@@ -226,8 +226,11 @@ def _append_component(
226
226
if not new_component .get ('licenses' ):
227
227
self .print_debug (f'WARNING: Results missing licenses. Skipping: { new_component } ' )
228
228
return components
229
+
230
+
231
+ licenses_order_by_source_priority = self ._get_licenses_order_by_source_priority (new_component ['licenses' ])
229
232
# Process licenses for this component
230
- for license_item in new_component [ 'licenses' ] :
233
+ for license_item in licenses_order_by_source_priority :
231
234
if license_item .get ('name' ):
232
235
spdxid = license_item ['name' ]
233
236
source = license_item .get ('source' )
@@ -436,6 +439,48 @@ def _convert_components_to_list(self, components: dict):
436
439
self .print_debug (f'WARNING: Licenses missing for: { component } ' )
437
440
component ['licenses' ] = []
438
441
return results_list
442
+
443
+ def _get_licenses_order_by_source_priority (self ,licenses_data ):
444
+ """
445
+ Select licenses based on source priority:
446
+ 1. component_declared (highest priority)
447
+ 2. license_file
448
+ 3. file_header
449
+ 4. scancode (lowest priority)
450
+
451
+ If any high-priority source is found, return only licenses from that source.
452
+ If none found, return all licenses.
453
+
454
+ Returns: list with ordered licenses by source.
455
+ """
456
+ # Define priority order (highest to lowest)
457
+ priority_sources = ['component_declared' , 'license_file' , 'file_header' , 'scancode' ]
458
+
459
+ # Group licenses by source
460
+ licenses_by_source = {}
461
+ for license_item in licenses_data :
462
+
463
+ source = license_item .get ('source' , 'unknown' )
464
+ if source not in licenses_by_source :
465
+ licenses_by_source [source ] = {}
466
+
467
+ license_name = license_item .get ('name' )
468
+ if license_name :
469
+ # Use license name as key, store full license object as value
470
+ # If duplicate license names exist in same source, the last one wins
471
+ licenses_by_source [source ][license_name ] = license_item
472
+
473
+ # Find the highest priority source that has licenses
474
+ for priority_source in priority_sources :
475
+ if priority_source in licenses_by_source :
476
+ self .print_trace (f'Choosing { priority_source } as source' )
477
+ return list (licenses_by_source [priority_source ].values ())
478
+
479
+ # If no priority sources found, combine all licenses into a single list
480
+ self .print_debug ("No priority sources found, returning all licenses as list" )
481
+ return licenses_data
482
+
483
+
439
484
#
440
485
# End of PolicyCheck Class
441
486
#
0 commit comments