🐛 Handle editable pip installs

[gabibguti]

What kind of change does this PR introduce?

Handle editable pip installs in Pinned-Dependencies check.

Description

When performing pip install -e <pkg>, the install can be considered secure if the package and it's dependencies are hash-pinned. The package can come from a local or remote source (VCS install). If the package is local, it is considered secure. If the package is remote, it needs to pinned by commit hash to be secure. We have no way to identify if the dependencies installed from requirements are hash-pinned. The flag --require-hashes does not work with -e flag. To guarantee we are not installing malicious dependencies, we can use --no-deps flag to not install the dependencies. That way the install can be considered secure.

Examples

secure	pip install --no-deps -e git+https://github.com/username/repo.git@0123456789abcdef0123456789abcdef01234567#egg=package"
secure	pip install --no-deps -e .
not secure	pip install -e git+https://github.com/username/repo.git@0123456789abcdef0123456789abcdef01234567#egg=package"
not secure	pip install --no-deps -e git+https://github.com/username/repo.git#egg=package"

References

• pip install syntax: https://pip.pypa.io/en/stable/cli/pip_install/#pip-install
• secure pip install: https://pip.pypa.io/en/stable/topics/secure-installs/#do-not-use-setuptools-directly
• what is editable pip install: https://setuptools.pypa.io/en/latest/userguide/development_mode.html
• pip VCS install syntax: https://pip.pypa.io/en/latest/topics/vcs-support/#vcs-support
• editable cannot be installed when requiring hashes pypa/pip#4995

(Is it a bug fix, feature, docs update, something else?)

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

Currently, we don't handle editable pip installs. We suggest using --require-hashes as remediation but it's not possible.

What is the new behavior (if this is a feature change)?**

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Closes #2228

Special notes for your reviewer

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

Accept pip installs with `-e` flag along with `--no-deps` flag in Pinned-Dependencies check. Editable pip installs will be accepted if coming from a local source or a remote Git source pinned by hash, as long as it's not installing dependencies.

[codecov]

Codecov Report

Merging #2731 (baae4da) into main (110e352) will increase coverage by 0.13%.
The diff coverage is 100.00%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2731      +/-   ##
==========================================
+ Coverage   49.78%   49.91%   +0.13%     
==========================================
  Files         156      156              
  Lines       11638    11669      +31     
==========================================
+ Hits         5794     5825      +31     
  Misses       5490     5490              
  Partials      354      354              

[di]

LGTM! Nice job!

[laurentsimon]

Thank you!

[laurentsimon]

Please rebase and we'll be able to merge.

[gabibguti]

rebased