It seems that we only check that "license" field exists but not actually evaluate SPDX expression.
Thank you!