pipewatch-cli 0.3.0__tar.gz → 0.4.0__tar.gz

{pipewatch_cli-0.3.0 → pipewatch_cli-0.4.0}/LICENSE

@@ -1,4 +1,3 @@
-Copyright (c) 2026 David Obi
 
 pipewatch-cli is licensed under the Creative Commons Attribution 4.0
 International License. To view a copy of this license, see below or

pipewatch_cli-0.4.0/PKG-INFO

@@ -0,0 +1,228 @@
+Metadata-Version: 2.4
+Name: pipewatch-cli
+Version: 0.4.0
+Summary: Integrity monitoring and static analysis for CI/CD pipelines
+License-Expression: CC-BY-4.0
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pyyaml>=6.0
+Dynamic: license-file
+
+# pipewatch
+
+**Integrity monitoring and static analysis for software supply chains.**
+
+CI/CD pipelines are high-value targets: they run with elevated permissions, pull from external registries, and execute arbitrary code on every commit. A single injected step, mutable action pin, or misconfigured trigger is enough to exfiltrate secrets, backdoor build artifacts, or pivot into production infrastructure — and the attack surface is almost always left unmonitored.
+
+pipewatch audits GitHub Actions workflows, GitLab CI, and Jenkinsfiles for exactly these risks. It combines commit-anchored baseline diffing, per-step SHA-256 fingerprinting, static misconfiguration analysis, and runner environment tracking into a single CLI tool. All commands exit non-zero on findings and emit structured JSON — suitable as a pipeline gate, a pre-merge check, or a periodic audit job.
+
+What It Detects
+Check	What it catches
+Baseline diff	Pipeline files modified, added, or deleted since a known-good commit
+Step fingerprinting	Individual steps injected, removed, or silently modified between commits
+pull_request_target misuse	Workflows that check out and execute PR head code with base-branch write permissions — the pattern behind numerous CI poisoning attacks
+Script injection	run: blocks and env: blocks that route user-controlled context values (github.event.pull_request.title, github.event.comment.body, etc.) into shell commands — both direct interpolation and the indirect env: VAR: ${{ ctx }} → $VAR pattern are detected
+Permission misconfiguration	Missing permissions: blocks, write-all scopes, secrets: inherit
+Mutable action pins	uses: references not locked to a full commit SHA — tags like v3 can be silently overwritten by a supply-chain attacker
+Invalid pinned SHAs	Pinned SHAs that do not exist in the upstream action repo (typos, deleted commits, fork SHAs)
+Unsafe workflow_run chains	Write-permissioned workflows triggered indirectly by external pull requests or issues, creating a privilege escalation path
+Self-hosted runners	Non-ephemeral runners that persist state between runs and are not managed by GitHub
+Runner environment drift	Env var and tool version changes between CI runs that could indicate a compromised or modified runner
+
+Findings are severity-ranked (CRITICAL → HIGH → MEDIUM → LOW → INFO) and always include a location, description, and evidence field.
+
+Installation
+
+Requires Python 3.12+. pyyaml is the only external dependency.
+
+Via pip (recommended):
+
+bash
+pip install pipewatch-cli
+
+Directly from GitHub (no clone required):
+
+bash
+pip install git+https://github.com/TheVoidThatConsumes/pipewatch.git
+
+Copy into your project — if you prefer to keep pipewatch self-contained inside a repo you're monitoring, download pipewatch.py and drop it anywhere in that repo. Install pyyaml manually:
+
+bash
+pip install pyyaml
+
+Then run it as py pipewatch.py <command> instead of pipewatch <command>.
+
+Quick Start
+bash
+# Record the current HEAD as known-good
+pipewatch baseline
+
+# Scan for changes and misconfigurations
+pipewatch scan
+
+# Full audit in one pass (scan + pin-audit + static)
+pipewatch audit --verify-shas
+Commands
+baseline
+
+Records the current (or a specified) commit as the integrity reference point. Set PIPEWATCH_HMAC_KEY to store a signed baseline — if the file is modified to suppress future findings, the HMAC check will fail and the tool will refuse to proceed.
+
+bash
+pipewatch baseline [--repo PATH] [--commit SHA]
+scan
+
+Diffs pipeline files and per-step fingerprints against the baseline commit. Detects both file-level changes (unified diff) and step-level tampering — a step whose uses, run, with, env, or shell fields change gets flagged even if the surrounding file diff looks innocuous.
+
+bash
+pipewatch scan [--repo PATH] [--baseline SHA] [--verbose] [--json]
+
+Covers GitHub Actions, GitLab CI, and Jenkinsfile stages.
+
+static
+
+Static analysis with no baseline required. Audits all GitHub Actions workflow files in .github/workflows/ for structural misconfigurations.
+
+bash
+pipewatch static [--repo PATH] [--verbose] [--json]
+
+Checks: pull_request_target misuse · script injection · missing/overpermissioned permissions: blocks · secrets: inherit · self-hosted runners · unsafe workflow_run trigger chains.
+
+pin-audit
+
+Flags uses: references not pinned to a full 40- or 64-character commit SHA. With --verify-shas, makes live GitHub API calls to confirm each pinned SHA actually exists in its upstream repository.
+
+bash
+pipewatch pin-audit [--repo PATH] [--verify-shas] [--token TOKEN] [--verbose] [--json]
+
+Rate limit: 60 requests/hr unauthenticated, 5 000/hr with --token or GITHUB_TOKEN. API calls are deduplicated — the same owner/repo@sha is only verified once regardless of how many steps reference it. Findings are not deduplicated: if the same invalid SHA appears across multiple workflow files or jobs, each affected step produces its own finding so the full scope of a compromised action is visible in the report.
+
+snapshot
+
+Captures the runner environment — environment variables and tool versions — to a JSON file for later comparison.
+
+bash
+pipewatch snapshot [--output FILE]
+
+Tracked tools: python3, python, node, npm, pip, pip3, git, curl, wget, docker, kubectl, terraform, aws, gcloud, az. Volatile per-run variables (GITHUB_RUN_ID, RUNNER_TEMP, etc.) are excluded to prevent noise on every comparison.
+
+Credential exclusion — environment variables whose names contain token, secret, key, password, passwd, pwd, auth, credential, private, or api_key (case-insensitive) are never written to the snapshot file. This prevents secrets such as GITHUB_TOKEN or PIPEWATCH_HMAC_KEY from being persisted to disk or uploaded to the Actions cache. Note that a legitimately non-sensitive variable with one of these terms in its name will also be excluded; rename it if you need env-diff to track it.
+
+Add the snapshot file to .gitignore to prevent it from being accidentally committed:
+
+.pipewatch_env_snapshot.json
+env-diff
+
+Diffs two runner environment snapshots. Detects new, removed, or changed environment variables and tool versions — useful for identifying runner poisoning or unexpected environment mutations between runs. If --current-snapshot is omitted, captures the live environment.
+
+bash
+pipewatch env-diff BASELINE_SNAPSHOT [--current-snapshot FILE] [--repo PATH] [--verbose] [--json]
+audit
+
+Full audit in one pass: scan + pin-audit + static. Exits non-zero if any findings exist.
+
+bash
+pipewatch audit [--repo PATH] [--baseline SHA] [--verify-shas] [--token TOKEN] [--verbose] [--json]
+init-runner
+
+Prints a ready-to-paste GitHub Actions step block that adds runner environment monitoring to any existing job.
+
+bash
+pipewatch init-runner [--snapshot-path PATH]
+Finding IDs
+Prefix	Category	Default Severity
+PW-DIFF-NNN	Pipeline file added / modified / deleted	HIGH / MEDIUM
+PW-STEP-NNN	Step fingerprint changed / injected / removed	HIGH / MEDIUM
+PW-PRT-NNN	pull_request_target misuse	HIGH
+PW-INJ-NNN	Script injection risk	HIGH
+PW-PERM-NNN	Permission misconfiguration	HIGH / MEDIUM
+PW-CHAIN-NNN	Unsafe workflow_run chain	HIGH
+PW-PIN-NNN	Unpinned action reference	MEDIUM
+PW-SHA-NNN	Pinned SHA not found in upstream repo	HIGH
+PW-RUNNER-NNN	Self-hosted runner	INFO
+PW-ENV-NNN	Runner environment drift	MEDIUM / LOW
+JSON Output
+
+All commands accept --json:
+
+json
+{
+  "tool": "pipewatch",
+  "version": "0.2.0",
+  "timestamp": "2025-01-01T00:00:00+00:00",
+  "repo": "/path/to/repo",
+  "baseline_commit": "abc123...",
+  "findings": [
+    {
+      "id": "PW-INJ-001",
+      "severity": "HIGH",
+      "category": "script_injection",
+      "title": "Script injection risk: .github/workflows/ci.yml::build::step[2]",
+      "description": "A run: block interpolates a user-controlled context value...",
+      "location": ".github/workflows/ci.yml::build::step[2]",
+      "evidence": "dangerous expressions found: ['github.event.pull_request.title']"
+    }
+  ],
+  "summary": { "total": 1, "CRITICAL": 0, "HIGH": 1, "MEDIUM": 0, "LOW": 0, "INFO": 0 }
+}
+
+Gate on exit code, or filter with jq:
+
+bash
+# fail the build on any HIGH or CRITICAL finding
+pipewatch audit --json | jq -e '.summary.HIGH == 0 and .summary.CRITICAL == 0'
+
+# list all finding titles
+pipewatch audit --json | jq -r '.findings[].title'
+Tamper-Evident Baselines
+
+Set PIPEWATCH_HMAC_KEY before running baseline. The baseline is stored as a signed JSON object:
+
+json
+{
+  "commit": "abc123...",
+  "timestamp": "2025-01-01T00:00:00+00:00",
+  "hmac": "<sha256-hmac-of-commit-and-timestamp>"
+}
+
+The HMAC is computed over both the commit SHA and the timestamp, bound together. This protects against two distinct attacks:
+
+Tampering — an attacker who modifies the commit field to point to an older known-good commit cannot produce a valid HMAC without the key.
+Replay — an attacker who reverts the baseline file to a previously-valid signed snapshot (to suppress findings introduced after that point) is also blocked, because the timestamp is part of the signed payload and the stored timestamp would no longer match the signature of any rewritten content.
+
+On scan or audit, the HMAC is verified before the baseline commit is trusted. Any verification failure causes an immediate exit with an error.
+
+Format-downgrade protection — if PIPEWATCH_HMAC_KEY is set and the baseline file is in plain-text format (a raw commit SHA rather than signed JSON), the tool refuses to proceed. An attacker cannot bypass signing by overwriting the file with an unsigned commit SHA. If you set PIPEWATCH_HMAC_KEY for the first time on a repo that already has an unsigned baseline, re-run pipewatch baseline to generate a signed one before your next scan.
+
+Store the key in a CI secret (PIPEWATCH_HMAC_KEY: ${{ secrets.PIPEWATCH_HMAC_KEY }}).
+
+Pipeline Integration
+yaml
+- name: pipewatch audit
+  env:
+    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    PIPEWATCH_HMAC_KEY: ${{ secrets.PIPEWATCH_HMAC_KEY }}
+  run: |
+    pipewatch audit --verify-shas --json | tee pw-report.json
+    jq -e '.summary.HIGH == 0 and .summary.CRITICAL == 0' pw-report.json
+
+Use init-runner to add runner environment monitoring alongside the audit step.
+
+Design Decisions
+
+HMAC-signed baselines — tamper-evident storage for the known-good commit reference. The HMAC covers both the commit SHA and the timestamp, so an attacker who can write to the repo but wants to suppress findings would need to forge the HMAC — not just overwrite the file or revert it to an older signed state. Attempting to downgrade a signed baseline to unsigned plain text is also refused when PIPEWATCH_HMAC_KEY is set.
+
+Volatile variable exclusion — snapshot strips run-specific GitHub variables so that env-diff doesn't generate noise on every comparison. Only structurally stable variables that could indicate environment manipulation are tracked. Variables whose names suggest credentials (containing token, secret, key, password, etc.) are also excluded so secrets are never written to the snapshot file or the Actions cache.
+
+Conservative SHA verification — --verify-shas treats network failures as non-findings. A flaky connection or GitHub API outage should not produce spurious HIGH alerts.
+
+Stdlib-first — pyyaml is the only dependency. The tool audits supply-chain risk; its own footprint is minimal by design.
+
+Platform Support
+Platform	Coverage
+GitHub Actions (.github/workflows/*.yml)	Full — file diff, step fingerprinting, static analysis, pin audit
+GitLab CI (.gitlab-ci.yml)	File diff + before_script / script / after_script fingerprinting
+Jenkins (Jenkinsfile)	File diff + best-effort stage / sh / bat fingerprinting (regex-based — not a Groovy parser)
+License
+
+Licensed under CC BY 4.0. See LICENSE.

pipewatch_cli-0.4.0/README.md

@@ -0,0 +1,217 @@
+# pipewatch
+
+**Integrity monitoring and static analysis for software supply chains.**
+
+CI/CD pipelines are high-value targets: they run with elevated permissions, pull from external registries, and execute arbitrary code on every commit. A single injected step, mutable action pin, or misconfigured trigger is enough to exfiltrate secrets, backdoor build artifacts, or pivot into production infrastructure — and the attack surface is almost always left unmonitored.
+
+pipewatch audits GitHub Actions workflows, GitLab CI, and Jenkinsfiles for exactly these risks. It combines commit-anchored baseline diffing, per-step SHA-256 fingerprinting, static misconfiguration analysis, and runner environment tracking into a single CLI tool. All commands exit non-zero on findings and emit structured JSON — suitable as a pipeline gate, a pre-merge check, or a periodic audit job.
+
+What It Detects
+Check	What it catches
+Baseline diff	Pipeline files modified, added, or deleted since a known-good commit
+Step fingerprinting	Individual steps injected, removed, or silently modified between commits
+pull_request_target misuse	Workflows that check out and execute PR head code with base-branch write permissions — the pattern behind numerous CI poisoning attacks
+Script injection	run: blocks and env: blocks that route user-controlled context values (github.event.pull_request.title, github.event.comment.body, etc.) into shell commands — both direct interpolation and the indirect env: VAR: ${{ ctx }} → $VAR pattern are detected
+Permission misconfiguration	Missing permissions: blocks, write-all scopes, secrets: inherit
+Mutable action pins	uses: references not locked to a full commit SHA — tags like v3 can be silently overwritten by a supply-chain attacker
+Invalid pinned SHAs	Pinned SHAs that do not exist in the upstream action repo (typos, deleted commits, fork SHAs)
+Unsafe workflow_run chains	Write-permissioned workflows triggered indirectly by external pull requests or issues, creating a privilege escalation path
+Self-hosted runners	Non-ephemeral runners that persist state between runs and are not managed by GitHub
+Runner environment drift	Env var and tool version changes between CI runs that could indicate a compromised or modified runner
+
+Findings are severity-ranked (CRITICAL → HIGH → MEDIUM → LOW → INFO) and always include a location, description, and evidence field.
+
+Installation
+
+Requires Python 3.12+. pyyaml is the only external dependency.
+
+Via pip (recommended):
+
+bash
+pip install pipewatch-cli
+
+Directly from GitHub (no clone required):
+
+bash
+pip install git+https://github.com/TheVoidThatConsumes/pipewatch.git
+
+Copy into your project — if you prefer to keep pipewatch self-contained inside a repo you're monitoring, download pipewatch.py and drop it anywhere in that repo. Install pyyaml manually:
+
+bash
+pip install pyyaml
+
+Then run it as py pipewatch.py <command> instead of pipewatch <command>.
+
+Quick Start
+bash
+# Record the current HEAD as known-good
+pipewatch baseline
+
+# Scan for changes and misconfigurations
+pipewatch scan
+
+# Full audit in one pass (scan + pin-audit + static)
+pipewatch audit --verify-shas
+Commands
+baseline
+
+Records the current (or a specified) commit as the integrity reference point. Set PIPEWATCH_HMAC_KEY to store a signed baseline — if the file is modified to suppress future findings, the HMAC check will fail and the tool will refuse to proceed.
+
+bash
+pipewatch baseline [--repo PATH] [--commit SHA]
+scan
+
+Diffs pipeline files and per-step fingerprints against the baseline commit. Detects both file-level changes (unified diff) and step-level tampering — a step whose uses, run, with, env, or shell fields change gets flagged even if the surrounding file diff looks innocuous.
+
+bash
+pipewatch scan [--repo PATH] [--baseline SHA] [--verbose] [--json]
+
+Covers GitHub Actions, GitLab CI, and Jenkinsfile stages.
+
+static
+
+Static analysis with no baseline required. Audits all GitHub Actions workflow files in .github/workflows/ for structural misconfigurations.
+
+bash
+pipewatch static [--repo PATH] [--verbose] [--json]
+
+Checks: pull_request_target misuse · script injection · missing/overpermissioned permissions: blocks · secrets: inherit · self-hosted runners · unsafe workflow_run trigger chains.
+
+pin-audit
+
+Flags uses: references not pinned to a full 40- or 64-character commit SHA. With --verify-shas, makes live GitHub API calls to confirm each pinned SHA actually exists in its upstream repository.
+
+bash
+pipewatch pin-audit [--repo PATH] [--verify-shas] [--token TOKEN] [--verbose] [--json]
+
+Rate limit: 60 requests/hr unauthenticated, 5 000/hr with --token or GITHUB_TOKEN. API calls are deduplicated — the same owner/repo@sha is only verified once regardless of how many steps reference it. Findings are not deduplicated: if the same invalid SHA appears across multiple workflow files or jobs, each affected step produces its own finding so the full scope of a compromised action is visible in the report.
+
+snapshot
+
+Captures the runner environment — environment variables and tool versions — to a JSON file for later comparison.
+
+bash
+pipewatch snapshot [--output FILE]
+
+Tracked tools: python3, python, node, npm, pip, pip3, git, curl, wget, docker, kubectl, terraform, aws, gcloud, az. Volatile per-run variables (GITHUB_RUN_ID, RUNNER_TEMP, etc.) are excluded to prevent noise on every comparison.
+
+Credential exclusion — environment variables whose names contain token, secret, key, password, passwd, pwd, auth, credential, private, or api_key (case-insensitive) are never written to the snapshot file. This prevents secrets such as GITHUB_TOKEN or PIPEWATCH_HMAC_KEY from being persisted to disk or uploaded to the Actions cache. Note that a legitimately non-sensitive variable with one of these terms in its name will also be excluded; rename it if you need env-diff to track it.
+
+Add the snapshot file to .gitignore to prevent it from being accidentally committed:
+
+.pipewatch_env_snapshot.json
+env-diff
+
+Diffs two runner environment snapshots. Detects new, removed, or changed environment variables and tool versions — useful for identifying runner poisoning or unexpected environment mutations between runs. If --current-snapshot is omitted, captures the live environment.
+
+bash
+pipewatch env-diff BASELINE_SNAPSHOT [--current-snapshot FILE] [--repo PATH] [--verbose] [--json]
+audit
+
+Full audit in one pass: scan + pin-audit + static. Exits non-zero if any findings exist.
+
+bash
+pipewatch audit [--repo PATH] [--baseline SHA] [--verify-shas] [--token TOKEN] [--verbose] [--json]
+init-runner
+
+Prints a ready-to-paste GitHub Actions step block that adds runner environment monitoring to any existing job.
+
+bash
+pipewatch init-runner [--snapshot-path PATH]
+Finding IDs
+Prefix	Category	Default Severity
+PW-DIFF-NNN	Pipeline file added / modified / deleted	HIGH / MEDIUM
+PW-STEP-NNN	Step fingerprint changed / injected / removed	HIGH / MEDIUM
+PW-PRT-NNN	pull_request_target misuse	HIGH
+PW-INJ-NNN	Script injection risk	HIGH
+PW-PERM-NNN	Permission misconfiguration	HIGH / MEDIUM
+PW-CHAIN-NNN	Unsafe workflow_run chain	HIGH
+PW-PIN-NNN	Unpinned action reference	MEDIUM
+PW-SHA-NNN	Pinned SHA not found in upstream repo	HIGH
+PW-RUNNER-NNN	Self-hosted runner	INFO
+PW-ENV-NNN	Runner environment drift	MEDIUM / LOW
+JSON Output
+
+All commands accept --json:
+
+json
+{
+  "tool": "pipewatch",
+  "version": "0.2.0",
+  "timestamp": "2025-01-01T00:00:00+00:00",
+  "repo": "/path/to/repo",
+  "baseline_commit": "abc123...",
+  "findings": [
+    {
+      "id": "PW-INJ-001",
+      "severity": "HIGH",
+      "category": "script_injection",
+      "title": "Script injection risk: .github/workflows/ci.yml::build::step[2]",
+      "description": "A run: block interpolates a user-controlled context value...",
+      "location": ".github/workflows/ci.yml::build::step[2]",
+      "evidence": "dangerous expressions found: ['github.event.pull_request.title']"
+    }
+  ],
+  "summary": { "total": 1, "CRITICAL": 0, "HIGH": 1, "MEDIUM": 0, "LOW": 0, "INFO": 0 }
+}
+
+Gate on exit code, or filter with jq:
+
+bash
+# fail the build on any HIGH or CRITICAL finding
+pipewatch audit --json | jq -e '.summary.HIGH == 0 and .summary.CRITICAL == 0'
+
+# list all finding titles
+pipewatch audit --json | jq -r '.findings[].title'
+Tamper-Evident Baselines
+
+Set PIPEWATCH_HMAC_KEY before running baseline. The baseline is stored as a signed JSON object:
+
+json
+{
+  "commit": "abc123...",
+  "timestamp": "2025-01-01T00:00:00+00:00",
+  "hmac": "<sha256-hmac-of-commit-and-timestamp>"
+}
+
+The HMAC is computed over both the commit SHA and the timestamp, bound together. This protects against two distinct attacks:
+
+Tampering — an attacker who modifies the commit field to point to an older known-good commit cannot produce a valid HMAC without the key.
+Replay — an attacker who reverts the baseline file to a previously-valid signed snapshot (to suppress findings introduced after that point) is also blocked, because the timestamp is part of the signed payload and the stored timestamp would no longer match the signature of any rewritten content.
+
+On scan or audit, the HMAC is verified before the baseline commit is trusted. Any verification failure causes an immediate exit with an error.
+
+Format-downgrade protection — if PIPEWATCH_HMAC_KEY is set and the baseline file is in plain-text format (a raw commit SHA rather than signed JSON), the tool refuses to proceed. An attacker cannot bypass signing by overwriting the file with an unsigned commit SHA. If you set PIPEWATCH_HMAC_KEY for the first time on a repo that already has an unsigned baseline, re-run pipewatch baseline to generate a signed one before your next scan.
+
+Store the key in a CI secret (PIPEWATCH_HMAC_KEY: ${{ secrets.PIPEWATCH_HMAC_KEY }}).
+
+Pipeline Integration
+yaml
+- name: pipewatch audit
+  env:
+    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    PIPEWATCH_HMAC_KEY: ${{ secrets.PIPEWATCH_HMAC_KEY }}
+  run: |
+    pipewatch audit --verify-shas --json | tee pw-report.json
+    jq -e '.summary.HIGH == 0 and .summary.CRITICAL == 0' pw-report.json
+
+Use init-runner to add runner environment monitoring alongside the audit step.
+
+Design Decisions
+
+HMAC-signed baselines — tamper-evident storage for the known-good commit reference. The HMAC covers both the commit SHA and the timestamp, so an attacker who can write to the repo but wants to suppress findings would need to forge the HMAC — not just overwrite the file or revert it to an older signed state. Attempting to downgrade a signed baseline to unsigned plain text is also refused when PIPEWATCH_HMAC_KEY is set.
+
+Volatile variable exclusion — snapshot strips run-specific GitHub variables so that env-diff doesn't generate noise on every comparison. Only structurally stable variables that could indicate environment manipulation are tracked. Variables whose names suggest credentials (containing token, secret, key, password, etc.) are also excluded so secrets are never written to the snapshot file or the Actions cache.
+
+Conservative SHA verification — --verify-shas treats network failures as non-findings. A flaky connection or GitHub API outage should not produce spurious HIGH alerts.
+
+Stdlib-first — pyyaml is the only dependency. The tool audits supply-chain risk; its own footprint is minimal by design.
+
+Platform Support
+Platform	Coverage
+GitHub Actions (.github/workflows/*.yml)	Full — file diff, step fingerprinting, static analysis, pin audit
+GitLab CI (.gitlab-ci.yml)	File diff + before_script / script / after_script fingerprinting
+Jenkins (Jenkinsfile)	File diff + best-effort stage / sh / bat fingerprinting (regex-based — not a Groovy parser)
+License
+
+Licensed under CC BY 4.0. See LICENSE.