# vendor

Copies of everything `report_generator` borrows from the monorepo, so the package can be lifted into
a repository of its own.

The files in here are committed with the standalone package. `__init__.py` puts
these copies first on `sys.path`, so the package does not accidentally use an
unrelated installed copy of one of these packages.

## What is copied, and what for

| Copied | Used for |
| --- | --- |
| `cc_common` | The CLI framework, the logging context, `PipelineError`. |
| `persistent_storage/shared.py` | The storage configuration and its secrets. |
| `persistent_storage/wrapper.py` | The `Scan` and `Artifact` rows. |
| `persistent_storage/utils/db_utils.py` | Reading a scan and its artifacts. |
| `persistent_storage/utils/s3_utils.py` | Fetching the stored files. |
| `persistent_storage/utils/cvss_utils.py` | Reading a CVSS vector of any generation. |
| `persistent_storage/helper.py` | What `db_utils` prints its tables with. |
| `cipherverifier/core/services/sarif.py` | Summarising a SARIF report. |
| `cipherverifier/core/services/vdr.py` | Summarising a vulnerability report. |

The two summarisers live in the web application today and are written to be free of it — no Django,
no store. That is what makes copying them honest rather than a workaround: wherever this tool ends
up, they belong beside it rather than inside a web application it does not otherwise use.

Not copied: the report's own template, stylesheet and fonts, which are this package's own and live
in `template/`.

## Third-party dependencies

`pyproject.toml` lists them. WeasyPrint additionally needs the native Pango and cairo libraries.