This should be quite easy to do as there is a JSON schema that validates the plugin.json anyway. We basically only need a comma separated list more or less. The only annoying thing be that people might have problems to release a plugin update when they are not using one of those values yet but they would receive an email in this case.

Not sure which ones we would need to whitelist.

If there is already a validation I guess there are 2 solutions:
Quick:

• use the list from https://github.com/sindresorhus/spdx-license-list/blob/master/spdx-simple.json and remove the licenses you don’t want to allow on the marketplace (and add the innocraft license)
• pedantic
  SPDX allows modifiers like „MIT and GPL-3.0+“, so one could use something like https://github.com/composer/spdx-licenses to validate it. But this way compatibility with the GPL can’t be checked.

👍 awesome there is such a json file. The only challenge be to find out all GPL compatible licenses.
From https://developer.matomo.org/guides/distributing-your-plugin:

The license must be compatible with the GPLv3 or later (for free plugins)

We could also start with a small list based on what licenses are used now, then on request add more licenses (we can mention this in the email when validation fails)

I guess that's the simplest solution. The list above should contain all currently used licenses.

So this converts to

["GPL-3.0+","GPL-3.0", "BSD AND GPL-3.0+", "InnoCraft EULA", "GPL-2.0-only", "GPL-2.0+", "MIT"]

fair use isn't a license but we could add CC0-1.0 and/or WTFPL for people who consider the MIT license as to strict. (they are both GPL3 compatible according to https://www.gnu.org/licenses/license-list.de.html)

"BSD & GPL v3+","1"
"GPL","1"
"GPL 3.0","1"
"GPL 3.0 / fair use","1"
"GPL v3","7"
"GPL v3+","63"
"GPL-3.0+","11"
"GPLv3","4"
"GPLv3 or later","1"
"GPLv3+","1"
"InnoCraft EULA","17"
"MIT","2"

quickly extracted some stats. I'll allow GPL v3+ for now as well as Matomo uses it by default. Ideally we would change this in core to no longer use it as default.

FYI: Issued https://github.com/matomo-org/developer-documentation/pull/217/files

while "GPL v3+" is supported, I do not mention it there so ideally users directly use a different one.

done