use spdx license codes