Handle declared and concluded licenses independently #24

What

The SPDX formatter assigns the same internal license value to both licenseDeclared and licenseConcluded.

"licenseConcluded": license_id if license_id else "NOASSERTION",
"licenseDeclared": license_id if license_id else "NOASSERTION",

SPDX permits these fields to be equal, but it would be better to move towards their intended purpose:

licenseDeclared:

List the licenses that have been declared by the authors of the package. ... A valid SPDX License Expression as defined in Annex D;

licenseConcluded

Contain the license the SPDX Document creator has concluded as governing the package or alternative values, if the governing license cannot be determined. ... If the Concluded License is not the same as the Declared License (7.15), a written explanation should be provided in the Comments on License field (7.16).

Acceptance Criteria (DoD)

• Different path of licenses determination
• Store declarations and conclusions separately, including their evidence.
• Compare concluded and declared license and explain the difference if any

How

no ideea yet, tbd