Move to importlib from pkg_resources

[Molkree]

Setuptools docs:

Use of pkg_resources is discouraged in favor of importlib.resources, importlib.metadata, and their backports (resources, metadata).

pkg_resources is used to iterate over checkers using iter_entry_points, it can be replaced with something like this:

if sys.version_info >= (3, 8):
    from importlib import metadata as importlib_metadata
else:
    import importlib_metadata
checkers = importlib_metadata.entry_points()["cve_bin_tool.checker"]

[terriko]

Good catch, thank you. Flagging this with the 3.1 milestone to make sure it happens before next release.

That code is a little hoary because there was some minor concern from @pdxjohnny that we'd want it to be possible to write checkers without concern for compliance with our GPLv3 license. I'm not sure if this has ever actually been an issue for anyone, since by the nature of having that option it's likely that people who didn't want to produce GPLv3 code probably never contacted us.

[XDRAGON2002]

Currently we are using pkg_resources in 4 places:
cli.py, cve_scanner.py, version_scanner.py, test_checkers.py
Should I try to remove its usage from all these occurances?

[terriko]

Yes, we want to stop using pkg_resources entirely now in favour of an importlib based solution. Please remove it anywhere you find it.

[XDRAGON2002]

Opened PR #1542 that closes this issue.