fosslight-source 2.3.11__tar.gz → 2.3.12__tar.gz

{fosslight_source-2.3.11/src/fosslight_source.egg-info → fosslight_source-2.3.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_source
-Version: 2.3.11
+Version: 2.3.12
 Summary: FOSSLight Source Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0

{fosslight_source-2.3.11 → fosslight_source-2.3.12}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fosslight_source"
-version = "2.3.11"
+version = "2.3.12"
 description = "FOSSLight Source Scanner"
 readme = "README.md"
 license = "Apache-2.0"

{fosslight_source-2.3.11 → fosslight_source-2.3.12}/src/fosslight_source/_parsing_scancode_file_item.py

@@ -19,7 +19,10 @@ logger = logging.getLogger(constant.LOGGER_NAME)
 REMOVE_LICENSE = ["warranty-disclaimer"]
 find_word = re.compile(rb"SPDX-PackageDownloadLocation\s*:\s*(\S+)", re.IGNORECASE)
 SPDX_LICENSE_IDENTIFIER_PATTERN = re.compile(
-    r'SPDX[-\s]+License[-\s]+Identifier(?:\s*[:,-]\s*|\s+)([^\r\n]+)',
+    # Require : , or - after Identifier. Bare whitespace is rejected so that
+    # messages like 'Misplaced SPDX-License-Identifier tag - use line ...'
+    # are not treated as license declarations.
+    r'SPDX[-\s]+License[-\s]+Identifier\s*[:,-]\s*([^\r\n]+)',
     re.IGNORECASE,
 )
 # Android Soong license_kinds string, e.g. "SPDX-license-identifier-BSD"
@@ -28,6 +31,7 @@ SOONG_SPDX_LICENSE_KIND_PATTERN = re.compile(
     re.IGNORECASE,
 )
 LICENSE_REF_PREFIX_PATTERN = re.compile(r'^LicenseRef-', re.IGNORECASE)
+LICENSE_REF_SCANCODE_PREFIX_PATTERN = re.compile(r'LicenseRef-scancode-', re.IGNORECASE)
 # Trailing closers from comments and quoted lists, e.g. "MIT */", "MIT -->", or '"MIT",'.
 SPDX_DECLARATION_TRAILER_PATTERN = re.compile(r'\s*(?:\*/|-->|["\']\s*,?)\s*$')
 SPDX_DECLARATION_LINE_COMMENT_PATTERN = re.compile(r'\s//.*$')
@@ -39,6 +43,7 @@ HTTP_URL_PATTERN = re.compile(r'https?://', re.IGNORECASE)
 SPDX_REPLACE_WORDS = ["(", ")"]
 KEY_AND_OR = re.compile(r"(?<=\s)(?:and|or)(?=\s)", re.IGNORECASE)
 KEY_AND_OR_CAPTURE = re.compile(r"(?<=\s)(and|or)(?=\s)", re.IGNORECASE)
+DETECTED_COMMENT_PREFIX = "Detected: "
 # GPL, LGPL, AGPL, GFDL
 GPL_LICENSE_PATTERN = re.compile(r'((a|l)?gpl|gfdl)', re.IGNORECASE)
 FSF_IN_COPYRIGHT = "free software foundation"
@@ -86,6 +91,59 @@ def _file_has_other_license(matches: list) -> bool:
     return False
 
 
+def _matched_text_has_spdx_license_identifier(matched_txt: str) -> bool:
+    """True for classic SPDX-License-Identifier with a colon. Soong dash form does not count."""
+    return bool(
+        re.search(
+            r'SPDX[-\s]+License[-\s]+Identifier\s*:\s*\S',
+            matched_txt or "",
+            flags=re.IGNORECASE,
+        )
+    )
+
+
+def _is_spdx_declaration_line(matched_txt: str) -> bool:
+    """
+    True when matched_text is (mostly) an SPDX declaration line, not code that
+    merely mentions SPDX-License-Identifier (e.g. sed replacements).
+    """
+    if not _extract_spdx_declared_expression(matched_txt):
+        return False
+    stripped = re.sub(r"""^[\s"'#/\*-]+""", "", (matched_txt or "").strip())
+    return bool(
+        re.match(
+            r"SPDX[-\s]+License[-\s]+Identifier\s*[:,-]",
+            stripped,
+            flags=re.IGNORECASE,
+        )
+    )
+
+
+def _file_has_spdx_license_identifier(matches: list) -> bool:
+    """True if any match is a classic SPDX-License-Identifier declaration line (colon form)."""
+    return any(
+        _is_spdx_declaration_line(m.get("matched_text") or "")
+        and _matched_text_has_spdx_license_identifier(m.get("matched_text") or "")
+        for m in (matches or [])
+    )
+
+
+def _file_has_spdx_declared_license(matches: list) -> bool:
+    """True if any match has a recoverable SPDX declaration (incl. Soong kinds)."""
+    for matched_lic in matches or []:
+        if _extract_spdx_declared_expression(matched_lic.get("matched_text") or ""):
+            return True
+    return False
+
+
+def _filter_spdx_declaration_matches(matches: list) -> list:
+    """Keep only matches that are SPDX declaration lines (not code mentions)."""
+    return [
+        matched_lic for matched_lic in (matches or [])
+        if _is_spdx_declaration_line(matched_lic.get("matched_text") or "")
+    ]
+
+
 def _matched_text_has_http_url(matched_text: str) -> bool:
     """Return whether matched text contains an HTTP or HTTPS URL."""
     return bool(HTTP_URL_PATTERN.search(matched_text or ""))
@@ -341,6 +399,97 @@ def _strip_license_ref_prefix(token: str) -> str:
     return LICENSE_REF_PREFIX_PATTERN.sub('', (token or "").strip())
 
 
+def _display_expression_for_detected_comment(match: dict) -> str:
+    """
+    Prefer license_expression_spdx; strip LicenseRef-scancode- for display.
+    Falls back to license_expression when SPDX form is absent.
+    """
+    spdx = (match.get("license_expression_spdx") or "").strip()
+    expr = (match.get("license_expression") or "").strip()
+    value = spdx or expr
+    if not value:
+        return ""
+    return LICENSE_REF_SCANCODE_PREFIX_PATTERN.sub("", value).strip()
+
+
+def _dedupe_detected_comment_expressions(expressions: list[str]) -> list[str]:
+    """
+    Drop exact duplicates, then drop a value if it appears as an AND/OR token
+    of another remaining value (e.g. BSD-2-Clause covered by
+    ``GPL-2.0-only OR BSD-2-Clause``).
+    """
+    unique: list[str] = []
+    for expr in expressions:
+        expr = (expr or "").strip()
+        if not expr:
+            continue
+        if any(expr.lower() == kept.lower() for kept in unique):
+            continue
+        unique.append(expr)
+
+    kept: list[str] = []
+    for idx, candidate in enumerate(unique):
+        others = [unique[j] for j in range(len(unique)) if j != idx]
+        candidate_lower = candidate.lower()
+        covered = False
+        for other in others:
+            other_tokens = [
+                token.lower()
+                for token in split_spdx_expression(other)
+                if token and token.strip()
+            ]
+            if candidate_lower in other_tokens:
+                covered = True
+                break
+        if not covered:
+            kept.append(candidate)
+    return kept
+
+
+def _expression_covered_by_reported_licenses(
+    expression: str, reported_licenses: list
+) -> bool:
+    """
+    True when expression is already represented in License column values.
+
+    Matches the whole expression, or every AND/OR token, case-insensitively.
+    """
+    reported = {
+        (lic or "").strip().lower()
+        for lic in (reported_licenses or [])
+        if (lic or "").strip()
+    }
+    if not expression or not reported:
+        return False
+    expr = expression.strip()
+    if expr.lower() in reported:
+        return True
+    tokens = [
+        token.strip().lower()
+        for token in split_spdx_expression(expr)
+        if token and token.strip()
+    ]
+    return bool(tokens) and all(token in reported for token in tokens)
+
+
+def build_detected_comment_from_dropped_matches(
+    dropped_matches: list, reported_licenses: list | None = None
+) -> str:
+    """Build ``Detected: a, b OR c`` from matches dropped by SPDX priority."""
+    displays = []
+    for match in (dropped_matches or []):
+        display = _display_expression_for_detected_comment(match)
+        if not display:
+            continue
+        if _expression_covered_by_reported_licenses(display, reported_licenses or []):
+            continue
+        displays.append(display)
+    deduped = _dedupe_detected_comment_expressions(displays)
+    if not deduped:
+        return ""
+    return DETECTED_COMMENT_PREFIX + ", ".join(deduped)
+
+
 def _extract_spdx_declared_expression(matched_txt: str) -> str:
     """
     Extract SPDX-License-Identifier value from matched_text.
@@ -385,59 +534,112 @@ def _declared_licenses_from_matched_text(matched_txt: str) -> tuple[list[str], l
     return split_spdx_expression_with_ops(declared)
 
 
-def _build_unknown_spdx_replacement_queue(matches: list) -> list[str]:
-    """Ordered replacements for each unknown-spdx token in match order."""
-    queue = []
-    for matched_lic in matches or []:
-        expr = (matched_lic.get("license_expression") or "").lower()
-        if KEYWORD_SCANCODE_UNKNOWN not in expr:
-            continue
-        match_tokens, _ = split_spdx_expression_with_ops(expr)
-        declared_tokens, declared_ops = _declared_licenses_from_matched_text(
-            matched_lic.get("matched_text") or ""
-        )
-        if not declared_tokens:
-            continue
+def _unknown_spdx_replacements_for_match(
+    expression: str, matched_txt: str
+) -> list[str]:
+    """
+    Ordered replacements for each unknown-spdx token in one match expression.
 
-        unknown_indexes = [
-            idx for idx, token in enumerate(match_tokens)
-            if KEYWORD_SCANCODE_UNKNOWN in token
-        ]
-        if not unknown_indexes:
+    Known tokens are never replaced. When token counts match, each unknown maps
+    to the declared token at the same index (e.g. gpl-2.0 OR unknown-spdx with
+    ``GPL-2.0 or MIT-like`` → MIT-like only).
+    """
+    expr = (expression or "").lower()
+    if KEYWORD_SCANCODE_UNKNOWN not in expr:
+        return []
+    match_tokens, _ = split_spdx_expression_with_ops(expr)
+    declared_tokens, declared_ops = _declared_licenses_from_matched_text(matched_txt)
+    if not declared_tokens:
+        return []
+
+    unknown_indexes = [
+        idx for idx, token in enumerate(match_tokens)
+        if KEYWORD_SCANCODE_UNKNOWN in token
+    ]
+    if not unknown_indexes:
+        return []
+
+    queue: list[str] = []
+    if len(match_tokens) == len(declared_tokens):
+        for idx in unknown_indexes:
+            queue.append(
+                _normalize_license_token(declared_tokens[idx]) or declared_tokens[idx]
+            )
+        return queue
+
+    if all(KEYWORD_SCANCODE_UNKNOWN in token for token in match_tokens):
+        if len(match_tokens) == 1:
+            norms = [_normalize_license_token(token) or token for token in declared_tokens]
+            queue.append(join_licenses_with_ops(norms, declared_ops))
+        else:
+            for i, _ in enumerate(unknown_indexes):
+                declared = (
+                    declared_tokens[i] if i < len(declared_tokens) else declared_tokens[-1]
+                )
+                queue.append(_normalize_license_token(declared) or declared)
+        return queue
+
+    # Mixed known + unknown with different declared length:
+    # drop declared tokens that correspond to known match tokens, then assign the rest.
+    unused = list(declared_tokens)
+    for token in match_tokens:
+        if KEYWORD_SCANCODE_UNKNOWN in token:
             continue
+        token_norm = (_normalize_license_token(token) or token).lower()
+        for idx, declared in enumerate(unused):
+            declared_norm = (_normalize_license_token(declared) or declared).lower()
+            if declared_norm == token_norm or declared.lower() == token.lower():
+                unused.pop(idx)
+                break
+    for _ in unknown_indexes:
+        if not unused:
+            break
+        declared = unused.pop(0)
+        queue.append(_normalize_license_token(declared) or declared)
+    return queue
 
-        if len(match_tokens) == len(declared_tokens):
-            for idx in unknown_indexes:
-                queue.append(_normalize_license_token(declared_tokens[idx]) or declared_tokens[idx])
-            continue
 
-        if all(KEYWORD_SCANCODE_UNKNOWN in token for token in match_tokens):
-            if len(match_tokens) == 1:
-                norms = [_normalize_license_token(token) or token for token in declared_tokens]
-                queue.append(join_licenses_with_ops(norms, declared_ops))
-            else:
-                for i, _ in enumerate(unknown_indexes):
-                    declared = declared_tokens[i] if i < len(declared_tokens) else declared_tokens[-1]
-                    queue.append(_normalize_license_token(declared) or declared)
-            continue
+def _resolve_unknown_spdx_in_expression(expression: str, matched_txt: str) -> str:
+    """
+    Restore unknown-spdx in an expression from matched_text.
 
-        # Mixed known + unknown tokens with different declared length:
-        # drop declared tokens that correspond to known match tokens, then assign the rest.
-        unused = list(declared_tokens)
-        for token in match_tokens:
-            if KEYWORD_SCANCODE_UNKNOWN in token:
-                continue
-            token_norm = (_normalize_license_token(token) or token).lower()
-            for idx, declared in enumerate(unused):
-                declared_norm = (_normalize_license_token(declared) or declared).lower()
-                if declared_norm == token_norm or declared.lower() == token.lower():
-                    unused.pop(idx)
-                    break
-        for _ in unknown_indexes:
-            if not unused:
-                break
-            declared = unused.pop(0)
-            queue.append(_normalize_license_token(declared) or declared)
+    - All tokens unknown → use the full declared expression
+    - Mixed known + unknown → replace only unknown tokens; keep known tokens
+    - Returns empty string when unknown cannot be restored from matched_text
+    """
+    tokens, ops = split_spdx_expression_with_ops(expression)
+    if not tokens:
+        return ""
+    unknown_indexes = [
+        idx for idx, token in enumerate(tokens)
+        if KEYWORD_SCANCODE_UNKNOWN in token.lower()
+    ]
+    if not unknown_indexes:
+        return expression
+
+    if all(KEYWORD_SCANCODE_UNKNOWN in token.lower() for token in tokens):
+        return _extract_spdx_declared_expression(matched_txt)
+
+    queue = _unknown_spdx_replacements_for_match(expression, matched_txt)
+    new_tokens = list(tokens)
+    for i, idx in enumerate(unknown_indexes):
+        new_tokens[idx] = queue[i] if i < len(queue) else ""
+    kept_tokens, kept_ops = _kept_tokens_with_merged_ops(new_tokens, ops)
+    if not kept_tokens:
+        return ""
+    return join_licenses_with_ops(kept_tokens, kept_ops)
+
+
+def _build_unknown_spdx_replacement_queue(matches: list) -> list[str]:
+    """Ordered replacements for each unknown-spdx token in match order."""
+    queue = []
+    for matched_lic in matches or []:
+        queue.extend(
+            _unknown_spdx_replacements_for_match(
+                matched_lic.get("license_expression") or "",
+                matched_lic.get("matched_text") or "",
+            )
+        )
     return queue
 
 
@@ -574,53 +776,78 @@ def parsing_scancode(
                 all_matches = []
                 for lic in licenses or []:
                     all_matches.extend(lic.get("matches") or [])
+                # SPDX priority: if the file has SPDX-License-Identifier (:/,/-),
+                # keep only matches that are SPDX declarations (drop body rule hits).
+                prefer_spdx_declarations = _file_has_spdx_license_identifier(all_matches)
+                matches_to_process = (
+                    _filter_spdx_declaration_matches(all_matches)
+                    if prefer_spdx_declarations
+                    else list(all_matches or [])
+                )
                 has_other_license_in_file = _file_has_other_license(all_matches)
+                has_spdx_declared_license = _file_has_spdx_declared_license(all_matches)
                 suppress_unknown_license_reference = (
                     _should_suppress_unknown_license_reference(
                         all_matches, has_other_license_in_file
                     )
                 )
-                for lic in licenses or []:
-                    matched_lic_list = lic.get("matches", [])
-                    for matched_lic in matched_lic_list:
-                        found_lic_list = matched_lic.get("license_expression", "")
-                        matched_txt = matched_lic.get("matched_text", "")
-                        if found_lic_list:
-                            found_lic_list = found_lic_list.lower()
-                            if KEYWORD_SCANCODE_UNKNOWN in found_lic_list:
+                # Prefer-SPDX filters matches; matched_text extraction is only for unknown-spdx.
+                # Mixed expressions keep known tokens and replace unknown tokens only.
+                for matched_lic in matches_to_process:
+                    found_lic_list = matched_lic.get("license_expression", "")
+                    matched_txt = matched_lic.get("matched_text", "")
+                    if not found_lic_list:
+                        continue
+                    found_lic_list = found_lic_list.lower()
+                    if KEYWORD_SCANCODE_UNKNOWN in found_lic_list:
+                        resolved = _resolve_unknown_spdx_in_expression(
+                            found_lic_list, matched_txt
+                        )
+                        if resolved:
+                            found_lic_list = resolved
+                            resolved_unknown_spdx = True
+                        elif has_spdx_declared_license:
+                            # File already has SPDX declarations; drop unrestorable
+                            # unknown-spdx noise (e.g. misplaced-tag messages).
+                            tokens = [
+                                t for t in split_spdx_expression(found_lic_list)
+                                if KEYWORD_SCANCODE_UNKNOWN not in t.lower()
+                            ]
+                            if not tokens:
+                                continue
+                            found_lic_list = " AND ".join(tokens)
+
+                    for found_lic in split_spdx_expression(found_lic_list):
+                        if found_lic:
+                            found_lic = found_lic.strip()
+                            if found_lic in REMOVE_LICENSE:
+                                continue
+                            if (
+                                KEYWORD_UNKNOWN_LICENSE_REFERENCE in found_lic.lower()
+                                and not _should_keep_unknown_license_reference(
+                                    matched_txt, has_other_license_in_file
+                                )
+                            ):
+                                continue
+                            if KEYWORD_SCANCODE_UNKNOWN in found_lic.lower():
                                 declared = _extract_spdx_declared_expression(matched_txt)
                                 if declared:
-                                    found_lic_list = declared
+                                    found_lic = declared
                                     resolved_unknown_spdx = True
-                            for found_lic in split_spdx_expression(found_lic_list):
-                                if found_lic:
-                                    found_lic = found_lic.strip()
-                                    if found_lic in REMOVE_LICENSE:
-                                        continue
-                                    if (
-                                        KEYWORD_UNKNOWN_LICENSE_REFERENCE in found_lic.lower()
-                                        and not _should_keep_unknown_license_reference(
-                                            matched_txt, has_other_license_in_file
-                                        )
-                                    ):
-                                        continue
-                                    if KEYWORD_SCANCODE_UNKNOWN in found_lic.lower():
-                                        declared = _extract_spdx_declared_expression(matched_txt)
-                                        if declared:
-                                            found_lic = declared
-                                            resolved_unknown_spdx = True
-                                    found_lic = _strip_license_ref_prefix(found_lic)
-                                    found_lic = _normalize_license_token(found_lic) or found_lic
-                                    if not found_lic:
-                                        continue
-                                    if matched_txt:
-                                        lic_matched_key = found_lic + matched_txt
-                                        if lic_matched_key in license_list:
-                                            license_list[lic_matched_key].set_files(file_path)
-                                        else:
-                                            lic_info = MatchedLicense(found_lic, "", matched_txt, file_path)
-                                            license_list[lic_matched_key] = lic_info
-                                    license_detected.append(found_lic)
+                                elif has_spdx_declared_license:
+                                    continue
+                            found_lic = _strip_license_ref_prefix(found_lic)
+                            found_lic = _normalize_license_token(found_lic) or found_lic
+                            if not found_lic:
+                                continue
+                            if matched_txt:
+                                lic_matched_key = found_lic + matched_txt
+                                if lic_matched_key in license_list:
+                                    license_list[lic_matched_key].set_files(file_path)
+                                else:
+                                    lic_info = MatchedLicense(found_lic, "", matched_txt, file_path)
+                                    license_list[lic_matched_key] = lic_info
+                            license_detected.append(found_lic)
                 result_item.licenses = license_detected
                 file_ext = os.path.splitext(file_path)[1].lower()
                 is_source_file = file_ext and file_ext in SOURCE_EXTENSIONS
@@ -634,7 +861,22 @@ def parsing_scancode(
                     )
                 )
 
-                if len(license_detected) > 1:
+                # Comment:
+                # - If SPDX priority dropped body matches, always record them as
+                #   ``Detected: ...`` (OR unrelated).
+                # - Else, for multi-license OR expressions, rebuild from detected_*.
+                dropped_matches = []
+                if prefer_spdx_declarations:
+                    process_ids = {id(match) for match in matches_to_process}
+                    dropped_matches = [
+                        match for match in all_matches if id(match) not in process_ids
+                    ]
+                    detected_comment = build_detected_comment_from_dropped_matches(
+                        dropped_matches, result_item.licenses
+                    )
+                    if detected_comment:
+                        result_item.comment = detected_comment
+                if not result_item.comment and len(license_detected) > 1:
                     detected_expression = file.get("detected_license_expression", "") or ""
                     detected_expression_spdx = file.get("detected_license_expression_spdx", "") or ""
                     if (

{fosslight_source-2.3.11 → fosslight_source-2.3.12}/src/fosslight_source/cli.py

@@ -454,16 +454,22 @@ def merge_results(
                 scancode_result.append(new_result_item)
     if manifest_licenses:
         for file_name, licenses in manifest_licenses.items():
-            valid_licenses = [lic.strip() for lic in licenses if isinstance(lic, str) and lic.strip()]
+            # None: marker-only (keep ScanCode). list (incl. []): overwrite with extracted result.
+            keep_scancode_licenses = licenses is None
+            license_list = [] if keep_scancode_licenses else licenses
+            valid_licenses = [
+                lic.strip() for lic in license_list if isinstance(lic, str) and lic.strip()
+            ]
             item = _get_or_append_source_item(
                 scancode_result, file_name, append=bool(valid_licenses) or ui_mode
             )
             if item is None:
                 continue
             item.is_manifest_file = True
+            if keep_scancode_licenses:
+                continue
+            item.licenses = []
             if valid_licenses:
-                # overwrite existing detected licenses with manifest-provided licenses
-                item.licenses = []  # clear existing licenses (setter clears when value falsy)
                 item.licenses = valid_licenses
 
     kb_origin_urls: dict[str, str] = {}
@@ -719,7 +725,9 @@ def metadata_collector(path_to_scan: str, excluded_files: set) -> tuple[dict, di
 
     - Traverse files with exclusions applied
     - spdx_downloads: {rel_path: [download_urls]}
-    - manifest_licenses: {rel_path: [license_names]} (empty list if extraction failed)
+    - manifest_licenses: {rel_path: list[str] | None}
+        - list (incl. []): overwrite ScanCode licenses with this result
+        - None: marker-only; keep ScanCode licenses
 
     :return: (spdx_downloads, manifest_licenses)
     """
@@ -739,7 +747,8 @@ def metadata_collector(path_to_scan: str, excluded_files: set) -> tuple[dict, di
                 spdx_downloads[rel_path_file] = downloads
 
             if is_manifest_file(file_path):
-                manifest_licenses[rel_path_file] = get_manifest_licenses(file_path) or []
+                # Preserve None (marker-only); do not coerce with `or []`.
+                manifest_licenses[rel_path_file] = get_manifest_licenses(file_path)
 
     return spdx_downloads, manifest_licenses
 

{fosslight_source-2.3.11 → fosslight_source-2.3.12}/src/fosslight_source/run_manifest_extractor.py

@@ -6,6 +6,7 @@ import os
 import json
 import re
 import logging
+from typing import Optional
 from fosslight_util.get_pom_license import get_license_from_pom
 import fosslight_util.constant as constant
 
@@ -111,6 +112,11 @@ def get_licenses_from_composer_json(file_path: str) -> list[str]:
     return unique
 
 
+def _is_setup_cfg_license_file_ref(value: str) -> bool:
+    """True when setup.cfg license points at a LICENSE file name, not an SPDX id."""
+    return value.strip().upper() == 'LICENSE'
+
+
 def get_licenses_from_setup_cfg(file_path: str) -> list[str]:
     try:
         import configparser
@@ -119,6 +125,9 @@ def get_licenses_from_setup_cfg(file_path: str) -> list[str]:
         if parser.has_section('metadata'):
             license_value = parser.get('metadata', 'license', fallback='').strip()
             if license_value:
+                # license = LICENSE is a file reference; treat as empty (clears ScanCode on merge).
+                if _is_setup_cfg_license_file_ref(license_value):
+                    return []
                 return _split_spdx_expression(license_value)
     except Exception as ex:
         logger.info(f"Failed to parse setup.cfg with configparser for {file_path}: {ex}")
@@ -138,6 +147,8 @@ def get_licenses_from_setup_cfg(file_path: str) -> list[str]:
             val = val[1:-1].strip()
         if not val:
             return []
+        if _is_setup_cfg_license_file_ref(val):
+            return []
         return _split_spdx_expression(val)
     except Exception as ex:
         logger.info(f"Failed to parse setup.cfg {file_path} via regex fallback: {ex}")
@@ -372,10 +383,15 @@ def get_licenses_from_huggingface_metadata(file_path: str) -> list[str]:
     return licenses
 
 
-def get_manifest_licenses(file_path: str) -> list[str]:
-    # Android.bp licenses come from ScanCode; manifest merge only sets is_manifest_file.
+def get_manifest_licenses(file_path: str) -> Optional[list[str]]:
+    """Extract licenses from a manifest file.
+
+    Returns:
+        list[str]: licenses to apply in merge (empty list clears ScanCode licenses).
+        None: marker-only manifest; merge sets is_manifest_file and keeps ScanCode licenses.
+    """
     if os.path.basename(file_path).lower() == 'android.bp':
-        return []
+        return None
     if file_path.endswith('.pom'):
         try:
             pom_licenses = get_license_from_pom(group_id='', artifact_id='', version='', pom_path=file_path, check_parent=True)
@@ -433,3 +449,4 @@ def get_manifest_licenses(file_path: str) -> list[str]:
         except Exception as ex:
             logger.info(f"Failed to extract license from huggingface_hub_metadata.json {file_path}: {ex}")
             return []
+    return []

{fosslight_source-2.3.11 → fosslight_source-2.3.12/src/fosslight_source.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_source
-Version: 2.3.11
+Version: 2.3.12
 Summary: FOSSLight Source Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0

{fosslight_source-2.3.11 → fosslight_source-2.3.12}/src/fosslight_source.egg-info/SOURCES.txt

@@ -28,6 +28,7 @@ tests/test_manifest_android_bp.py
 tests/test_manifest_composer.py
 tests/test_manifest_pyproject.py
 tests/test_manifest_recommended_scenarios.py
+tests/test_manifest_setup_cfg.py
 tests/test_multi_value_order.py
 tests/test_parsing_unknown_spdx.py
 tests/test_tox.py

{fosslight_source-2.3.11 → fosslight_source-2.3.12}/tests/test_manifest_android_bp.py

@@ -18,10 +18,10 @@ def test_is_manifest_file_recognizes_android_bp():
     assert is_manifest_file("/tmp/module/package.json") is True
 
 
-def test_get_manifest_licenses_returns_empty_for_android_bp(tmp_path):
+def test_get_manifest_licenses_returns_none_for_android_bp(tmp_path):
     android_bp = tmp_path / "Android.bp"
     android_bp.write_text('license { name: "test_license" }', encoding="utf-8")
-    assert get_manifest_licenses(str(android_bp)) == []
+    assert get_manifest_licenses(str(android_bp)) is None
 
 
 def test_metadata_collector_adds_android_bp_without_license_extraction(tmp_path):
@@ -34,7 +34,7 @@ def test_metadata_collector_adds_android_bp_without_license_extraction(tmp_path)
         spdx_downloads, manifest_licenses = metadata_collector(str(tmp_path), set())
 
     assert spdx_downloads == {}
-    assert manifest_licenses == {"Android.bp": [], "package.json": ["MIT"]}
+    assert manifest_licenses == {"Android.bp": None, "package.json": ["MIT"]}
     assert mock_get.call_count == 2
 
 
@@ -44,7 +44,7 @@ def test_merge_results_sets_manifest_flag_without_overwriting_scancode_licenses(
 
     merged, _, _, _ = merge_results(
         scancode_result=[scancode_item],
-        manifest_licenses={"carrois-gothic-sc/Android.bp": []},
+        manifest_licenses={"carrois-gothic-sc/Android.bp": None},
     )
 
     assert len(merged) == 1
@@ -55,7 +55,7 @@ def test_merge_results_sets_manifest_flag_without_overwriting_scancode_licenses(
 def test_merge_results_skips_android_bp_not_in_scancode_result():
     merged, _, _, _ = merge_results(
         scancode_result=[],
-        manifest_licenses={"module/Android.bp": []},
+        manifest_licenses={"module/Android.bp": None},
     )
 
     assert merged == []

{fosslight_source-2.3.11 → fosslight_source-2.3.12}/tests/test_manifest_recommended_scenarios.py

@@ -13,7 +13,7 @@ def test_scenario1_android_bp_keeps_scancode_licenses():
 
     merged, _, _, _ = merge_results(
         scancode_result=[scancode_item],
-        manifest_licenses={"Android.bp": []},
+        manifest_licenses={"Android.bp": None},
     )
 
     assert len(merged) == 1
@@ -21,10 +21,11 @@ def test_scenario1_android_bp_keeps_scancode_licenses():
     assert merged[0].licenses == ["Apache-2.0", "BSD", "MIT", "OFL", "unknown-license-reference"]
 
 
-def test_scenario2_package_json_manifest_fail_keeps_scancode_licenses():
-    """package.json manifest extraction fails but ScanCode row exists: manifest flag only."""
+def test_scenario2_package_json_empty_clears_scancode_licenses():
+    """package.json empty manifest licenses overwrite/clear ScanCode licenses."""
     scancode_item = SourceItem("app/package.json")
     scancode_item.licenses = ["Apache-2.0"]
+    scancode_item.download_location = ["https://example.com/app"]
 
     merged, _, _, _ = merge_results(
         scancode_result=[scancode_item],
@@ -33,7 +34,23 @@ def test_scenario2_package_json_manifest_fail_keeps_scancode_licenses():
 
     assert len(merged) == 1
     assert merged[0].is_manifest_file is True
-    assert merged[0].licenses == ["Apache-2.0"]
+    assert merged[0].licenses == []
+
+
+def test_scenario2_pyproject_license_file_clears_scancode_licenses():
+    """pyproject.toml license={file=...} yields []; ScanCode licenses are cleared."""
+    scancode_item = SourceItem("tornado/pyproject.toml")
+    scancode_item.licenses = ["Apache-2.0"]
+    scancode_item.download_location = ["https://example.com/tornado"]
+
+    merged, _, _, _ = merge_results(
+        scancode_result=[scancode_item],
+        manifest_licenses={"tornado/pyproject.toml": []},
+    )
+
+    assert len(merged) == 1
+    assert merged[0].is_manifest_file is True
+    assert merged[0].licenses == []
 
 
 def test_scenario3_android_bp_from_spdx_marks_manifest_without_new_row():
@@ -43,7 +60,7 @@ def test_scenario3_android_bp_from_spdx_marks_manifest_without_new_row():
 
     merged, _, _, _ = merge_results(
         scancode_result=[spdx_item],
-        manifest_licenses={"module/Android.bp": []},
+        manifest_licenses={"module/Android.bp": None},
     )
 
     assert len(merged) == 1
@@ -56,7 +73,7 @@ def test_scenario3_android_bp_not_in_result_no_row_non_ui():
     """Android.bp absent from merge result: no row in non-UI mode."""
     merged_non_ui, _, _, _ = merge_results(
         scancode_result=[],
-        manifest_licenses={"module/Android.bp": []},
+        manifest_licenses={"module/Android.bp": None},
         ui_mode=False,
     )
     assert merged_non_ui == []
@@ -66,7 +83,7 @@ def test_scenario3_android_bp_not_in_result_ui_keeps_empty_row():
     """Android.bp absent from merge result: UI mode still creates manifest row."""
     merged_ui, _, _, _ = merge_results(
         scancode_result=[],
-        manifest_licenses={"module/Android.bp": []},
+        manifest_licenses={"module/Android.bp": None},
         ui_mode=True,
     )
 

fosslight_source-2.3.12/tests/test_manifest_setup_cfg.py

@@ -0,0 +1,41 @@
+# Copyright (c) 2026 LG Electronics Inc.
+# SPDX-License-Identifier: Apache-2.0
+"""Tests for setup.cfg manifest license extraction."""
+
+from fosslight_source._scan_item import SourceItem
+from fosslight_source.cli import merge_results
+from fosslight_source.run_manifest_extractor import get_licenses_from_setup_cfg
+
+
+def test_setup_cfg_spdx_license(tmp_path):
+    path = tmp_path / "setup.cfg"
+    path.write_text("[metadata]\nname = demo\nlicense = MIT\n", encoding="utf-8")
+    assert get_licenses_from_setup_cfg(str(path)) == ["MIT"]
+
+
+def test_setup_cfg_license_filename_returns_empty(tmp_path):
+    path = tmp_path / "setup.cfg"
+    path.write_text("[metadata]\nname = demo\nlicense = LICENSE\n", encoding="utf-8")
+    assert get_licenses_from_setup_cfg(str(path)) == []
+
+
+def test_setup_cfg_license_filename_case_insensitive(tmp_path):
+    path = tmp_path / "setup.cfg"
+    path.write_text("[metadata]\nname = demo\nlicense = License\n", encoding="utf-8")
+    assert get_licenses_from_setup_cfg(str(path)) == []
+
+
+def test_setup_cfg_license_filename_clears_scancode_licenses(tmp_path):
+    path = tmp_path / "setup.cfg"
+    path.write_text("[metadata]\nname = demo\nlicense = LICENSE\n", encoding="utf-8")
+    assert get_licenses_from_setup_cfg(str(path)) == []
+
+    scancode_item = SourceItem("pkg/setup.cfg")
+    scancode_item.licenses = ["Apache-2.0"]
+    scancode_item.download_location = ["https://example.com/pkg"]
+    merged, _, _, _ = merge_results(
+        scancode_result=[scancode_item],
+        manifest_licenses={"pkg/setup.cfg": []},
+    )
+    assert merged[0].is_manifest_file is True
+    assert merged[0].licenses == []

{fosslight_source-2.3.11 → fosslight_source-2.3.12}/tests/test_parsing_unknown_spdx.py

@@ -21,7 +21,6 @@ from fosslight_source._parsing_scancode_file_item import (
         ("// SPDX-License-Identifier: MIT", "MIT"),
         ("// SPDX-License-Identifier-MIT", "MIT"),
         ("// SPDX-License-Identifier, MIT", "MIT"),
-        ("// SPDX-License-Identifier MIT", "MIT"),
         ('        "SPDX-license-identifier-BSD",', "BSD"),
         ('        "SPDX-license-identifier-OFL", // by exception only', "OFL"),
         ("/* SPDX-License-Identifier: MIT */", "MIT"),
@@ -41,6 +40,20 @@ def test_extract_spdx_declared_expression(matched_text, expected):
     assert _extract_spdx_declared_expression(matched_text) == expected
 
 
+@pytest.mark.parametrize(
+    "matched_text",
+    [
+        "// SPDX-License-Identifier MIT",
+        (
+            '\t\t\t     "Misplaced SPDX-License-Identifier tag - use line '
+            '$checklicenseline instead " . $herecurr);'
+        ),
+    ],
+)
+def test_extract_spdx_rejects_whitespace_only_separator(matched_text):
+    assert _extract_spdx_declared_expression(matched_text) == ""
+
+
 def test_declared_licenses_strips_licenseref_per_token():
     tokens, ops = _declared_licenses_from_matched_text(
         "# SPDX-License-Identifier: LicenseRef-Foo AND LicenseRef-Bar"
@@ -128,9 +141,11 @@ def test_unknown_spdx_comment_preserves_and_or_from_detected_expression():
     success, results, _messages, _ = parsing_scancode(scancode_file_list)
 
     assert success is True
-    assert results[0].licenses == ["DApache-2.0", "GPL-2.0", "NEW"]
+    # Classic SPDX-License-Identifier with colon present → SPDX priority drops
+    # non-declaration matches from licenses; dropped findings go to Detected comment.
+    assert results[0].licenses == ["DApache-2.0", "NEW"]
     assert "unknown-license-reference" not in [lic.lower() for lic in results[0].licenses]
-    assert results[0].comment == "NEW OR DApache-2.0 AND GPL-2.0"
+    assert results[0].comment == "Detected: unknown-license-reference, gpl-2.0"
 
 
 def test_unknown_license_reference_suppressed_when_same_matched_text_has_other_license():
@@ -238,7 +253,7 @@ def test_unknown_license_reference_suppressed_by_other_license_in_same_file():
     success, results, _messages, license_list = parsing_scancode(scancode_file_list)
 
     assert success is True
-    assert results[0].licenses == ["MIT", "Apache-2.0"]
+    assert results[0].licenses == ["Apache-2.0", "MIT"]
     assert results[0].comment == "MIT OR Apache-2.0"
     assert all(
         item.license != "unknown-license-reference"
@@ -499,12 +514,345 @@ def test_android_bp_soong_license_kinds_without_line_comment_in_license():
 
     assert success is True
     licenses = results[0].licenses
+    # unknown-license-reference has no URL and other licenses exist → suppressed
     assert licenses == [
         "Apache-2.0",
         "BSD",
         "MIT",
         "OFL",
-        "unknown-license-reference",
     ]
     assert all("//" not in lic for lic in results[0].licenses)
     assert all('"' not in lic for lic in results[0].licenses)
+
+
+def test_ignore_unknown_spdx_when_file_has_spdx_declaration():
+    """SPDX-License-Identifier present → ignore unrestorable unknown-spdx match."""
+    scancode_file_list = [{
+        "path": "sample.c",
+        "type": "file",
+        "detected_license_expression": "gpl-2.0 AND unknown-spdx",
+        "license_detections": [
+            {
+                "matches": [{
+                    "license_expression": "gpl-2.0",
+                    "matched_text": "# SPDX-License-Identifier: GPL-2.0",
+                }],
+            },
+            {
+                "matches": [{
+                    "license_expression": "unknown-spdx",
+                    "matched_text": (
+                        '\t\t\t     "Misplaced SPDX-License-Identifier tag - use line '
+                        '$checklicenseline instead " . $herecurr);'
+                    ),
+                }],
+            },
+        ],
+        "copyrights": [],
+    }]
+
+    success, results, _messages, _ = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert results[0].licenses == ["GPL-2.0"]
+    assert all("unknown" not in lic.lower() for lic in results[0].licenses)
+    assert all("tag" not in lic.lower() for lic in results[0].licenses)
+
+
+def test_spdx_priority_drops_body_rule_matches():
+    """When classic SPDX-License-Identifier with colon exists, keep declaration only."""
+    scancode_file_list = [{
+        "path": "sample.c",
+        "type": "file",
+        "detected_license_expression": (
+            "gpl-2.0 AND (gpl-2.0 AND bsd-simplified AND (gpl-2.0 OR bsd-simplified))"
+        ),
+        "license_detections": [
+            {
+                "matches": [{
+                    "license_expression": "gpl-2.0",
+                    "matched_text": "# SPDX-License-Identifier: GPL-2.0",
+                }],
+            },
+            {
+                "matches": [
+                    {
+                        "license_expression": "gpl-2.0",
+                        "matched_text": (
+                            "\t\t\t\t\t    not $spdx_license =~ /GPL-2\\.0.*BSD-2-Clause/) {"
+                        ),
+                    },
+                    {
+                        "license_expression": "bsd-simplified",
+                        "matched_text": (
+                            "\t\t\t\t\t    not $spdx_license =~ /GPL-2\\.0.*BSD-2-Clause/) {"
+                        ),
+                    },
+                    {
+                        "license_expression": "gpl-2.0 OR bsd-simplified",
+                        "matched_text": (
+                            "DT binding documents should be licensed "
+                            "(GPL-2.0-only OR BSD-2-Clause)"
+                        ),
+                    },
+                ],
+            },
+        ],
+        "copyrights": [],
+    }]
+
+    success, results, _messages, _ = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert results[0].licenses == ["GPL-2.0"]
+    # Body singles covered by OR expression are dropped; Detected keeps the OR form.
+    assert results[0].comment == "Detected: gpl-2.0 OR bsd-simplified"
+
+
+def test_prefer_spdx_uses_license_expression_not_matched_text_trailer():
+    """Known license keeps ScanCode expression; HTML trailer in matched_text is ignored."""
+    scancode_file_list = [{
+        "path": "index.html",
+        "type": "file",
+        "detected_license_expression": "apache-2.0",
+        "detected_license_expression_spdx": "Apache-2.0",
+        "license_detections": [{
+            "matches": [{
+                "license_expression": "apache-2.0",
+                "license_expression_spdx": "Apache-2.0",
+                "matched_text": "  SPDX-License-Identifier: Apache-2.0</p>",
+            }],
+        }],
+        "copyrights": [],
+    }]
+
+    success, results, _messages, _ = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert results[0].licenses == ["Apache-2.0"]
+    assert all("</p>" not in lic for lic in results[0].licenses)
+
+
+def test_mixed_unknown_spdx_preserves_known_tokens():
+    """unknown-spdx AND mit with a shorter declared id must keep MIT."""
+    scancode_file_list = [{
+        "path": "mixed.c",
+        "type": "file",
+        "detected_license_expression": "unknown-spdx AND mit",
+        "license_detections": [{
+            "matches": [{
+                "license_expression": "unknown-spdx AND mit",
+                "matched_text": "# SPDX-License-Identifier: Apache-2.0",
+            }],
+        }],
+        "copyrights": [],
+    }]
+
+    success, results, _messages, _ = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert results[0].licenses == ["Apache-2.0", "MIT"]
+    assert results[0].comment == ""
+
+
+@pytest.mark.parametrize(
+    "dropped_exprs, expected_comment",
+    [
+        (
+            [
+                ("bsd-simplified", "BSD-2-Clause"),
+                ("gpl-2.0 OR bsd-simplified", "GPL-2.0-only OR BSD-2-Clause"),
+            ],
+            "Detected: GPL-2.0-only OR BSD-2-Clause",
+        ),
+        (
+            [
+                ("gpl-2.0", "GPL-2.0"),
+                ("gpl-2.0 OR bsd-simplified", "GPL-2.0-only OR BSD-2-Clause"),
+            ],
+            "Detected: GPL-2.0, GPL-2.0-only OR BSD-2-Clause",
+        ),
+        (
+            [
+                ("gpl-3.0", "GPL-3.0"),
+                ("apache-2.0", "Apache-2.0"),
+                ("gpl-2.0 OR bsd-simplified", "GPL-2.0-only OR BSD-2-Clause"),
+            ],
+            "Detected: GPL-3.0, Apache-2.0, GPL-2.0-only OR BSD-2-Clause",
+        ),
+        (
+            [
+                ("unknown-spdx", "LicenseRef-scancode-unknown-spdx"),
+            ],
+            "Detected: unknown-spdx",
+        ),
+    ],
+)
+def test_dedupe_detected_comment_examples(dropped_exprs, expected_comment):
+    from fosslight_source._parsing_scancode_file_item import (
+        build_detected_comment_from_dropped_matches,
+    )
+    dropped = [
+        {
+            "license_expression": expr,
+            "license_expression_spdx": spdx,
+            "matched_text": "body",
+        }
+        for expr, spdx in dropped_exprs
+    ]
+    assert build_detected_comment_from_dropped_matches(dropped) == expected_comment
+
+
+def test_detected_comment_excludes_licenses_already_in_license_column():
+    from fosslight_source._parsing_scancode_file_item import (
+        build_detected_comment_from_dropped_matches,
+    )
+    dropped = [
+        {
+            "license_expression": "apache-2.0",
+            "license_expression_spdx": "Apache-2.0",
+            "matched_text": "Licensed under the Apache License, Version 2.0",
+        },
+        {
+            "license_expression": "mit",
+            "license_expression_spdx": "MIT",
+            "matched_text": "Permission is hereby granted",
+        },
+    ]
+    assert (
+        build_detected_comment_from_dropped_matches(dropped, ["Apache-2.0"])
+        == "Detected: MIT"
+    )
+    assert build_detected_comment_from_dropped_matches(dropped, ["Apache-2.0", "MIT"]) == ""
+
+
+def test_detected_comment_uses_final_licenses_after_column_limit():
+    """License dropped by column length limit must still be allowed in Detected."""
+    fillers = [f"AaaLic{i:02d}-{'y' * 80}" for i in range(20)]
+    spdx_matches = [
+        {
+            "license_expression": name.lower(),
+            "license_expression_spdx": name,
+            "matched_text": f"SPDX-License-Identifier: {name}",
+        }
+        for name in fillers + ["ZebraExtra"]
+    ]
+    scancode_file_list = [{
+        "path": "crowded.c",
+        "type": "file",
+        "detected_license_expression": " AND ".join(
+            name.lower() for name in fillers + ["ZebraExtra"]
+        ),
+        "license_detections": [
+            {"matches": spdx_matches},
+            {
+                "matches": [{
+                    "license_expression": "zebraextra",
+                    "license_expression_spdx": "ZebraExtra",
+                    "matched_text": "This file is under ZebraExtra terms.",
+                }],
+            },
+        ],
+        "copyrights": [],
+    }]
+
+    success, results, _messages, _ = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert "ZebraExtra" not in results[0].licenses
+    assert "Detected: ZebraExtra" in results[0].comment
+
+
+def test_readme_spdx_apache_does_not_repeat_in_detected_comment():
+    """Body apache-2.0 match dropped by SPDX priority must not echo License column."""
+    scancode_file_list = [{
+        "path": "README.md",
+        "type": "file",
+        "detected_license_expression": "apache-2.0",
+        "detected_license_expression_spdx": "Apache-2.0",
+        "license_detections": [
+            {
+                "matches": [{
+                    "license_expression": "apache-2.0",
+                    "license_expression_spdx": "Apache-2.0",
+                    "matched_text": "SPDX-License-Identifier: Apache-2.0",
+                }],
+            },
+            {
+                "matches": [
+                    {
+                        "license_expression": "apache-2.0",
+                        "license_expression_spdx": "Apache-2.0",
+                        "matched_text": (
+                            'Licensed under the Apache License, Version 2.0 '
+                            '(the "License"); you may not use this file except '
+                            "in compliance with the License."
+                        ),
+                    },
+                    {
+                        "license_expression": "apache-2.0",
+                        "license_expression_spdx": "Apache-2.0",
+                        "matched_text": "SPDX-License-Identifier: Apache-2.0",
+                    },
+                ],
+            },
+        ],
+        "copyrights": [],
+    }]
+
+    success, results, _messages, _ = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert results[0].licenses == ["Apache-2.0"]
+    assert results[0].comment == ""
+
+
+def test_spdx_priority_detected_comment_uses_spdx_ids():
+    """Dropped body matches use license_expression_spdx in Detected comment."""
+    scancode_file_list = [{
+        "path": "tag.pl",
+        "type": "file",
+        "detected_license_expression": (
+            "gpl-2.0 AND bsd-simplified AND (gpl-2.0 OR bsd-simplified) AND unknown-spdx"
+        ),
+        "license_detections": [
+            {
+                "matches": [{
+                    "license_expression": "gpl-2.0",
+                    "license_expression_spdx": "GPL-2.0-only",
+                    "matched_text": "# SPDX-License-Identifier: GPL-2.0",
+                }],
+            },
+            {
+                "matches": [
+                    {
+                        "license_expression": "bsd-simplified",
+                        "license_expression_spdx": "BSD-2-Clause",
+                        "matched_text": "not $spdx_license =~ /GPL-2\\.0.*BSD-2-Clause/",
+                    },
+                    {
+                        "license_expression": "gpl-2.0 OR bsd-simplified",
+                        "license_expression_spdx": "GPL-2.0-only OR BSD-2-Clause",
+                        "matched_text": "licensed (GPL-2.0-only OR BSD-2-Clause)",
+                    },
+                    {
+                        "license_expression": "unknown-spdx",
+                        "license_expression_spdx": "LicenseRef-scancode-unknown-spdx",
+                        "matched_text": (
+                            '"Misplaced SPDX-License-Identifier tag - use line '
+                            '$checklicenseline instead "'
+                        ),
+                    },
+                ],
+            },
+        ],
+        "copyrights": [],
+    }]
+
+    success, results, _messages, _ = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert results[0].licenses == ["GPL-2.0"]
+    assert results[0].comment == (
+        "Detected: GPL-2.0-only OR BSD-2-Clause, unknown-spdx"
+    )