fix: Fail more gracefully when pip --dry-run doesn't work (#2476)

* Fixes #2463

Author: metabiswadeep

cve_bin_tool/parsers/python.py

@@ -16,8 +16,8 @@ def __init__(self, cve_db, logger):
 
     def run_checker(self, filename):
         self.filename = filename
-        lines = json.loads(
-            subprocess.check_output(
+        try:
+            output = subprocess.check_output(
                 [
                     "pip3",
                     "install",
@@ -28,16 +28,30 @@ def run_checker(self, filename):
                     "--report",
                     "-",
                     "--quiet",
-                ]
+                ],
+                stderr=subprocess.STDOUT,
             )
-        )
-        for line in lines["install"]:
-            product = line["metadata"]["name"]
-            version = line["metadata"]["version"]
-            vendor = self.find_vendor(product, version)
-            if vendor is not None:
-                yield from vendor
-        self.logger.debug(f"Done scanning file: {self.filename}")
+        except subprocess.CalledProcessError as e:
+            self.logger.error(e.output)
+            pip_version = subprocess.check_output(["pip3", "--version"])
+            pip_version = float(pip_version[6:10])
+            if pip_version < 22.2:
+                self.logger.error(
+                    f"{filename} not scanned: pip --dry-run was unable to get package versions."
+                )
+                self.logger.error(
+                    "pip version >= 22.2 is required to scan Python requirements files."
+                )
+        else:
+            output = output[127:]
+            lines = json.loads(output)
+            for line in lines["install"]:
+                product = line["metadata"]["name"]
+                version = line["metadata"]["version"]
+                vendor = self.find_vendor(product, version)
+                if vendor is not None:
+                    yield from vendor
+            self.logger.debug(f"Done scanning file: {self.filename}")
 
 
 class PythonParser(Parser):