "2021-03-08T20:20:43Z")

</div>

Issue: Nexus firewall quarantines an artifact due to presence of banned license in dual license list.

For example -  
Selected Version: 1.4.20  
Type: maven  
Group: org.jetbrains.kotlin  
Artifact: kotlin-allopen  
Extension: jar  
Classifier: sources  
Version: 1.4.20  
Declared License: Apache-2.0  
Observed License: GPL or NPL-1.1,BSD-3-Clause,Apache-2.0  
Effective License: GPL or NPL-1.1,BSD-3-Clause,Apache-2.0  
Highest Policy Threat: 10 within 2 policies  
Highest CVSS Score: NA  
Cataloged: 3 months ago  
Match State: exact  
Identification Source: Sonatype  
Category: Build Tools/Compilers

This artifact have files with multiple licenses -  
(a) GPL or NPL-1.1,  
(b) BSD-3-Clause  
© Apache-2.0

These three license groups have at least one whitelisted license -  
NPL-1.1 ← whitelisted  
BSD-3-Clause ← whitelisted  
Apache-2.0 ← whitelisted

In this example, nexus iq should use whitelisted license in an “or” clause and should not block the component.

---

<div class="post-metadata">

**Author:** ![jitendra.rai](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@jitendra.rai](https://community.sonatype.com/u/jitendra.rai)\
**Post date:** [March 22, 2021, 1:12pm UTC](https://community.sonatype.com/t/automatically-choose-whitelisted-license-in-an-or-clause/6029/2 "2021-03-22T13:12:37Z")

</div>

Has this request been reviewed and prioritized ? Would you be able to provide an ETA ?

---

<div class="post-metadata">

**Author:** ![dgriffin](https://avatars.discourse-cdn.com/v4/letter/d/e47774/32.png) [@dgriffin](https://community.sonatype.com/u/dgriffin)\
**Post date:** [April 30, 2021, 5:53pm UTC](https://community.sonatype.com/t/automatically-choose-whitelisted-license-in-an-or-clause/6029/3 "2021-04-30T17:53:55Z")

</div>

Hi Jitendra, rather than whitelist the license would you be more interested in a feature that allowed you to set up rules to autoselect a license?

In other words you could define rules for Firewall or Lifecycle to always select a more permissive license when presented with a multi-select option. Or even go further and create rules that stated things like, “always select MIT if available in a multi-select”?

Would that also resolve this use case of having a component be quarantined because one of the licenses in a multi-select is restrictive / copyleft?

I ask because we’re looking to start discovery on a rules based license selection feature in the Q3 / Q4-ish timeframe.

---

<div class="post-metadata">

**Author:** ![jitendra.rai](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@jitendra.rai](https://community.sonatype.com/u/jitendra.rai)\
**Post date:** [May 4, 2021, 1:40pm UTC](https://community.sonatype.com/t/automatically-choose-whitelisted-license-in-an-or-clause/6029/4 "2021-05-04T13:40:22Z")

</div>

The proposal “have rules to always select a more permissive license when presented with a multi-select option” will satisfy our requirements.

---

<div class="post-metadata">

**Author:** ![elizabeth.lester](https://avatars.discourse-cdn.com/v4/letter/e/b487fb/32.png) [@elizabeth.lester](https://community.sonatype.com/u/elizabeth.lester)\
**Post date:** [November 1, 2022, 6:33pm UTC](https://community.sonatype.com/t/automatically-choose-whitelisted-license-in-an-or-clause/6029/5 "2022-11-01T18:33:02Z")

</div>

I am curious whether you all are looking at implementing this feature. I think it would be really helpful to minimize the noise for certain types of components that are frequently dual licensed.