Pbr is unexpectedly required during runtime

[kulikjak]

Describe the bug

When running bandit without pbr installed, it breaks with:

Traceback (most recent call last):
  File "/usr/bin/bandit", line 6, in <module>
    from bandit.cli.main import main
  File "/usr/lib/python3.7/vendor-packages/bandit/__init__.py", line 17, in
<module>
    import pbr.version
ModuleNotFoundError: No module named 'pbr'

but pbr is not listed as runtime required so this is unexpected.

Reproduction steps

Run bandit without pbr installed.

Expected behavior

Bandit should either list pbr as a runtime dependency somewhere, or it should not use it in __init__.py.

Bandit version

1.7.0 (Default)

Python version

3.7

Additional context

This issue is avoided when installing with pip and pbr is brought in with stevedore. However, we have some python libraries repackaged and we don't list pbr as a stevedore runtime dependency (because it's not used anywhere in the code), and thus it is never brought in.

And while this works for anybody who installs it with pip (or doesn't change dependencies as we do), I think it should be listed as a runtime dependency in Bandit as well (because it should not depend on the fact that another fouth party library brings it in).

[sv-atoslav]

additional context

$ bandit --help
Traceback (most recent call last):
  File "/usr/local/bin/bandit", line 6, in <module>
    from bandit.cli.main import main
  File "/usr/local/lib/python3.9/dist-packages/bandit/__init__.py", line 17, in <module>
    import pbr.version
ModuleNotFoundError: No module named 'pbr'
$ pip install pbr
Requirement already satisfied: pbr in ./venv/lib/python3.9/site-packages (5.8.0)
$ pip show pbr
Name: pbr
Version: 5.8.0
Summary: Python Build Reasonableness
Home-page: https://docs.openstack.org/pbr/latest/
Author: OpenStack
Author-email: [email protected]
License: UNKNOWN
Location: /home/sv7atoslav/PycharmProjects/whitebox-files-scanner/external_tools/venv/lib/python3.9/site-packages
Requires: 
Required-by: stevedore
$ bandit --help
Traceback (most recent call last):
  File "/usr/local/bin/bandit", line 6, in <module>
    from bandit.cli.main import main
  File "/usr/local/lib/python3.9/dist-packages/bandit/__init__.py", line 17, in <module>
    import pbr.version
ModuleNotFoundError: No module named 'pbr'