An aside to the specific change, but if there's an established pattern of defining multilicensed projects using (X AND Y), maybe we could automate the parsing to check that each are individually valid licenses. As I write this, I see we do this already for "OR" combinations. Perhaps worth creating as a separate task?

Yah, OR was the more common occurrence when I originally wrote this script, so I just wrote a basic parser for those expressions.

The two major factors for doing it in our own script, instead of using an existing package, were:

• The official SPDX parser doesn't allow for invalid license strings.
• There wasn't anything that worked really well for extracting the license from places other than package.json.

We'd probably need to keep our extractor, but something like this could work:

• Test if the license is valid with spdx-expression-validate.
• If it isn't, try and correct it with spdx-correct.
• Check if the license is GPL-2.0 compatible with spdx-satisfies.

That at least avoids us having to write a proper expression parser.

Let's get this in as-is and iterate on improvements separately.