PR #21 introduced the option to specify licenses of Extractors using the SPDX license identifiers. However, we're not checking whether the supplied string is an actual identifier.
Option one is to check against a release of the SPDX data "statically".
Option two would be to probe an up-to-date online SPDX Identifier database. These seem to be queryable using the following format:
https://spdx.org/licenses/${identifier}.html
and will return a 404 if the ${identifier} is not a valid SPDX license identifier. We could leverage this and validate the provided entries against the live data.
From: marda-alliance/metadata_extractors_schema#24
From: marda-alliance/metadata_extractors_schema#24