diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 283c906..ed32ba4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -168,6 +168,12 @@ jobs: - php: '8.5' wp: '7.0' experimental: false + - php: '8.4' + wp: '7.1' + experimental: false + - php: '8.5' + wp: '7.1' + experimental: false - php: '8.5' wp: 'trunk' experimental: true diff --git a/LICENSE b/LICENSE index 55435ea..e74937c 100644 --- a/LICENSE +++ b/LICENSE @@ -1,21 +1,357 @@ -MIT License - -Copyright (c) 2026 Tsvetan Stoychev - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. +Basicrum - Real User Monitoring for WordPress +Copyright (C) 2026 Tsvetan Stoychev and the Basicrum contributors + +This program is free software; you can redistribute it and/or modify it under +the terms of the GNU General Public License as published by the Free Software +Foundation; either version 2 of the License, or (at your option) any later +version. + +This program is distributed in the hope that it will be useful, but WITHOUT ANY +WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A +PARTICULAR PURPOSE. See the GNU General Public License for more details. + +You should have received a copy of the GNU General Public License along with +this program; if not, write to the Free Software Foundation, Inc., 51 Franklin +Street, Fifth Floor, Boston, MA 02110-1301 USA. + +Bundled third-party software keeps its own license. See +plugins/basicrum/THIRD-PARTY-NOTICES.txt. + + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc., + + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Lesser General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License along + with this program; if not, see . + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) year name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + , 1 April 1989 + Moe Ghoul, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. diff --git a/README.md b/README.md index e411c6b..b4dbd5c 100644 --- a/README.md +++ b/README.md @@ -70,7 +70,7 @@ The tag workflow verifies the version, runs the release tests, builds and smoke- Read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request. Report suspected vulnerabilities privately according to [SECURITY.md](SECURITY.md), not through a public issue. -Basicrum-owned code is available under the [MIT License](LICENSE). Bundled third-party software retains its upstream license; see the plugin's [third-party notices](plugins/basicrum/THIRD-PARTY-NOTICES.txt). +Basicrum-owned code is available under the [GNU General Public License version 2 or later](LICENSE). Bundled third-party software retains its upstream license; see the plugin's [third-party notices](plugins/basicrum/THIRD-PARTY-NOTICES.txt). ## Contributors diff --git a/docs/audits/wporg-submission-checklist.md b/docs/audits/wporg-submission-checklist.md index 0df9586..2054fa6 100644 --- a/docs/audits/wporg-submission-checklist.md +++ b/docs/audits/wporg-submission-checklist.md @@ -46,12 +46,34 @@ refuters. 84 claims audited: 52 clean, 24 upheld findings, 8 overturned. 0.0.x builds and can be misread as shipped-version history. Decide whether 0.0.7/0.0.6 entries stay (internal history) or fold in. (C13, C14) -- [ ] Run Plugin Check against the BUILT release/basicrum.zip (not the - repo tree) after the fixes and keep the output for the submission. (B7) -- [ ] Tested up to 7.0: internally defensible (blocking CI rows for wp - 7.0 exist; format correct - verdict overturned by refuters), but - re-confirm on submission day that WordPress 7.0 is the current released - stable. (R05) +- [x] RESOLVED 2026-08-20: Plugin Check 2.1.0 run against the built ZIP found + a single error - outdated_tested_upto_header (WordPress 7.1 had shipped) - + and zero other findings; all seven earlier findings confirmed fixed. Final + 0/0 confirmation run against the 7.1-bumped ZIP in progress. (B7) +- [x] RESOLVED 2026-08-20: the permanent directory slug is decided. wp.org + autogenerates the slug from the plugin header Plugin Name at submission and + cannot rename it after approval, so `Basicrum - Real User Monitoring` will be + offered `basicrum-real-user-monitoring`. The display name stays descriptive + and the shorter `basicrum` slug is requested through the documented one-time + correction: the FAQ states "You can update your slug once after submitting + it. Every submission gets an automated email with directions." Both + `basicrum` and `basicrum-real-user-monitoring` were unregistered on + 2026-08-20 (wordpress.org/plugins// redirects to search for each). + `basicrum` is what the generated POT `Report-Msgid-Bugs-To` and the plugin + directory name already assume, so taking it keeps the support URL correct. + This is a user-only action on submission day; see the list below. +- [x] RESOLVED 2026-08-20: External services now links the service privacy + information guideline 6 and the common-issues page ask for. The Basicrum + Privacy Notice covers only basicrum.com, its contact form, and beta requests, + so the readme says exactly that and directs webmasters to request the hosted + collector's own terms and privacy notice. Publishing those two documents is + still an open user-only action. +- [x] RESOLVED 2026-08-20: WordPress stable moved to 7.1 and Plugin Check + now errors on Tested up to below current stable. Integration suite run + locally against a verified real WordPress 7.1 core (wp_version 7.1, + 4 tests green), blocking rows php 8.4/wp 7.1 and php 8.5/wp 7.1 added to + ci.yml, readme bumped to Tested up to: 7.1, ZIP rebuilt. GitHub CI must + confirm the new rows green on push before tagging. (R05) ## 3. Ambiguity fixes - upheld copy issues @@ -75,10 +97,9 @@ refuters. 84 claims audited: 52 clean, 24 upheld findings, 8 overturned. "Strictness" relaxes enforcement). Rewrite the FAQ to lead with the default (auto-upgrade to HTTPS) and what the toggle actually allows; the label rename remains open from the operator-experience audit. (C08) -- [ ] "eligible pages" in the contributed privacy-policy text - (Privacy.php immediate-mode sentence) is undefined for site owners; - spell out: frontend pages, admins excluded unless Track Admin Users. - (C12) +- [x] RESOLVED 2026-08-20: immediate-mode sentence now says "frontend + pages" with the administrator exclusion spelled out; PrivacyTest pins + both phrases. (C12) - [x] Define "connected" CookieYes at first use. Resolved by removing the ambiguous implementation detail from the customer-facing overview. (C07) - [x] Replace "fails closed" jargon with plain language. (C19) @@ -92,11 +113,8 @@ refuters. 84 claims audited: 52 clean, 24 upheld findings, 8 overturned. - [x] Screenshots: four current WordPress 7.0.2 settings captures use the exact Visitor Consent and Consent Tool Connection labels, privacy-safe example values, and matching numbered captions in `readme.txt`. (C24) -- [ ] Spot-check the two basicrum.com URLs (home, /contact/) resolve; - reviewers click them. (R45) -- [ ] CookieYes "modern ... runtime" - one refuter pair split on this; - consider "CookieYes 3.x" with a one-line legacy note for precision. - (C06) +- [x] RESOLVED 2026-08-20: both URLs return HTTP 200. (R45) +- [x] RESOLVED: readme now says "CookieYes 3.x". (C06) ## 5. Verified clean (highlights) @@ -105,9 +123,13 @@ refuters. 84 claims audited: 52 clean, 24 upheld findings, 8 overturned. - [x] Short description 95 chars (under 150), byte-identical to the header Description; privacy-first claim backed by defaults. (R09, C01 overturned) -- [x] MIT license declared consistently (readme, header, LICENSE.md, - composer.json); GPL-compatible; Boomerang BSD is GPL-compatible; - THIRD-PARTY-NOTICES.txt scopes correctly. (R08, B1) +- [x] SUPERSEDED 2026-08-20: relicensed from MIT to GPLv2-or-later so the + listing matches the license guideline 1 recommends. GPLv2 text now ships in + LICENSE and plugins/basicrum/LICENSE.md; header, readme, composer.json + (`GPL-2.0-or-later`), THIRD-PARTY-NOTICES.txt, root README, and the + regenerated POT all agree. Boomerang stays BSD and GPL-compatible, and + THIRD-PARTY-NOTICES.txt still scopes it out of the Basicrum license. + Original finding: MIT declared consistently and GPL-compatible. (R08, B1) - [x] All five tags valid and implemented; Requires at least 6.0 and Requires PHP 7.4 match headers, composer, and CI matrix. (R03, R04, R06) - [x] Feature claims verified against code: page-type values verbatim in @@ -125,5 +147,17 @@ refuters. 84 claims audited: 52 clean, 24 upheld findings, 8 overturned. ## User-only actions before submission day 1. Register/confirm the wordpress.org username matching Contributors. -2. Re-confirm WordPress 7.0 is the current released stable. +2. Re-confirm WordPress 7.1 is the current released stable. 3. Verify basicrum.com pages linked from the listing are live. +4. Publish the hosted-service Terms of Service and a privacy notice that covers + the hosted collector, then link both from the readme External services + section. See docs/privacy-policy-preparation-checklist.md steps 14 and 15. +5. Confirm the two outside code contributors are content with the GPLv2-or-later + relicense. MIT permits the sublicense, so this is a courtesy record, not a + blocker. +6. On the submission email, use the one-time slug update to change + `basicrum-real-user-monitoring` to `basicrum` before approval. The slug is + permanent afterwards, and it also sets the SVN path, the installed folder + name, and the support URL the POT already points at. Keep the display name + `Basicrum - Real User Monitoring`; wp.org treats display name and slug + separately, and the display name stays editable after approval. diff --git a/docs/privacy-policy-preparation-checklist.md b/docs/privacy-policy-preparation-checklist.md new file mode 100644 index 0000000..ba180dc --- /dev/null +++ b/docs/privacy-policy-preparation-checklist.md @@ -0,0 +1,368 @@ +# Basicrum Privacy Policy Preparation Checklist + +Use this checklist to prepare the public Privacy Policy for `basicrum.com` and +the hosted Basicrum service. Complete the sections in order. Write `unknown` +when an answer is not available yet instead of guessing. + +This is a compliance-readiness worksheet, not legal advice. Decisions about +controller roles, legal bases, cookie requirements, international transfers, +and German business status should be confirmed by qualified counsel. + +## Keep private information out of Git + +- [ ] Do not enter a home address, private phone number, API key, password, + customer identifier, contract, or security-sensitive infrastructure detail + in this public repository. +- [ ] Use placeholders such as `[PUBLIC SERVICE ADDRESS]` in this file. +- [ ] Keep the complete vendor and contract records in a private location. +- [ ] Add the real public contact details directly to the final website page. + +## Status labels + +Use these labels beside unresolved decisions: + +- `PASS` - the statement is supported by code, runtime evidence, and current + documentation. +- `FAIL` - actual behavior and the proposed disclosure do not agree. +- `NEEDS LEGAL DECISION` - the answer depends on law, contracts, roles, + jurisdiction, or a business decision. +- `NOT APPLICABLE` - evidence shows that the item does not apply. + +## Step 1: Identify the controller + +- [ ] Confirm the controller's full legal name and spelling. + - Public value: `[FULL LEGAL NAME]` +- [ ] Confirm that this person alone decides why and how Basicrum processes + personal data. + - Answer: `[YES / NO / UNKNOWN]` +- [ ] Record whether another contributor jointly decides collection, + retention, vendors, product purposes, or customer terms. + - Answer: `[TO COMPLETE]` +- [ ] If another person jointly makes those decisions, stop and assess joint + controllership under GDPR Article 26. + - Status: `NEEDS LEGAL DECISION` +- [ ] Confirm the German city and federal state from which Basicrum is + operated. Do not put the street address here. + - City/state: `[CITY, FEDERAL STATE]` +- [ ] Choose a serviceable postal address for the final Privacy Policy and + Impressum. + - Public placeholder: `[PUBLIC SERVICE ADDRESS]` +- [ ] Create or confirm the privacy contact email. + - Proposed value: `privacy@basicrum.com` +- [ ] Identify the competent German data-protection supervisory authority. + - Authority: `[TO COMPLETE AFTER FEDERAL STATE IS KNOWN]` + +Suggested opening, only if one person is the sole controller: + +> Basicrum is a project operated by `[FULL LEGAL NAME]`. For the processing +> described in this Privacy Policy, the controller is `[FULL LEGAL NAME]`, +> `[PUBLIC SERVICE ADDRESS]`, Germany. Privacy questions and requests can be +> sent to `privacy@basicrum.com`. + +## Step 2: Define what the policy covers + +- [ ] Confirm that the policy covers the public `basicrum.com` website. +- [ ] Confirm that it covers contact and private-beta requests. +- [ ] Confirm that it covers hosted Basicrum customer accounts. +- [ ] Confirm that it covers the hosted collector and dashboard. +- [ ] Decide whether `demo.playground.basicrum.com` is covered by the same + policy or needs a separate notice. + - Answer: `[TO COMPLETE]` +- [ ] State that self-hosted Basicrum operators are responsible for their own + processing and privacy notices. +- [ ] List any other Basicrum domains or applications in scope. + - Domains/apps: `[TO COMPLETE]` + +## Step 3: Inventory the public website + +### Hosting and request logs + +- [ ] Name the website hosting provider privately and record its country. + - Provider/country: `[TO COMPLETE]` +- [ ] Record whether a CDN, reverse proxy, DNS proxy, or DDoS provider receives + visitor requests. + - Provider/country: `[TO COMPLETE]` +- [ ] Confirm which request-log fields are stored: IP address, timestamp, + requested URL, referrer, user agent, response status, and error details. + - Fields: `[TO COMPLETE]` +- [ ] Set and verify the request-log retention period. + - Retention: `[TO COMPLETE]` +- [ ] Document the security and service-delivery purpose. +- [ ] Select and legally review the applicable GDPR legal basis. + - Status: `NEEDS LEGAL DECISION` + +### Contact and private-beta requests + +- [ ] Describe what happens when someone submits an email address or contact + request on `basicrum.com`. +- [ ] List every collected field. + - Fields: `[TO COMPLETE]` +- [ ] Name the email, form, CRM, or newsletter provider privately. + - Provider/country: `[TO COMPLETE]` +- [ ] Confirm whether double opt-in is used for marketing email. + - Answer: `[YES / NO / NOT APPLICABLE]` +- [ ] Separate service or beta-request messages from marketing subscriptions. +- [ ] Set retention for accepted, rejected, abandoned, and withdrawn requests. + - Retention: `[TO COMPLETE]` +- [ ] Explain how consent can be withdrawn where consent is the legal basis. + +### Website cookies and third-party content + +- [ ] Run a cookie and browser-storage inventory on the public website. +- [ ] List each cookie or storage key, provider, purpose, lifetime, domain, + path, Secure flag, and SameSite value. +- [ ] Inventory analytics, error monitoring, support chat, embedded media, + fonts, maps, CAPTCHA, and social-media embeds. +- [ ] Confirm which resources contact third parties before consent. +- [ ] Implement a consent mechanism where legally required. + - Status: `NEEDS LEGAL DECISION` + +## Step 4: Inventory Basicrum customer accounts + +- [ ] List the data collected for beta access and account creation. + - Possible categories to confirm: name, email, password or identity-provider + identifier, organization, website, Brum Site ID, and account status. +- [ ] Confirm whether passwords are stored directly or delegated to an + identity provider. +- [ ] Describe the purpose of each account-data field. +- [ ] Identify which fields are required and what happens if they are not + provided. +- [ ] Set account-data retention during the beta and after account closure. + - Retention: `[TO COMPLETE]` +- [ ] Document support messages and their retention. +- [ ] Document billing and tax records if payment is introduced. + - Current status: `[FREE BETA / PAID / NOT DECIDED]` +- [ ] Select and review the legal basis for account, support, billing, and + security processing. + - Status: `NEEDS LEGAL DECISION` + +## Step 5: Inventory hosted RUM telemetry + +The WordPress plugin audit establishes that the browser may transmit the +following categories. Confirm what the hosted collector receives, stores, +indexes, aggregates, and deletes. See `docs/audits/evidence.md` for the runtime +evidence. + +- [ ] Page, navigation, referrer, and resource URLs. +- [ ] Complete query strings when customer-side redaction is disabled. +- [ ] Timing data, page types, Core Web Vitals, and resource measurements. +- [ ] Interaction counts and timestamps. +- [ ] Pointer coordinates and interacted-element CSS selectors where present. +- [ ] Screen, browser, device, CPU, memory, network, DOM, and browser-storage + size information. +- [ ] Brum Site ID. +- [ ] Random `RT` session identifier linking page views. +- [ ] IP address and user agent observed by the HTTP collector. +- [ ] Confirm that keystroke values and browser-storage contents are not + collected. +- [ ] Confirm that battery data and high-entropy client hints are not + collected by the current WordPress integration. +- [ ] Document any additional backend-derived fields, geolocation, user agent + parsing, fingerprinting, enrichment, or identifiers. + - Additional fields: `[TO COMPLETE]` +- [ ] Determine which fields are necessary for the documented RUM purpose and + disable unnecessary collection. + - Status: `NEEDS LEGAL DECISION` + +## Step 6: Define customer and Basicrum roles + +- [ ] Confirm whether the customer determines the purpose of monitoring its + visitors and Basicrum processes the telemetry only on the customer's + instructions. +- [ ] If yes, document the customer as controller and Basicrum as processor for + hosted RUM telemetry. +- [ ] Prepare an Article 28 Data Processing Agreement for hosted customers. +- [ ] List every permitted processing instruction and Basicrum's security, + deletion, assistance, audit, and subprocessor commitments. +- [ ] Determine whether Basicrum uses customer telemetry for its own product + analytics, research, model training, benchmarking, or unrelated purposes. + - Answer: `[TO COMPLETE]` +- [ ] If Basicrum determines any additional purpose, reassess whether it is a + controller for that processing. + - Status: `NEEDS LEGAL DECISION` + +## Step 7: Document the `RT` cookie and consent + +- [ ] Disclose that monitored customer sites may set a first-party `RT` + cookie. +- [ ] Confirm the audited attributes: path `/`, `SameSite=Strict`, Secure only + on HTTPS, rolling seven-day expiry, and a 30-minute session window. +- [ ] Explain that the cookie contains a random session identifier linking + monitored page views. +- [ ] Explain that opt-out removes `RT` and any legacy `BA` cookie. +- [ ] State that Basicrum's WordPress plugin supports: + - Monitoring without waiting for consent. + - Requiring an external consent decision before monitoring. +- [ ] State that the website operator, not the plugin, selects the legal basis + and configures consent where required. +- [ ] Assess the ePrivacy classification of the `RT` cookie and the conditions + for setting it without prior consent. + - Status: `NEEDS LEGAL DECISION` +- [ ] Document that withdrawing consent stops future collection but cannot + retract beacons already sent. + +## Step 8: Set retention and deletion rules + +Do not use only "as long as necessary." Record a period or objective criterion +for every category. + +- [ ] Website request logs: `[PERIOD]` +- [ ] Contact messages: `[PERIOD]` +- [ ] Marketing subscriptions: `[UNTIL WITHDRAWAL PLUS SUPPRESSION RECORD]` +- [ ] Rejected beta requests: `[PERIOD]` +- [ ] Customer account data: `[PERIOD AFTER CLOSURE]` +- [ ] Raw RUM beacons: `[PERIOD]` +- [ ] Aggregated RUM metrics: `[PERIOD]` +- [ ] Collector IP/request logs: `[PERIOD]` +- [ ] Support history: `[PERIOD]` +- [ ] Backups: `[ROTATION AND FINAL DELETION PERIOD]` +- [ ] Security and abuse records: `[PERIOD]` +- [ ] Define the customer-initiated deletion procedure. +- [ ] Define how an individual visitor can be identified for access or + deletion, or document why identification is not technically possible. +- [ ] Ensure deletion propagates to indexes, replicas, exports, and backups + according to the stated schedule. + +## Step 9: Record vendors, recipients, and transfers + +Maintain the detailed register privately. Publish enough information for users +to understand where their data goes. + +- [ ] Hosting and infrastructure providers. +- [ ] CDN, DNS, and security providers. +- [ ] Email and newsletter providers. +- [ ] Identity and authentication providers. +- [ ] Support and communication providers. +- [ ] Monitoring and error-reporting providers. +- [ ] Backup providers. +- [ ] Payment providers, if applicable. +- [ ] AI providers, if applicable. +- [ ] Record each provider's legal entity, purpose, processing country, data + categories, retention, contract, and subprocessor status. +- [ ] Identify transfers outside the EU/EEA. +- [ ] Document adequacy decisions, Standard Contractual Clauses, supplementary + measures, or another transfer mechanism where required. + - Status: `NEEDS LEGAL DECISION` + +## Step 10: Describe AI processing accurately + +- [ ] Confirm whether AI features are currently active. +- [ ] Confirm whether an AI request is automatic or initiated by the customer. +- [ ] List exactly what is sent: raw beacons, URLs, selectors, aggregated + metrics, or prepared summaries. +- [ ] Confirm whether the customer or Basicrum supplies the provider API key. +- [ ] Name supported providers and processing locations. +- [ ] Confirm provider retention and whether submitted data may be used for + model training. +- [ ] Document how sensitive URL or selector data is removed before an AI + request. +- [ ] Remove or qualify any public "No PII" or similar absolute claim that + cannot be demonstrated for every processing path. + +## Step 11: Prepare individual-rights procedures + +- [ ] Publish the privacy-request contact email. +- [ ] Create an internal process for access, correction, deletion, + restriction, portability, objection, and consent withdrawal requests. +- [ ] Define how identity is verified without collecting excessive additional + data. +- [ ] Define who responds and how the one-month GDPR deadline is tracked. +- [ ] Explain when a customer must handle a monitored visitor's request and + how Basicrum assists as processor. +- [ ] Name the competent supervisory authority and explain the right to lodge + a complaint. +- [ ] Record whether automated decision-making or profiling with legal or + similarly significant effects occurs. + - Expected answer: `[YES / NO / UNKNOWN]` + +## Step 12: Prepare security and governance records + +- [ ] Document access controls and administrator roles. +- [ ] Document encryption in transit and at rest. +- [ ] Document secrets management, backups, patching, and vulnerability + handling. +- [ ] Create a personal-data breach response process. +- [ ] Maintain a record of processing activities where required or useful. +- [ ] Assess whether a Data Protection Impact Assessment is required. + - Status: `NEEDS LEGAL DECISION` +- [ ] Assess whether a Data Protection Officer is required. Do not appoint or + claim one without a valid basis. + - Status: `NEEDS LEGAL DECISION` + +## Step 13: Draft the public Privacy Policy + +- [ ] Title and effective date. +- [ ] Controller identity and contact details. +- [ ] Scope and definitions. +- [ ] Public website and server logs. +- [ ] Contact and private-beta requests. +- [ ] Customer accounts and support. +- [ ] Hosted RUM telemetry and customer/processor roles. +- [ ] Cookies, consent, and withdrawal limits. +- [ ] AI functionality. +- [ ] Purposes and legal bases by processing activity. +- [ ] Recipients and subprocessors. +- [ ] International transfers and safeguards. +- [ ] Retention and deletion by data category. +- [ ] Required and optional information and consequences of not providing it. +- [ ] Individual rights and complaint authority. +- [ ] Automated decision-making statement. +- [ ] Security summary. +- [ ] Policy-change process. +- [ ] Use clear, plain language and a layered structure. +- [ ] Ensure the policy describes actual behavior rather than aspirations. + +## Step 14: Prepare the related legal surfaces + +- [ ] Publish a separate German `Impressum` or Legal Notice containing the + actual provider name, serviceable address, and direct electronic contact. +- [ ] Do not claim a company form, register entry, or registration number that + does not exist. +- [ ] Confirm whether operating jointly has already created a German civil-law + partnership (`GbR`). + - Status: `NEEDS LEGAL DECISION` +- [ ] Prepare hosted-service Terms of Service. +- [ ] Prepare the hosted-service Data Processing Agreement. +- [ ] Prepare a current subprocessor list. +- [ ] Ensure contracts, policy, product behavior, and marketing claims agree. + +## Step 15: Review and publish + +- [ ] Have the controller-role, legal-basis, ePrivacy, transfer, retention, + and German business-status decisions reviewed by qualified counsel. +- [ ] Compare the final policy against a captured website request, signup flow, + account flow, representative RUM beacon, cookie inventory, AI request, and + deletion test. +- [ ] Remove or correct conflicting marketing claims on `basicrum.com`. +- [ ] Link `Privacy Policy`, `Terms`, and `Impressum` from every website page. +- [ ] Link the hosted-service Privacy Policy and Terms from the WordPress.org + plugin `readme.txt` External services section. +- [ ] Add the links near beta signup and account creation. +- [ ] Record the publication date and next review date. +- [ ] Review the policy whenever data fields, purposes, vendors, retention, + countries, cookies, AI providers, or consent behavior change. + +## Definition of done + +- [ ] Every processing activity has a named purpose, data category, recipient, + legal basis, retention rule, deletion path, and public disclosure. +- [ ] Controller and processor roles match contracts and actual decisions. +- [ ] Cookie and consent statements match tested runtime behavior. +- [ ] No absolute compliance or "no personal data" claim contradicts the + observed data flow. +- [ ] Privacy Policy, Terms, Impressum, DPA, and subprocessor information are + mutually consistent. +- [ ] The final policy has been reviewed for the jurisdictions and service + model actually used. + +## Primary references + +Accessed 2026-07-21: + +- [GDPR Articles 12-14, 26, and 28](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679) +- [ePrivacy Directive Article 5(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32002L0058) +- [EDPB guidance for small businesses](https://www.edpb.europa.eu/sme/be-compliant/respect-individuals-rights_en) +- [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en) +- [German Digital Services Act, Section 5](https://www.gesetze-im-internet.de/ddg/__5.html) +- [German Civil Code, Section 705](https://www.gesetze-im-internet.de/bgb/__705.html) +- [WordPress Plugin Directory external-service guidance](https://developer.wordpress.org/plugins/wordpress-org/common-issues/) diff --git a/plugins/basicrum/.distignore b/plugins/basicrum/.distignore index 1b090d4..866f129 100644 --- a/plugins/basicrum/.distignore +++ b/plugins/basicrum/.distignore @@ -4,6 +4,7 @@ /.vscode /tests /vendor/bin +/vendor/composer/installers /vendor/**/.github /.distignore diff --git a/plugins/basicrum/LICENSE.md b/plugins/basicrum/LICENSE.md index 55435ea..1757540 100644 --- a/plugins/basicrum/LICENSE.md +++ b/plugins/basicrum/LICENSE.md @@ -1,21 +1,357 @@ -MIT License - -Copyright (c) 2026 Tsvetan Stoychev - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. +Basicrum - Real User Monitoring for WordPress +Copyright (C) 2026 Tsvetan Stoychev and the Basicrum contributors + +This program is free software; you can redistribute it and/or modify it under +the terms of the GNU General Public License as published by the Free Software +Foundation; either version 2 of the License, or (at your option) any later +version. + +This program is distributed in the hope that it will be useful, but WITHOUT ANY +WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A +PARTICULAR PURPOSE. See the GNU General Public License for more details. + +You should have received a copy of the GNU General Public License along with +this program; if not, write to the Free Software Foundation, Inc., 51 Franklin +Street, Fifth Floor, Boston, MA 02110-1301 USA. + +Bundled third-party software keeps its own license. See +THIRD-PARTY-NOTICES.txt. + + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc., + + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Lesser General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License along + with this program; if not, see . + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) year name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + , 1 April 1989 + Moe Ghoul, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. diff --git a/plugins/basicrum/THIRD-PARTY-NOTICES.txt b/plugins/basicrum/THIRD-PARTY-NOTICES.txt index 9868697..3425b03 100644 --- a/plugins/basicrum/THIRD-PARTY-NOTICES.txt +++ b/plugins/basicrum/THIRD-PARTY-NOTICES.txt @@ -1,6 +1,6 @@ # Third-Party Notices -Basicrum-owned code is licensed under the MIT License in `LICENSE.md`. The plugin also distributes the following third-party software under its own license. +Basicrum-owned code is licensed under the GNU General Public License version 2 or later in `LICENSE.md`. The plugin also distributes the following third-party software under its own license. ## Boomerang 1.815.60 @@ -13,4 +13,4 @@ Basicrum-owned code is licensed under the MIT License in `LICENSE.md`. The plugi - Version banner note: the banner inside the bundled file stamps the parent commit `564759ed70de7801bb64de5e2025fb6ac049ff5f` because the final source change was uncommitted when the shipped file was generated; the code content matches `ead2783a` exactly - Fork changes vs upstream: maintained commits that remove Long Tasks monitoring, remove the deprecated FID metric and rework Time to First Interaction, drop unused utility functions, and add the Basicrum configuration bootstrap -The Boomerang copyright notice and license remain applicable to the bundled Boomerang file. Basicrum does not relicense that file under the Basicrum MIT License. +The Boomerang copyright notice and license remain applicable to the bundled Boomerang file. Basicrum does not relicense that file under the Basicrum GNU General Public License. diff --git a/plugins/basicrum/basicrum.php b/plugins/basicrum/basicrum.php index 351ece0..47eef80 100644 --- a/plugins/basicrum/basicrum.php +++ b/plugins/basicrum/basicrum.php @@ -6,8 +6,8 @@ * Version: 0.0.8 * Author: Tsvetan Stoychev * Author URI: https://www.basicrum.com/contact/ - * License: MIT - * License URI: https://opensource.org/licenses/MIT + * License: GPLv2 or later + * License URI: https://www.gnu.org/licenses/gpl-2.0.html * Text Domain: basicrum * Domain Path: /languages * Requires at least: 6.0 diff --git a/plugins/basicrum/composer.json b/plugins/basicrum/composer.json index e830287..603e0cc 100644 --- a/plugins/basicrum/composer.json +++ b/plugins/basicrum/composer.json @@ -2,7 +2,7 @@ "name": "basicrum/basicrum-wordpress", "description": "Basicrum - Open Source Real User Monitoring for WordPress", "type": "wordpress-plugin", - "license": "MIT", + "license": "GPL-2.0-or-later", "authors": [ { "name": "Tsvetan Stoychev", diff --git a/plugins/basicrum/composer.lock b/plugins/basicrum/composer.lock index 8078807..4e6a417 100644 --- a/plugins/basicrum/composer.lock +++ b/plugins/basicrum/composer.lock @@ -1135,21 +1135,21 @@ }, { "name": "phpcsstandards/phpcsextra", - "version": "1.5.0", + "version": "1.5.1", "source": { "type": "git", "url": "https://github.com/PHPCSStandards/PHPCSExtra.git", - "reference": "b598aa890815b8df16363271b659d73280129101" + "reference": "39467533fdb742446d68c1d10ac33d625ee0311c" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/PHPCSStandards/PHPCSExtra/zipball/b598aa890815b8df16363271b659d73280129101", - "reference": "b598aa890815b8df16363271b659d73280129101", + "url": "https://api.github.com/repos/PHPCSStandards/PHPCSExtra/zipball/39467533fdb742446d68c1d10ac33d625ee0311c", + "reference": "39467533fdb742446d68c1d10ac33d625ee0311c", "shasum": "" }, "require": { "php": ">=5.4", - "phpcsstandards/phpcsutils": "^1.2.0", + "phpcsstandards/phpcsutils": "^1.2.3", "squizlabs/php_codesniffer": "^3.13.5 || ^4.0.1" }, "require-dev": { @@ -1213,20 +1213,20 @@ "type": "thanks_dev" } ], - "time": "2025-11-12T23:06:57+00:00" + "time": "2026-07-27T11:13:17+00:00" }, { "name": "phpcsstandards/phpcsutils", - "version": "1.2.2", + "version": "1.2.3", "source": { "type": "git", "url": "https://github.com/PHPCSStandards/PHPCSUtils.git", - "reference": "c216317e96c8b3f5932808f9b0f1f7a14e3bbf55" + "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/c216317e96c8b3f5932808f9b0f1f7a14e3bbf55", - "reference": "c216317e96c8b3f5932808f9b0f1f7a14e3bbf55", + "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/5f35d9408c54d7b529501f3c688b6eae562aea1f", + "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f", "shasum": "" }, "require": { @@ -1306,7 +1306,7 @@ "type": "thanks_dev" } ], - "time": "2025-12-08T14:27:58+00:00" + "time": "2026-07-27T10:28:41+00:00" }, { "name": "phpstan/phpstan", @@ -2799,16 +2799,16 @@ }, { "name": "squizlabs/php_codesniffer", - "version": "3.13.5", + "version": "3.13.6", "source": { "type": "git", "url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git", - "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4" + "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/0ca86845ce43291e8f5692c7356fccf3bcf02bf4", - "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4", + "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/4c378e1a528ea066890fc2397cbdd2f94eb2fc91", + "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91", "shasum": "" }, "require": { @@ -2874,7 +2874,7 @@ "type": "thanks_dev" } ], - "time": "2025-11-04T16:30:35+00:00" + "time": "2026-08-06T00:17:32+00:00" }, { "name": "szepeviktor/phpstan-wordpress", @@ -2991,16 +2991,16 @@ }, { "name": "wp-coding-standards/wpcs", - "version": "3.4.0", + "version": "3.4.1", "source": { "type": "git", "url": "https://github.com/WordPress/WordPress-Coding-Standards.git", - "reference": "469c18ceab4d642b15bad4c65ebf3b307bfd55ab" + "reference": "ec2ff942335f33683a5957a85d138753876a05cf" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/WordPress/WordPress-Coding-Standards/zipball/469c18ceab4d642b15bad4c65ebf3b307bfd55ab", - "reference": "469c18ceab4d642b15bad4c65ebf3b307bfd55ab", + "url": "https://api.github.com/repos/WordPress/WordPress-Coding-Standards/zipball/ec2ff942335f33683a5957a85d138753876a05cf", + "reference": "ec2ff942335f33683a5957a85d138753876a05cf", "shasum": "" }, "require": { @@ -3009,8 +3009,8 @@ "ext-tokenizer": "*", "ext-xmlreader": "*", "php": ">=7.2", - "phpcsstandards/phpcsextra": "^1.5.0", - "phpcsstandards/phpcsutils": "^1.2.2", + "phpcsstandards/phpcsextra": "^1.5.1", + "phpcsstandards/phpcsutils": "^1.2.3", "squizlabs/php_codesniffer": "^3.13.5" }, "require-dev": { @@ -3053,7 +3053,7 @@ "type": "custom" } ], - "time": "2026-07-16T13:05:29+00:00" + "time": "2026-07-27T11:53:23+00:00" }, { "name": "yoast/phpunit-polyfills", diff --git a/plugins/basicrum/languages/basicrum.pot b/plugins/basicrum/languages/basicrum.pot index 9f04d57..0731cc6 100644 --- a/plugins/basicrum/languages/basicrum.pot +++ b/plugins/basicrum/languages/basicrum.pot @@ -1,5 +1,5 @@ # Copyright (C) 2026 Tsvetan Stoychev -# This file is distributed under the MIT. +# This file is distributed under the GPLv2 or later. msgid "" msgstr "" "Project-Id-Version: Basicrum - Real User Monitoring 0.0.8\n" @@ -79,7 +79,7 @@ msgid "Monitoring is configured to follow the site's consent tool on every page. msgstr "" #: src/Admin/Privacy.php:71 -msgid "Monitoring is configured to start immediately on eligible pages without waiting for a consent signal." +msgid "Monitoring is configured to start immediately on frontend pages, without waiting for a consent signal. Logged-in administrators are excluded unless Track Admin Users is enabled." msgstr "" #: src/Admin/Settings/Page.php:115 diff --git a/plugins/basicrum/readme.txt b/plugins/basicrum/readme.txt index 0c6ed54..c57ec5a 100644 --- a/plugins/basicrum/readme.txt +++ b/plugins/basicrum/readme.txt @@ -2,11 +2,11 @@ Contributors: basicrum, rawbird Tags: analytics, performance, rum, real-user-monitoring, web-vitals Requires at least: 6.0 -Tested up to: 7.0 +Tested up to: 7.1 Requires PHP: 7.4 Stable tag: 0.0.8 -License: MIT -License URI: https://opensource.org/licenses/MIT +License: GPLv2 or later +License URI: https://www.gnu.org/licenses/gpl-2.0.html Privacy-first Real User Monitoring with consent-controlled loading, page types, and Web Vitals. @@ -98,11 +98,13 @@ Beacons may include page, navigation, referrer, and resource URLs; query strings Beacons go only to the configured endpoint. The plugin does not contact basicrum.com unless the administrator configures a hosted Basicrum collector URL. Basicrum does not store visitor beacon data in the WordPress database. -The collector may be hosted or self-hosted. Its operator determines retention, access, deletion, hosting, and transfer arrangements. Review the applicable service and privacy information before enabling monitoring. See [basicrum.com](https://www.basicrum.com/) for the Basicrum platform. +The collector may be hosted or self-hosted. Its operator determines retention, access, deletion, hosting, and transfer arrangements, and publishes the terms and privacy notice that apply. Review them before enabling monitoring. + +For the Basicrum hosted option, see the [Basicrum platform](https://www.basicrum.com/) and the [Basicrum Privacy Notice](https://www.basicrum.com/privacy/), which covers the basicrum.com website, contact messages, and beta access requests. Ask [Basicrum](https://www.basicrum.com/contact/) for the hosted collector's service terms and privacy notice before you point the plugin at a hosted collector. == Third-party software == -Basicrum-owned code uses the MIT License. The bundled Boomerang 1.815.60 library comes from the [official Akamai Boomerang project](https://github.com/akamai/boomerang) and retains its BSD license. Basicrum's build comes from [Basicrum's Boomerang fork at commit ead2783a](https://github.com/basicrum/boomerang/tree/ead2783a33a2ce91205fe34f8fc992433faba9a2); the bundle banner identifies parent commit `564759ed70de7801bb64de5e2025fb6ac049ff5f`. License, fork-change, and reproducible-build details are in [THIRD-PARTY-NOTICES.txt](https://github.com/basicrum/basicrum-wordpress/blob/main/plugins/basicrum/THIRD-PARTY-NOTICES.txt). +Basicrum-owned code uses the GNU General Public License version 2 or later. The bundled Boomerang 1.815.60 library comes from the [official Akamai Boomerang project](https://github.com/akamai/boomerang) and retains its BSD license. Basicrum's build comes from [Basicrum's Boomerang fork at commit ead2783a](https://github.com/basicrum/boomerang/tree/ead2783a33a2ce91205fe34f8fc992433faba9a2); the bundle banner identifies parent commit `564759ed70de7801bb64de5e2025fb6ac049ff5f`. License, fork-change, and reproducible-build details are in [THIRD-PARTY-NOTICES.txt](https://github.com/basicrum/basicrum-wordpress/blob/main/plugins/basicrum/THIRD-PARTY-NOTICES.txt). == Support == diff --git a/plugins/basicrum/src/Admin/Privacy.php b/plugins/basicrum/src/Admin/Privacy.php index 72bf53f..d4fa8b6 100644 --- a/plugins/basicrum/src/Admin/Privacy.php +++ b/plugins/basicrum/src/Admin/Privacy.php @@ -68,7 +68,7 @@ public function add_policy_content() { if ( $is_configured && '1' === $settings['consent_enabled'] ) { $content .= esc_html__( 'Monitoring is configured to follow the site\'s consent tool on every page. Basicrum does not persist consent across page loads or in its own cookie or server-side record. The consent tool may report monitoring as allowed before visitor interaction where an opt-out policy applies. Signaling denial, expiry, or withdrawal stops future browser collection but does not retract data already sent.', 'basicrum' ); } elseif ( $is_configured ) { - $content .= esc_html__( 'Monitoring is configured to start immediately on eligible pages without waiting for a consent signal.', 'basicrum' ); + $content .= esc_html__( 'Monitoring is configured to start immediately on frontend pages, without waiting for a consent signal. Logged-in administrators are excluded unless Track Admin Users is enabled.', 'basicrum' ); } if ( $is_configured ) { $content .= '

'; diff --git a/plugins/basicrum/tests/unit/PrivacyTest.php b/plugins/basicrum/tests/unit/PrivacyTest.php index 6cdc66e..cbd7718 100644 --- a/plugins/basicrum/tests/unit/PrivacyTest.php +++ b/plugins/basicrum/tests/unit/PrivacyTest.php @@ -130,7 +130,8 @@ function( $policy_title, $policy_content ) use ( &$content ) { $privacy = new Privacy(); $privacy->add_policy_content(); - $this->assertStringContainsString( 'start immediately on eligible pages', $content ); + $this->assertStringContainsString( 'start immediately on frontend pages', $content ); + $this->assertStringContainsString( 'Logged-in administrators are excluded unless Track Admin Users is enabled', $content ); $this->assertStringContainsString( 'collector configured at', $content ); } diff --git a/tools/build-release.sh b/tools/build-release.sh index 8a15184..93d63f9 100755 --- a/tools/build-release.sh +++ b/tools/build-release.sh @@ -51,6 +51,23 @@ rsync -rc \ --classmap-authoritative ) +# composer/installers only places this package when a Composer project installs +# it as a dependency. It has no role inside an installed plugin, so remove it +# from the staged tree so that the shipped vendor directory, class map, and +# Composer metadata all agree, then restore the manifest the repository ships. +( + cd "$BUILD_DIR" + composer remove composer/installers \ + --no-interaction \ + --no-progress \ + --no-plugins \ + --no-scripts \ + --update-no-dev \ + --classmap-authoritative +) + +cp "$PLUGIN_DIR/composer.json" "$BUILD_DIR/composer.json" + rsync -rc \ --delete \ --delete-excluded \ diff --git a/tools/verify-release.sh b/tools/verify-release.sh index 6082a3d..9af66ca 100755 --- a/tools/verify-release.sh +++ b/tools/verify-release.sh @@ -93,6 +93,16 @@ if printf '%s\n' "$ARCHIVE_ENTRIES" | grep -Eq '^basicrum/vendor/.*/\.github(/|$ exit 1 fi +if printf '%s\n' "$ARCHIVE_ENTRIES" | grep -Eq '^basicrum/vendor/composer/installers(/|$)'; then + printf '%s\n' 'Release archive contains the Composer installer plugin.' >&2 + exit 1 +fi + +if unzip -p "$ARCHIVE_PATH" basicrum/vendor/composer/autoload_classmap.php | grep -Fq 'Composer\\Installers'; then + printf '%s\n' 'Composer class map references the removed Composer installer plugin.' >&2 + exit 1 +fi + if ! unzip -p "$ARCHIVE_PATH" basicrum/vendor/composer/autoload_classmap.php | grep -Fq "'Basicrum\\\\WP\\\\Plugin'"; then printf '%s\n' 'Composer class map does not contain the Basicrum plugin classes.' >&2 exit 1