I decided to follow spdx.org and not to differentiate those two. Packages would often have the wrong version anyway.