# vendor

Copies of everything `report_generator` borrows from the monorepo, so the package can be lifted into
a repository of its own.

Nothing in here is edited. `sync.py` writes it, under the same import paths the monorepo uses:

```
python -m persistent_storage.report_generator.vendor.sync
```

Re-run it after changing anything it lists; the diff then shows what drifted. The copied packages
are removed whole first, so dropping an entry from the list actually drops it from the tree.

`__init__.py` decides whether these copies are used. It asks whether the real packages can be
imported — not a flag, not an environment variable — so the same code runs in the monorepo and
outside it, and the copies can never shadow the real packages while those are present.

## What is copied, and what for

| Copied | Used for |
| --- | --- |
| `cc_common` | The CLI framework, the logging context, `PipelineError`. |
| `persistent_storage/shared.py` | The storage configuration and its secrets. |
| `persistent_storage/wrapper.py` | The `Scan` and `Artifact` rows. |
| `persistent_storage/utils/db_utils.py` | Reading a scan and its artifacts. |
| `persistent_storage/utils/s3_utils.py` | Fetching the stored files. |
| `persistent_storage/utils/cvss_utils.py` | Reading a CVSS vector of any generation. |
| `persistent_storage/helper.py` | What `db_utils` prints its tables with. |
| `cipherverifier/core/services/sarif.py` | Summarising a SARIF report. |
| `cipherverifier/core/services/vdr.py` | Summarising a vulnerability report. |

The two summarisers live in the web application today and are written to be free of it — no Django,
no store. That is what makes copying them honest rather than a workaround: wherever this tool ends
up, they belong beside it rather than inside a web application it does not otherwise use.

Not copied: the report's own template, stylesheet and fonts, which are this package's own and live
in `template/`.

## Third-party dependencies

`pyproject.toml` lists them. WeasyPrint additionally needs the native Pango and cairo libraries.