Verification
Is each requirement verified, by the method it calls for, on the build that matters? Every result below names the build it applies to. Parent requirements roll up their children: one failure fails the parent.
Latest main-branch build of each repository 0.28.1 · 2024-12-06 0.28.0 · 2024-11-28 8.5.0 · 2026-08-22 8.4.2 · 2026-06-24 8.4.1 · 2026-05-22 8.4.0 · 2026-05-16 v2.34.2 · 2026-05-14 v2.34.1 · 2026-05-13 v2.34.0 · 2026-05-11 v2.34.0.dev1 · 2026-05-03 v2.33.1 · 2026-03-30 v2.33.0 · 2026-03-25
FailedRe-verifyVerifiedVerified on older buildNot verified
| Requirement | Method | Status | Criteria | Target build |
|---|---|---|---|---|
| SYS-01 v1 Third-party client libraries meet the platform dependency baseline |
roll-up | Needs re-verification | 1 requirement below | each child against its own build |
| SUB-HTTP-01 v1 HTTP client libraries (requests, httpx) meet the baseline |
roll-up | Needs re-verification | 3 requirements below | each child against its own build |
| REQ-HTTPX-01 v2 TLS configuration has one obvious way |
test | Needs re-verification 6 open re-verification items |
0/6 on this build
|
#1020 (0.28.0) 80960fa319
encode/httpx · 2024-11-28 · synthetic CI
|
| REQ-HTTPX-02 v1 URLs are encoded the way browsers encode them |
test | Not verified |
0/3 on this build
|
#1020 (0.28.0) 80960fa319
encode/httpx · 2024-11-28 · synthetic CI
|
| REQ-HTTPX-03 v1 Secrets never appear in logs |
inspection | Not verified |
0/1 on this build
|
#1020 (0.28.0) 80960fa319
encode/httpx · 2024-11-28 · synthetic CI
|
REQ-HTTPX-01 · TLS configuration has one obvious way Needs re-verification
Verified by test. Only test evidence counts; status is against build #1020 (0.28.0).
| Criterion | Status | Result applies to | Evidence |
|---|---|---|---|
| AC-HTTPX-101-1 history `verify` accepts `True`, `False` or an `ssl.SSLContext`, and the separate `ssl_context` parameter is removed. |
Re-verify | – |
Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.
|
| AC-HTTPX-101-2 history Passing a string to `verify` raises an error that tells the user to use `ssl.create_default_context(cafile=...)` instead. |
Re-verify | – |
Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.
|
| AC-HTTPX-101-3 history Passing a string to `verify` raises `TypeError`. |
Re-verify | – |
Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.
|
| AC-HTTPX-101-4 history Importing httpx does not import the `ssl` module until a client actually needs it. |
Re-verify | – |
Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.
|
| AC-HTTPX-101-5 history Using `verify=False` together with a client certificate (`cert=...`) still loads the certificate instead of ignoring it. |
Re-verify | – |
Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.
|
| AC-HTTPX-101-6 history The documentation describes the `SSL_CERT_FILE` and `SSL_CERT_DIR` environment variables. |
Re-verify | – |
Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.
|
REQ-HTTPX-02 · URLs are encoded the way browsers encode them Not verified
Verified by test. Only test evidence counts; status is against build #1020 (0.28.0).
| Criterion | Status | Result applies to | Evidence |
|---|---|---|---|
| AC-HTTPX-201-1 history Query parameters encode spaces as `+` (form encoding). |
Not verified | – | No test evidence recorded. |
| AC-HTTPX-201-2 history A `/` inside a query parameter value is percent-encoded as `%2F`. |
Not verified | – | No test evidence recorded. |
| AC-HTTPX-201-3 history The behaviour change is called out in the CHANGELOG under backwards-incompatible changes. |
Not verified | – | No test evidence recorded. |
REQ-HTTPX-03 · Secrets never appear in logs Not verified
Verified by inspection. Only inspection evidence counts; status is against build #1020 (0.28.0).
| Criterion | Status | Result applies to | Evidence |
|---|---|---|---|
| AC-HTTPX-102-3 history Proxy credentials (user and password in the proxy URL) are never written to log output. |
Not verified | – | No inspection evidence recorded. |
Recent builds
| Build | Repository | Commit | Result | Finished |
|---|---|---|---|---|
| #1049 | pallets/click | 2247b35ea1 | failure | 2026-10-04 |
| #1048 | pallets/click | 06b2a67874 | success | 2026-09-23 |
| #1047 | pallets/click | 6aabf099bf | success | 2026-09-06 |
| #1046 | pallets/click | 36baa15ff8 | success | 2026-08-27 |
| #1045 | pallets/click | 68e7ea7228 | success | 2026-08-25 |
| #1044 (8.5.0) | pallets/click | 8b19813f2b | success | 2026-08-22 |
| #1043 | pallets/click | 2c8cd3ac95 | success | 2026-08-20 |
| #1042 | pallets/click | e1fd5946ab | success | 2026-08-20 |
| #1041 | pallets/click | 2103e15768 | success | 2026-08-19 |
| #1040 | pallets/click | 61b69e967e | success | 2026-08-18 |
| #1039 | pallets/click | f36d58bbd7 | success | 2026-08-18 |
| #1038 | pallets/click | cbd7a4109d | success | 2026-08-16 |
| #1037 | pallets/click | fc5c7f45da | success | 2026-08-16 |
| #1036 | pallets/click | 150d1071d6 | success | 2026-08-15 |
| #1035 | pallets/click | 8b44edfff7 | success | 2026-08-14 |
| #1034 | pallets/click | 9c4dfdaebe | success | 2026-08-09 |
| #1033 | pallets/click | 00e592cea7 | success | 2026-07-24 |
| #1032 | pallets/click | 5aa8ac4352 | success | 2026-07-23 |
| #1031 | pallets/click | 42235de05e | success | 2026-07-23 |
| #1030 | pallets/click | 398f915431 | success | 2026-07-22 |
| #1029 | pallets/click | 5e906a8afb | success | 2026-07-22 |
| #1028 | pallets/click | cfa01eeb78 | success | 2026-07-20 |
| #1027 | pallets/click | 333c28d79c | success | 2026-07-17 |
| #1026 | pallets/click | 7df2f82305 | success | 2026-07-17 |
| #1025 | pallets/click | b551fe8571 | success | 2026-07-16 |
In the offline demo the builds and test results are synthetic (git keeps no CI history) and flagged as such; release tags are real. A live sync reads GitHub Actions runs, and devtrack ingest-junit loads real test reports.
Data classification
| Repository | Class | External models |
|---|---|---|
| encode/httpx Open-source dependency. |
public | allowed |
| pallets/click Open-source dependency. |
public | allowed |
| psf/requests Open-source dependency. |
public | allowed |
A repository with no classification is treated as controlled. Controlled code is only ever judged by an approved internal model.