Initial commit. monorepo deps are copied in a dirty way to the vendor folder

report_generator/vendor/README.md

@@ -0,0 +1,42 @@
+# vendor
+
+Copies of everything `report_generator` borrows from the monorepo, so the package can be lifted into
+a repository of its own.
+
+Nothing in here is edited. `sync.py` writes it, under the same import paths the monorepo uses:
+
+```
+python -m persistent_storage.report_generator.vendor.sync
+```
+
+Re-run it after changing anything it lists; the diff then shows what drifted. The copied packages
+are removed whole first, so dropping an entry from the list actually drops it from the tree.
+
+`__init__.py` decides whether these copies are used. It asks whether the real packages can be
+imported — not a flag, not an environment variable — so the same code runs in the monorepo and
+outside it, and the copies can never shadow the real packages while those are present.
+
+## What is copied, and what for
+
+| Copied | Used for |
+| --- | --- |
+| `cc_common` | The CLI framework, the logging context, `PipelineError`. |
+| `persistent_storage/shared.py` | The storage configuration and its secrets. |
+| `persistent_storage/wrapper.py` | The `Scan` and `Artifact` rows. |
+| `persistent_storage/utils/db_utils.py` | Reading a scan and its artifacts. |
+| `persistent_storage/utils/s3_utils.py` | Fetching the stored files. |
+| `persistent_storage/utils/cvss_utils.py` | Reading a CVSS vector of any generation. |
+| `persistent_storage/helper.py` | What `db_utils` prints its tables with. |
+| `cipherverifier/core/services/sarif.py` | Summarising a SARIF report. |
+| `cipherverifier/core/services/vdr.py` | Summarising a vulnerability report. |
+
+The two summarisers live in the web application today and are written to be free of it — no Django,
+no store. That is what makes copying them honest rather than a workaround: wherever this tool ends
+up, they belong beside it rather than inside a web application it does not otherwise use.
+
+Not copied: the report's own template, stylesheet and fonts, which are this package's own and live
+in `template/`.
+
+## Third-party dependencies
+
+`pyproject.toml` lists them. WeasyPrint additionally needs the native Pango and cairo libraries.