Collect data from pypi API

[TG1999]

For example see this: https://pypi.org/pypi/Django/1.1.3/json

[johnmhoran]

I've drafted a gDoc describing the PyPi (and PyPA) advisory data, together with some suggestions -- and a number of questions -- re the collection process. Please share your thoughts and suggestions.

Strategy for collecting Python vulnerability data

[TG1999]

@johnmhoran thanks for researching this, pypi API should be an improver and not an importer. This improver should take all the Pypi packages stored in vulnerablecode, get all the valid versions for a package, and validate that we don't store a version that's not in the releases coming from the API. Validate the package-version we have is actually vulnerable and collect more vulnerabilities for that particular package-version from the Pypi API.

[johnmhoran]

Thank you @TG1999 . 👍