2.0 KiB
vendor
Copies of everything report_generator borrows from the monorepo, so the package can be lifted into
a repository of its own.
Nothing in here is edited. sync.py writes it, under the same import paths the monorepo uses:
python -m persistent_storage.report_generator.vendor.sync
Re-run it after changing anything it lists; the diff then shows what drifted. The copied packages are removed whole first, so dropping an entry from the list actually drops it from the tree.
__init__.py decides whether these copies are used. It asks whether the real packages can be
imported — not a flag, not an environment variable — so the same code runs in the monorepo and
outside it, and the copies can never shadow the real packages while those are present.
What is copied, and what for
| Copied | Used for |
|---|---|
cc_common |
The CLI framework, the logging context, PipelineError. |
persistent_storage/shared.py |
The storage configuration and its secrets. |
persistent_storage/wrapper.py |
The Scan and Artifact rows. |
persistent_storage/utils/db_utils.py |
Reading a scan and its artifacts. |
persistent_storage/utils/s3_utils.py |
Fetching the stored files. |
persistent_storage/utils/cvss_utils.py |
Reading a CVSS vector of any generation. |
persistent_storage/helper.py |
What db_utils prints its tables with. |
cipherverifier/core/services/sarif.py |
Summarising a SARIF report. |
cipherverifier/core/services/vdr.py |
Summarising a vulnerability report. |
The two summarisers live in the web application today and are written to be free of it — no Django, no store. That is what makes copying them honest rather than a workaround: wherever this tool ends up, they belong beside it rather than inside a web application it does not otherwise use.
Not copied: the report's own template, stylesheet and fonts, which are this package's own and live
in template/.
Third-party dependencies
pyproject.toml lists them. WeasyPrint additionally needs the native Pango and cairo libraries.