Verification
Is each requirement verified, by the method it calls for, on the build that matters? Every result below names the build it applies to. Parent requirements roll up their children: one failure fails the parent.
Latest main-branch build of each repository 0.28.1 · 2024-12-06 0.28.0 · 2024-11-28 8.5.0 · 2026-08-22 8.4.2 · 2026-06-24 8.4.1 · 2026-05-22 8.4.0 · 2026-05-16 v2.34.2 · 2026-05-14 v2.34.1 · 2026-05-13 v2.34.0 · 2026-05-11 v2.34.0.dev1 · 2026-05-03 v2.33.1 · 2026-03-30 v2.33.0 · 2026-03-25
FailedRe-verifyVerifiedVerified on older buildNot verified
| Requirement | Method | Status | Criteria | Target build |
|---|---|---|---|---|
| SYS-01 v1 Third-party client libraries meet the platform dependency baseline |
roll-up | Needs re-verification | 1 requirement below | each child against its own build |
| SUB-HTTP-01 v1 HTTP client libraries (requests, httpx) meet the baseline |
roll-up | Needs re-verification | 3 requirements below | each child against its own build |
| REQ-REQ-01 v1 Anything that behaves like a file is accepted |
test | Not verified |
0/3 on this build
|
#1026 (v2.34.0.dev1) f7822f7c41
psf/requests · 2026-05-03 · synthetic CI
|
| REQ-REQ-02 v3 Public type hints describe what callers may pass |
analysis | Needs re-verification 3 open re-verification items |
0/3 on this build
|
#1026 (v2.34.0.dev1) f7822f7c41
psf/requests · 2026-05-03 · synthetic CI
|
| REQ-REQ-03 v1 Security-relevant code works under FIPS |
demonstration | Not verified |
0/2 on this build
|
#1026 (v2.34.0.dev1) f7822f7c41
psf/requests · 2026-05-03 · synthetic CI
|
REQ-REQ-01 · Anything that behaves like a file is accepted Not verified
Verified by test. Only test evidence counts; status is against build #1026 (v2.34.0.dev1).
| Criterion | Status | Result applies to | Evidence |
|---|---|---|---|
| AC-REQ-101-1 history Request bodies that wrap a file through `__getattr__` (without defining `__iter__` themselves) are streamed instead of rejected. |
Not verified | – | No test evidence recorded. |
| AC-REQ-101-2 history Multipart uploads accept file objects that only expose `read` through `__getattr__`. |
Not verified | – | No test evidence recorded. |
| AC-REQ-101-3 history All read-capability checks go through one helper function instead of repeated isinstance checks. |
Not verified | – | No test evidence recorded. |
REQ-REQ-02 · Public type hints describe what callers may pass Needs re-verification
Verified by analysis. Only analysis evidence counts; status is against build #1026 (v2.34.0.dev1).
| Criterion | Status | Result applies to | Evidence |
|---|---|---|---|
| AC-REQ-201-1 history `Request.hooks` has a type annotation. |
Re-verify | – |
Re-verify: requirement changed to v3 on 2026-06-20; no passing analysis since.
1 invalidated result
|
| AC-REQ-202-1 history `Request.headers` is typed as a read-only `Mapping[str, str | bytes]`. |
Re-verify | – |
Re-verify: requirement changed to v3 on 2026-06-20; no passing analysis since.
1 invalidated result
|
| AC-REQ-202-2 history `Response.reason` is typed as `str`. |
Re-verify | – |
Re-verify: requirement changed to v3 on 2026-06-20; no passing analysis since.
1 invalidated result
|
REQ-REQ-03 · Security-relevant code works under FIPS Not verified
Verified by demonstration. Only demonstration evidence counts; status is against build #1026 (v2.34.0.dev1).
| Criterion | Status | Result applies to | Evidence |
|---|---|---|---|
| AC-REQ-203-1 history DigestAuth works on FIPS-enabled systems by passing `usedforsecurity=False` to every hashlib call it makes. |
Not verified | – | No demonstration evidence recorded. |
| AC-REQ-203-3 history DigestAuth supports the SHA-512-256 algorithm. |
Not verified | – | No demonstration evidence recorded. |
Recent builds
| Build | Repository | Commit | Result | Finished |
|---|---|---|---|---|
| #1049 | pallets/click | 2247b35ea1 | failure | 2026-10-04 |
| #1048 | pallets/click | 06b2a67874 | success | 2026-09-23 |
| #1047 | pallets/click | 6aabf099bf | success | 2026-09-06 |
| #1046 | pallets/click | 36baa15ff8 | success | 2026-08-27 |
| #1045 | pallets/click | 68e7ea7228 | success | 2026-08-25 |
| #1044 (8.5.0) | pallets/click | 8b19813f2b | success | 2026-08-22 |
| #1043 | pallets/click | 2c8cd3ac95 | success | 2026-08-20 |
| #1042 | pallets/click | e1fd5946ab | success | 2026-08-20 |
| #1041 | pallets/click | 2103e15768 | success | 2026-08-19 |
| #1040 | pallets/click | 61b69e967e | success | 2026-08-18 |
| #1039 | pallets/click | f36d58bbd7 | success | 2026-08-18 |
| #1038 | pallets/click | cbd7a4109d | success | 2026-08-16 |
| #1037 | pallets/click | fc5c7f45da | success | 2026-08-16 |
| #1036 | pallets/click | 150d1071d6 | success | 2026-08-15 |
| #1035 | pallets/click | 8b44edfff7 | success | 2026-08-14 |
| #1034 | pallets/click | 9c4dfdaebe | success | 2026-08-09 |
| #1033 | pallets/click | 00e592cea7 | success | 2026-07-24 |
| #1032 | pallets/click | 5aa8ac4352 | success | 2026-07-23 |
| #1031 | pallets/click | 42235de05e | success | 2026-07-23 |
| #1030 | pallets/click | 398f915431 | success | 2026-07-22 |
| #1029 | pallets/click | 5e906a8afb | success | 2026-07-22 |
| #1028 | pallets/click | cfa01eeb78 | success | 2026-07-20 |
| #1027 | pallets/click | 333c28d79c | success | 2026-07-17 |
| #1026 | pallets/click | 7df2f82305 | success | 2026-07-17 |
| #1025 | pallets/click | b551fe8571 | success | 2026-07-16 |
In the offline demo the builds and test results are synthetic (git keeps no CI history) and flagged as such; release tags are real. A live sync reads GitHub Actions runs, and devtrack ingest-junit loads real test reports.
Data classification
| Repository | Class | External models |
|---|---|---|
| encode/httpx Open-source dependency. |
public | allowed |
| pallets/click Open-source dependency. |
public | allowed |
| psf/requests Open-source dependency. |
public | allowed |
A repository with no classification is treated as controlled. Controlled code is only ever judged by an approved internal model.