Towards a `pip audit` subcommand for vulnerability analysis & management

[bernatgabor (Bernát Gábor)]

@fungi

it seems like the end goal is to have security advisory information served from PyPI and reported to end users at the time they’re trying to install things, but to also be able to later re-audit those same environments for newly discovered vulnerabilities.

Guess this is the part I do not agree with then. If I ask an installer to install a package, I’d not like to get a security audit, just install it. I’ll handle security auditing in parallel when I need it. I’d rather not make pip even slower if that’s possible.