SCM, SPDX license