License choice is not respected when generating NOTICE file

[maklostermann]

Using license choice (either for package or repository) to select one of two available licenses, e.g.:

license_choices:
  repository_license_choices:
    - given: "Apache-2.0 OR LGPL-2.1-only"
      choice: "Apache-2.0"

The Web App report's table shows "Apache-2.0" as effective, "Apache-2.0, LGPL-2.1-only" as detected license, as expected.

However, the NOTICE_DEFAULT still lists both licenses:

Package: net.java.dev.jna:jna:5.3.1

The following copyrights and licenses were found in the source code of this package:

                                 Apache License
[...]
  --

                  GNU LESSER GENERAL PUBLIC LICENSE
[...]

Note: There is no copyright as there was no scan. The analyzer already lists the licenses (from Maven).

We currently work around this issue by concluding the license with a curation instead of choosing it.