fosslight-source 2.3.11__tar.gz → 2.3.13__tar.gz

{fosslight_source-2.3.11/src/fosslight_source.egg-info → fosslight_source-2.3.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_source
-Version: 2.3.11
+Version: 2.3.13
 Summary: FOSSLight Source Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0
@@ -20,11 +20,11 @@ Requires-Dist: setuptools<=80.10.2
 Requires-Dist: pyparsing
 Requires-Dist: scanoss>=1.45.0
 Requires-Dist: XlsxWriter
-Requires-Dist: fosslight_util>=2.2.12
+Requires-Dist: fosslight_util>=2.2.14
 Requires-Dist: PyYAML
 Requires-Dist: wheel>=0.38.1
 Requires-Dist: intbitset
-Requires-Dist: scancode-toolkit>=32.0.2
+Requires-Dist: scancode-toolkit>=32.5.0
 Requires-Dist: lxml>=6.0.1
 Requires-Dist: cryptography<49; platform_system == "Darwin" and platform_machine == "x86_64"
 Requires-Dist: fingerprints==1.2.3

{fosslight_source-2.3.11 → fosslight_source-2.3.13}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fosslight_source"
-version = "2.3.11"
+version = "2.3.13"
 description = "FOSSLight Source Scanner"
 readme = "README.md"
 license = "Apache-2.0"
@@ -29,11 +29,11 @@ dependencies = [
     "pyparsing",
     "scanoss>=1.45.0",
     "XlsxWriter",
-    "fosslight_util>=2.2.12",
+    "fosslight_util>=2.2.14",
     "PyYAML",
     "wheel>=0.38.1",
     "intbitset",
-    "scancode-toolkit>=32.0.2",
+    "scancode-toolkit>=32.5.0",
     "lxml>=6.0.1",
     # cryptography 49.x does not provide macOS x86_64 wheels, causing source builds to require OpenSSL/pkg-config.
     "cryptography<49; platform_system == 'Darwin' and platform_machine == 'x86_64'",

{fosslight_source-2.3.11 → fosslight_source-2.3.13}/src/fosslight_source/_parsing_scancode_file_item.py

@@ -19,7 +19,10 @@ logger = logging.getLogger(constant.LOGGER_NAME)
 REMOVE_LICENSE = ["warranty-disclaimer"]
 find_word = re.compile(rb"SPDX-PackageDownloadLocation\s*:\s*(\S+)", re.IGNORECASE)
 SPDX_LICENSE_IDENTIFIER_PATTERN = re.compile(
-    r'SPDX[-\s]+License[-\s]+Identifier(?:\s*[:,-]\s*|\s+)([^\r\n]+)',
+    # Require : , or - after Identifier. Bare whitespace is rejected so that
+    # messages like 'Misplaced SPDX-License-Identifier tag - use line ...'
+    # are not treated as license declarations.
+    r'SPDX[-\s]+License[-\s]+Identifier\s*[:,-]\s*([^\r\n]+)',
     re.IGNORECASE,
 )
 # Android Soong license_kinds string, e.g. "SPDX-license-identifier-BSD"
@@ -28,6 +31,7 @@ SOONG_SPDX_LICENSE_KIND_PATTERN = re.compile(
     re.IGNORECASE,
 )
 LICENSE_REF_PREFIX_PATTERN = re.compile(r'^LicenseRef-', re.IGNORECASE)
+LICENSE_REF_SCANCODE_PREFIX_PATTERN = re.compile(r'LicenseRef-scancode-', re.IGNORECASE)
 # Trailing closers from comments and quoted lists, e.g. "MIT */", "MIT -->", or '"MIT",'.
 SPDX_DECLARATION_TRAILER_PATTERN = re.compile(r'\s*(?:\*/|-->|["\']\s*,?)\s*$')
 SPDX_DECLARATION_LINE_COMMENT_PATTERN = re.compile(r'\s//.*$')
@@ -39,6 +43,7 @@ HTTP_URL_PATTERN = re.compile(r'https?://', re.IGNORECASE)
 SPDX_REPLACE_WORDS = ["(", ")"]
 KEY_AND_OR = re.compile(r"(?<=\s)(?:and|or)(?=\s)", re.IGNORECASE)
 KEY_AND_OR_CAPTURE = re.compile(r"(?<=\s)(and|or)(?=\s)", re.IGNORECASE)
+DETECTED_COMMENT_PREFIX = "Detected: "
 # GPL, LGPL, AGPL, GFDL
 GPL_LICENSE_PATTERN = re.compile(r'((a|l)?gpl|gfdl)', re.IGNORECASE)
 FSF_IN_COPYRIGHT = "free software foundation"
@@ -86,6 +91,59 @@ def _file_has_other_license(matches: list) -> bool:
     return False
 
 
+def _matched_text_has_spdx_license_identifier(matched_txt: str) -> bool:
+    """True for classic SPDX-License-Identifier with a colon. Soong dash form does not count."""
+    return bool(
+        re.search(
+            r'SPDX[-\s]+License[-\s]+Identifier\s*:\s*\S',
+            matched_txt or "",
+            flags=re.IGNORECASE,
+        )
+    )
+
+
+def _is_spdx_declaration_line(matched_txt: str) -> bool:
+    """
+    True when matched_text is (mostly) an SPDX declaration line, not code that
+    merely mentions SPDX-License-Identifier (e.g. sed replacements).
+    """
+    if not _extract_spdx_declared_expression(matched_txt):
+        return False
+    stripped = re.sub(r"""^[\s"'#/\*-]+""", "", (matched_txt or "").strip())
+    return bool(
+        re.match(
+            r"SPDX[-\s]+License[-\s]+Identifier\s*[:,-]",
+            stripped,
+            flags=re.IGNORECASE,
+        )
+    )
+
+
+def _file_has_spdx_license_identifier(matches: list) -> bool:
+    """True if any match is a classic SPDX-License-Identifier declaration line (colon form)."""
+    return any(
+        _is_spdx_declaration_line(m.get("matched_text") or "")
+        and _matched_text_has_spdx_license_identifier(m.get("matched_text") or "")
+        for m in (matches or [])
+    )
+
+
+def _file_has_spdx_declared_license(matches: list) -> bool:
+    """True if any match has a recoverable SPDX declaration (incl. Soong kinds)."""
+    for matched_lic in matches or []:
+        if _extract_spdx_declared_expression(matched_lic.get("matched_text") or ""):
+            return True
+    return False
+
+
+def _filter_spdx_declaration_matches(matches: list) -> list:
+    """Keep only matches that are SPDX declaration lines (not code mentions)."""
+    return [
+        matched_lic for matched_lic in (matches or [])
+        if _is_spdx_declaration_line(matched_lic.get("matched_text") or "")
+    ]
+
+
 def _matched_text_has_http_url(matched_text: str) -> bool:
     """Return whether matched text contains an HTTP or HTTPS URL."""
     return bool(HTTP_URL_PATTERN.search(matched_text or ""))
@@ -341,6 +399,97 @@ def _strip_license_ref_prefix(token: str) -> str:
     return LICENSE_REF_PREFIX_PATTERN.sub('', (token or "").strip())
 
 
+def _display_expression_for_detected_comment(match: dict) -> str:
+    """
+    Prefer license_expression_spdx; strip LicenseRef-scancode- for display.
+    Falls back to license_expression when SPDX form is absent.
+    """
+    spdx = (match.get("license_expression_spdx") or "").strip()
+    expr = (match.get("license_expression") or "").strip()
+    value = spdx or expr
+    if not value:
+        return ""
+    return LICENSE_REF_SCANCODE_PREFIX_PATTERN.sub("", value).strip()
+
+
+def _dedupe_detected_comment_expressions(expressions: list[str]) -> list[str]:
+    """
+    Drop exact duplicates, then drop a value if it appears as an AND/OR token
+    of another remaining value (e.g. BSD-2-Clause covered by
+    ``GPL-2.0-only OR BSD-2-Clause``).
+    """
+    unique: list[str] = []
+    for expr in expressions:
+        expr = (expr or "").strip()
+        if not expr:
+            continue
+        if any(expr.lower() == kept.lower() for kept in unique):
+            continue
+        unique.append(expr)
+
+    kept: list[str] = []
+    for idx, candidate in enumerate(unique):
+        others = [unique[j] for j in range(len(unique)) if j != idx]
+        candidate_lower = candidate.lower()
+        covered = False
+        for other in others:
+            other_tokens = [
+                token.lower()
+                for token in split_spdx_expression(other)
+                if token and token.strip()
+            ]
+            if candidate_lower in other_tokens:
+                covered = True
+                break
+        if not covered:
+            kept.append(candidate)
+    return kept
+
+
+def _expression_covered_by_reported_licenses(
+    expression: str, reported_licenses: list
+) -> bool:
+    """
+    True when expression is already represented in License column values.
+
+    Matches the whole expression, or every AND/OR token, case-insensitively.
+    """
+    reported = {
+        (lic or "").strip().lower()
+        for lic in (reported_licenses or [])
+        if (lic or "").strip()
+    }
+    if not expression or not reported:
+        return False
+    expr = expression.strip()
+    if expr.lower() in reported:
+        return True
+    tokens = [
+        token.strip().lower()
+        for token in split_spdx_expression(expr)
+        if token and token.strip()
+    ]
+    return bool(tokens) and all(token in reported for token in tokens)
+
+
+def build_detected_comment_from_dropped_matches(
+    dropped_matches: list, reported_licenses: list | None = None
+) -> str:
+    """Build ``Detected: a, b OR c`` from matches dropped by SPDX priority."""
+    displays = []
+    for match in (dropped_matches or []):
+        display = _display_expression_for_detected_comment(match)
+        if not display:
+            continue
+        if _expression_covered_by_reported_licenses(display, reported_licenses or []):
+            continue
+        displays.append(display)
+    deduped = _dedupe_detected_comment_expressions(displays)
+    if not deduped:
+        return ""
+    return DETECTED_COMMENT_PREFIX + ", ".join(deduped)
+
+
 def _extract_spdx_declared_expression(matched_txt: str) -> str:
     """
     Extract SPDX-License-Identifier value from matched_text.
@@ -385,59 +534,112 @@ def _declared_licenses_from_matched_text(matched_txt: str) -> tuple[list[str], l
     return split_spdx_expression_with_ops(declared)
 
 
-def _build_unknown_spdx_replacement_queue(matches: list) -> list[str]:
-    """Ordered replacements for each unknown-spdx token in match order."""
-    queue = []
-    for matched_lic in matches or []:
-        expr = (matched_lic.get("license_expression") or "").lower()
-        if KEYWORD_SCANCODE_UNKNOWN not in expr:
-            continue
-        match_tokens, _ = split_spdx_expression_with_ops(expr)
-        declared_tokens, declared_ops = _declared_licenses_from_matched_text(
-            matched_lic.get("matched_text") or ""
-        )
-        if not declared_tokens:
-            continue
+def _unknown_spdx_replacements_for_match(
+    expression: str, matched_txt: str
+) -> list[str]:
+    """
+    Ordered replacements for each unknown-spdx token in one match expression.
 
-        unknown_indexes = [
-            idx for idx, token in enumerate(match_tokens)
-            if KEYWORD_SCANCODE_UNKNOWN in token
-        ]
-        if not unknown_indexes:
+    Known tokens are never replaced. When token counts match, each unknown maps
+    to the declared token at the same index (e.g. gpl-2.0 OR unknown-spdx with
+    ``GPL-2.0 or MIT-like`` → MIT-like only).
+    """
+    expr = (expression or "").lower()
+    if KEYWORD_SCANCODE_UNKNOWN not in expr:
+        return []
+    match_tokens, _ = split_spdx_expression_with_ops(expr)
+    declared_tokens, declared_ops = _declared_licenses_from_matched_text(matched_txt)
+    if not declared_tokens:
+        return []
+
+    unknown_indexes = [
+        idx for idx, token in enumerate(match_tokens)
+        if KEYWORD_SCANCODE_UNKNOWN in token
+    ]
+    if not unknown_indexes:
+        return []
+
+    queue: list[str] = []
+    if len(match_tokens) == len(declared_tokens):
+        for idx in unknown_indexes:
+            queue.append(
+                _normalize_license_token(declared_tokens[idx]) or declared_tokens[idx]
+            )
+        return queue
+
+    if all(KEYWORD_SCANCODE_UNKNOWN in token for token in match_tokens):
+        if len(match_tokens) == 1:
+            norms = [_normalize_license_token(token) or token for token in declared_tokens]
+            queue.append(join_licenses_with_ops(norms, declared_ops))
+        else:
+            for i, _ in enumerate(unknown_indexes):
+                declared = (
+                    declared_tokens[i] if i < len(declared_tokens) else declared_tokens[-1]
+                )
+                queue.append(_normalize_license_token(declared) or declared)
+        return queue
+
+    # Mixed known + unknown with different declared length:
+    # drop declared tokens that correspond to known match tokens, then assign the rest.
+    unused = list(declared_tokens)
+    for token in match_tokens:
+        if KEYWORD_SCANCODE_UNKNOWN in token:
             continue
+        token_norm = (_normalize_license_token(token) or token).lower()
+        for idx, declared in enumerate(unused):
+            declared_norm = (_normalize_license_token(declared) or declared).lower()
+            if declared_norm == token_norm or declared.lower() == token.lower():
+                unused.pop(idx)
+                break
+    for _ in unknown_indexes:
+        if not unused:
+            break
+        declared = unused.pop(0)
+        queue.append(_normalize_license_token(declared) or declared)
+    return queue
 
-        if len(match_tokens) == len(declared_tokens):
-            for idx in unknown_indexes:
-                queue.append(_normalize_license_token(declared_tokens[idx]) or declared_tokens[idx])
-            continue
 
-        if all(KEYWORD_SCANCODE_UNKNOWN in token for token in match_tokens):
-            if len(match_tokens) == 1:
-                norms = [_normalize_license_token(token) or token for token in declared_tokens]
-                queue.append(join_licenses_with_ops(norms, declared_ops))
-            else:
-                for i, _ in enumerate(unknown_indexes):
-                    declared = declared_tokens[i] if i < len(declared_tokens) else declared_tokens[-1]
-                    queue.append(_normalize_license_token(declared) or declared)
-            continue
+def _resolve_unknown_spdx_in_expression(expression: str, matched_txt: str) -> str:
+    """
+    Restore unknown-spdx in an expression from matched_text.
 
-        # Mixed known + unknown tokens with different declared length:
-        # drop declared tokens that correspond to known match tokens, then assign the rest.
-        unused = list(declared_tokens)
-        for token in match_tokens:
-            if KEYWORD_SCANCODE_UNKNOWN in token:
-                continue
-            token_norm = (_normalize_license_token(token) or token).lower()
-            for idx, declared in enumerate(unused):
-                declared_norm = (_normalize_license_token(declared) or declared).lower()
-                if declared_norm == token_norm or declared.lower() == token.lower():
-                    unused.pop(idx)
-                    break
-        for _ in unknown_indexes:
-            if not unused:
-                break
-            declared = unused.pop(0)
-            queue.append(_normalize_license_token(declared) or declared)
+    - All tokens unknown → use the full declared expression
+    - Mixed known + unknown → replace only unknown tokens; keep known tokens
+    - Returns empty string when unknown cannot be restored from matched_text
+    """
+    tokens, ops = split_spdx_expression_with_ops(expression)
+    if not tokens:
+        return ""
+    unknown_indexes = [
+        idx for idx, token in enumerate(tokens)
+        if KEYWORD_SCANCODE_UNKNOWN in token.lower()
+    ]
+    if not unknown_indexes:
+        return expression
+
+    if all(KEYWORD_SCANCODE_UNKNOWN in token.lower() for token in tokens):
+        return _extract_spdx_declared_expression(matched_txt)
+
+    queue = _unknown_spdx_replacements_for_match(expression, matched_txt)
+    new_tokens = list(tokens)
+    for i, idx in enumerate(unknown_indexes):
+        new_tokens[idx] = queue[i] if i < len(queue) else ""
+    kept_tokens, kept_ops = _kept_tokens_with_merged_ops(new_tokens, ops)
+    if not kept_tokens:
+        return ""
+    return join_licenses_with_ops(kept_tokens, kept_ops)
+
+
+def _build_unknown_spdx_replacement_queue(matches: list) -> list[str]:
+    """Ordered replacements for each unknown-spdx token in match order."""
+    queue = []
+    for matched_lic in matches or []:
+        queue.extend(
+            _unknown_spdx_replacements_for_match(
+                matched_lic.get("license_expression") or "",
+                matched_lic.get("matched_text") or "",
+            )
+        )
     return queue
 
 
@@ -574,53 +776,78 @@ def parsing_scancode(
                 all_matches = []
                 for lic in licenses or []:
                     all_matches.extend(lic.get("matches") or [])
+                # SPDX priority: if the file has SPDX-License-Identifier (:/,/-),
+                # keep only matches that are SPDX declarations (drop body rule hits).
+                prefer_spdx_declarations = _file_has_spdx_license_identifier(all_matches)
+                matches_to_process = (
+                    _filter_spdx_declaration_matches(all_matches)
+                    if prefer_spdx_declarations
+                    else list(all_matches or [])
+                )
                 has_other_license_in_file = _file_has_other_license(all_matches)
+                has_spdx_declared_license = _file_has_spdx_declared_license(all_matches)
                 suppress_unknown_license_reference = (
                     _should_suppress_unknown_license_reference(
                         all_matches, has_other_license_in_file
                     )
                 )
-                for lic in licenses or []:
-                    matched_lic_list = lic.get("matches", [])
-                    for matched_lic in matched_lic_list:
-                        found_lic_list = matched_lic.get("license_expression", "")
-                        matched_txt = matched_lic.get("matched_text", "")
-                        if found_lic_list:
-                            found_lic_list = found_lic_list.lower()
-                            if KEYWORD_SCANCODE_UNKNOWN in found_lic_list:
+                # Prefer-SPDX filters matches; matched_text extraction is only for unknown-spdx.
+                # Mixed expressions keep known tokens and replace unknown tokens only.
+                for matched_lic in matches_to_process:
+                    found_lic_list = matched_lic.get("license_expression", "")
+                    matched_txt = matched_lic.get("matched_text", "")
+                    if not found_lic_list:
+                        continue
+                    found_lic_list = found_lic_list.lower()
+                    if KEYWORD_SCANCODE_UNKNOWN in found_lic_list:
+                        resolved = _resolve_unknown_spdx_in_expression(
+                            found_lic_list, matched_txt
+                        )
+                        if resolved:
+                            found_lic_list = resolved
+                            resolved_unknown_spdx = True
+                        elif has_spdx_declared_license:
+                            # File already has SPDX declarations; drop unrestorable
+                            # unknown-spdx noise (e.g. misplaced-tag messages).
+                            tokens = [
+                                t for t in split_spdx_expression(found_lic_list)
+                                if KEYWORD_SCANCODE_UNKNOWN not in t.lower()
+                            ]
+                            if not tokens:
+                                continue
+                            found_lic_list = " AND ".join(tokens)
+
+                    for found_lic in split_spdx_expression(found_lic_list):
+                        if found_lic:
+                            found_lic = found_lic.strip()
+                            if found_lic in REMOVE_LICENSE:
+                                continue
+                            if (
+                                KEYWORD_UNKNOWN_LICENSE_REFERENCE in found_lic.lower()
+                                and not _should_keep_unknown_license_reference(
+                                    matched_txt, has_other_license_in_file
+                                )
+                            ):
+                                continue
+                            if KEYWORD_SCANCODE_UNKNOWN in found_lic.lower():
                                 declared = _extract_spdx_declared_expression(matched_txt)
                                 if declared:
-                                    found_lic_list = declared
+                                    found_lic = declared
                                     resolved_unknown_spdx = True
-                            for found_lic in split_spdx_expression(found_lic_list):
-                                if found_lic:
-                                    found_lic = found_lic.strip()
-                                    if found_lic in REMOVE_LICENSE:
-                                        continue
-                                    if (
-                                        KEYWORD_UNKNOWN_LICENSE_REFERENCE in found_lic.lower()
-                                        and not _should_keep_unknown_license_reference(
-                                            matched_txt, has_other_license_in_file
-                                        )
-                                    ):
-                                        continue
-                                    if KEYWORD_SCANCODE_UNKNOWN in found_lic.lower():
-                                        declared = _extract_spdx_declared_expression(matched_txt)
-                                        if declared:
-                                            found_lic = declared
-                                            resolved_unknown_spdx = True
-                                    found_lic = _strip_license_ref_prefix(found_lic)
-                                    found_lic = _normalize_license_token(found_lic) or found_lic
-                                    if not found_lic:
-                                        continue
-                                    if matched_txt:
-                                        lic_matched_key = found_lic + matched_txt
-                                        if lic_matched_key in license_list:
-                                            license_list[lic_matched_key].set_files(file_path)
-                                        else:
-                                            lic_info = MatchedLicense(found_lic, "", matched_txt, file_path)
-                                            license_list[lic_matched_key] = lic_info
-                                    license_detected.append(found_lic)
+                                elif has_spdx_declared_license:
+                                    continue
+                            found_lic = _strip_license_ref_prefix(found_lic)
+                            found_lic = _normalize_license_token(found_lic) or found_lic
+                            if not found_lic:
+                                continue
+                            if matched_txt:
+                                lic_matched_key = found_lic + matched_txt
+                                if lic_matched_key in license_list:
+                                    license_list[lic_matched_key].set_files(file_path)
+                                else:
+                                    lic_info = MatchedLicense(found_lic, "", matched_txt, file_path)
+                                    license_list[lic_matched_key] = lic_info
+                            license_detected.append(found_lic)
                 result_item.licenses = license_detected
                 file_ext = os.path.splitext(file_path)[1].lower()
                 is_source_file = file_ext and file_ext in SOURCE_EXTENSIONS
@@ -634,7 +861,22 @@ def parsing_scancode(
                     )
                 )
 
-                if len(license_detected) > 1:
+                # Comment:
+                # - If SPDX priority dropped body matches, always record them as
+                #   ``Detected: ...`` (OR unrelated).
+                # - Else, for multi-license OR expressions, rebuild from detected_*.
+                dropped_matches = []
+                if prefer_spdx_declarations:
+                    process_ids = {id(match) for match in matches_to_process}
+                    dropped_matches = [
+                        match for match in all_matches if id(match) not in process_ids
+                    ]
+                    detected_comment = build_detected_comment_from_dropped_matches(
+                        dropped_matches, result_item.licenses
+                    )
+                    if detected_comment:
+                        result_item.comment = detected_comment
+                if not result_item.comment and len(license_detected) > 1:
                     detected_expression = file.get("detected_license_expression", "") or ""
                     detected_expression_spdx = file.get("detected_license_expression_spdx", "") or ""
                     if (

{fosslight_source-2.3.11 → fosslight_source-2.3.13}/src/fosslight_source/cli.py

@@ -176,15 +176,14 @@ def create_report_file(
         for i, output_extension in enumerate(output_extensions):
             if output_files[i] is None or output_files[i] == "":
                 if formats:
-                    if formats[i].startswith('spdx') or formats[i].startswith('cyclonedx'):
+                    if formats[i].startswith('spdx'):
                         if platform.system() == 'Windows':
                             logger.warning(f'{formats[i]} is not supported on Windows.Please remove {formats[i]} from format.')
                             to_remove.append(i)
                         else:
-                            if formats[i].startswith('spdx'):
-                                output_files[i] = f"fosslight_spdx_src_{name_time}"
-                            elif formats[i].startswith('cyclonedx'):
-                                output_files[i] = f'fosslight_cyclonedx_src_{name_time}'
+                            output_files[i] = f"fosslight_spdx_src_{name_time}"
+                    elif formats[i].startswith('cyclonedx'):
+                        output_files[i] = f'fosslight_cyclonedx_src_{name_time}'
                     else:
                         if output_extension == _json_ext:
                             output_files[i] = f"fosslight_opossum_src_{name_time}"
@@ -276,7 +275,8 @@ def create_report_file(
         # if need_license and output_extension == _json_ext and "scanoss_reference" in sheet_list:
         #     del sheet_list["scanoss_reference"]
         result = write_output_file(
-            combined_path_and_file, output_extension, scan_item, hide_header="", format=output_format
+            combined_path_and_file, output_extension, scan_item, hide_header="", format=output_format,
+            scanner_covers=[scan_item.cover]
         )
         results.append(result)
     for success, msg, result_file in results:
@@ -454,16 +454,22 @@ def merge_results(
                 scancode_result.append(new_result_item)
     if manifest_licenses:
         for file_name, licenses in manifest_licenses.items():
-            valid_licenses = [lic.strip() for lic in licenses if isinstance(lic, str) and lic.strip()]
+            # None: marker-only (keep ScanCode). list (incl. []): overwrite with extracted result.
+            keep_scancode_licenses = licenses is None
+            license_list = [] if keep_scancode_licenses else licenses
+            valid_licenses = [
+                lic.strip() for lic in license_list if isinstance(lic, str) and lic.strip()
+            ]
             item = _get_or_append_source_item(
                 scancode_result, file_name, append=bool(valid_licenses) or ui_mode
             )
             if item is None:
                 continue
             item.is_manifest_file = True
+            if keep_scancode_licenses:
+                continue
+            item.licenses = []
             if valid_licenses:
-                # overwrite existing detected licenses with manifest-provided licenses
-                item.licenses = []  # clear existing licenses (setter clears when value falsy)
                 item.licenses = valid_licenses
 
     kb_origin_urls: dict[str, str] = {}
@@ -719,7 +725,9 @@ def metadata_collector(path_to_scan: str, excluded_files: set) -> tuple[dict, di
 
     - Traverse files with exclusions applied
     - spdx_downloads: {rel_path: [download_urls]}
-    - manifest_licenses: {rel_path: [license_names]} (empty list if extraction failed)
+    - manifest_licenses: {rel_path: list[str] | None}
+        - list (incl. []): overwrite ScanCode licenses with this result
+        - None: marker-only; keep ScanCode licenses
 
     :return: (spdx_downloads, manifest_licenses)
     """
@@ -739,7 +747,8 @@ def metadata_collector(path_to_scan: str, excluded_files: set) -> tuple[dict, di
                 spdx_downloads[rel_path_file] = downloads
 
             if is_manifest_file(file_path):
-                manifest_licenses[rel_path_file] = get_manifest_licenses(file_path) or []
+                # Preserve None (marker-only); do not coerce with `or []`.
+                manifest_licenses[rel_path_file] = get_manifest_licenses(file_path)
 
     return spdx_downloads, manifest_licenses