Option to skip dependencies with empty PyPI listing.

[m000]

Adds a cli and resolvelib option to allow pip-audit continue running when resolvelib deems a package as unresolvable.
This notably happens when a package links page exists, but is empty (e.g. https://pypi.org/simple/pkg_resources/).
Fixes #210.

Nit: Avoid redirection from https://pypi.org/simple/PROJECT to https://pypi.org/simple/PROJECT/.

[CLAassistant]

All committers have signed the CLA.

[woodruffw]

Overall structure looks good here, thanks! FWIW, I agree with the comment you left on #210 (comment): a separate PyPINoProjectLinksError makes sense to me. Could you add that?

cc @di for signoff: I think this is also a reasonable solution to #209 that won't be overly invasive.

[m000]

I'm working to update the PR. I may have to tweak it a bit. Where the exception is handled now, the top-level package (e.g. django-admin-inline-paginator) will be marked as skipped, while we only want to skip the dependency that had no links (e.g. pkg_resources).

Also, the name of the flag needs to be updated to reflect its effects. I was thinking to make it --skip-no-links. If anyone can come up with something more descriptive, please comment.

[m000]

In the end, I had to take a slightly more complicated approach. Because resolvelib doesn't have provisions for changing it's behaviour when we feed it with an empty dependency list to choose from, I resorted to feeding it with a fake candidate, and then handling the fake appropriately, before and after resolvelib is invoked.

I have added a new exception that will be thrown if the new flag is not specified and an empty PyPI listing occurs. This is mostly informational, to tell apart from a generic ResolutionImpossible error.

I have checked with the test case of #197 (where the cause of failure is different), and the two cases are not confused. I.e. #197 will still throw the same error even when --ignore-empty is supplied.

--ignore-empty seems a descriptive enough name for the flag, if no better proposals come up.

[di]

Some thoughts:

While this works for the narrow case of pkg_resources, I'm not sure it makes makes sense to apply across all projects that don't have releases on PyPI. It's entirely possible that a user has a vulnerable version of a package installed, that PyPI knows about the vulnerability, but the project owners (for whatever reason) have removed all releases. This is rare now but may become more common if we start taking into account packages that are malicious / typosquats / etc, where it's very likely they would have no releases on PyPI after admin intervention.

I think this change would make sense if we made it more generalizable as an option to skip resolution for any dependency that isn't resolvable for whatever reason. We would still check if there is a known vulnerability or not, but wouldn't attempt to continue resolution for it. This would be similar to #139, #145, #162, etc.

[m000]

I think this change would make sense if we made it more generalizable as an option to skip resolution for any dependency that isn't resolvable for whatever reason. We would still check if there is a known vulnerability or not, but wouldn't attempt to continue resolution for it.

Sounds reasonable. I'll update the PR within the next few days.

[m000]

Sorry for the delay. I'm in the middle of moving to a new place, so my free time is less than expected. I will pick this up the soonest possible.

[di]

I'm going to close this for now, but feel free to start a new PR if you are able to revisit!