def licensing_mapper(licenses, package, is_private=False):
    """
    Update package licensing and return package.
    Licensing data structure has evolved over time and is a tad messy.
    https://getcomposer.org/doc/04-schema.md#license
    The value of license is either:
    - an SPDX expression string:  {  "license": "(LGPL-2.1 or GPL-3.0+)" }
    - a list of SPDX license ids choices: "license": ["LGPL-2.1","GPL-3.0+"]

    Some older licenses are plain strings and not SPDX ids. Also if there is no
    license and the `is_private` Fkag is True, we return a "proprietary-license"
    license.
    """
    if not licenses and is_private:
        package.declared_license = 'proprietary-license'
        return package
    package.declared_license = licenses
    return package
