We use short names like “Apache 2”, but the raw license data uses long names (“The Apache Software License, Version 2.0”) and URLs (http://www.apache.org/licenses/LICENSE-2.0.txt). By using its list of standard license URLs and adding additional variants from the wild, each license can be normalized to a SPDX identifier. With each license now mapped to a SPDX identifier, solving #3 is as simple as creating an allow-list of identifiers and failing the build if a disallowed license shows up.