The files in here are committed with the standalone package. __init__.py puts these copies first on sys.path, so the package does not accidentally use an unrelated installed copy of one of these packages.

What is copied, and what for

Copied	Used for
`cc_common`	The CLI framework, the logging context, `PipelineError`.
`persistent_storage/shared.py`	The storage configuration and its secrets.
`persistent_storage/wrapper.py`	The `Scan` and `Artifact` rows.
`persistent_storage/utils/db_utils.py`	Reading a scan and its artifacts.
`persistent_storage/utils/s3_utils.py`	Fetching the stored files.
`persistent_storage/utils/cvss_utils.py`	Reading a CVSS vector of any generation.
`persistent_storage/helper.py`	What `db_utils` prints its tables with.
`cipherverifier/core/services/sarif.py`	Summarising a SARIF report.
`cipherverifier/core/services/vdr.py`	Summarising a vulnerability report.

The two summarisers live in the web application today and are written to be free of it — no Django, no store. That is what makes copying them honest rather than a workaround: wherever this tool ends up, they belong beside it rather than inside a web application it does not otherwise use.

Not copied: the report's own template, stylesheet and fonts, which are this package's own and live in template/.

Third-party dependencies

pyproject.toml lists them. WeasyPrint additionally needs the native Pango and cairo libraries.