https://bugzilla.redhat.com/show_bug.cgi?id=2040728
--- Comment #16 from Artur Frenszek-Iwicki fedora@svgames.pl ---
License: GPLv2+ MIT
So... On one hand, the value here should be "GPLv2+ and MIT". It's important to use "and" or "or" here. https://docs.fedoraproject.org/en-US/packaging-guidelines/LicensingGuideline...
...on the other hand, the license field applies only to the resulting RPM package. As such, the fact that halibut is MIT-licensed is irrelevant, as it is only used for processing some files during the build process, and neither the halibut executable, nor any halibut code is shipped in the resulting package. With cJSON unbundled (hint: you can try removing the cjson files during %prep to be 100% sure the system library is used), I think the resulting package is now GPLv2.
Requires: cjson
This is not required. rpmbuild picks up the list of required .so files from the xtrkcad executable and builds the Requires list based on that.