Python utility for tracking third party dependencies within a library
This looks really neat. One thing I noticed on reading the source code, it appears to actually import the modules:<p>Quoting the docstring on the `track_module` function:<p><pre><code>    """This function executes the tracking of a single module by launching a
    subprocess to execute this module against the target module. The
    implementation of thie tracking resides in the __main__ in order to
    carefully control the import ecosystem.
</code></pre>
Source: <a href="https://github.com/IBM/import-tracker/blob/67a1e84e5a609e52e9bab866496af60e906d97c7/import_tracker/import_tracker.py#L33-L36" rel="nofollow">https://github.com/IBM/import-tracker/blob/67a1e84e5a609e52e...</a><p>Here's the actual subprocess call:
<a href="https://github.com/IBM/import-tracker/blob/67a1e84e5a609e52e9bab866496af60e906d97c7/import_tracker/import_tracker.py#L96-L97" rel="nofollow">https://github.com/IBM/import-tracker/blob/67a1e84e5a609e52e...</a><p><pre><code>    # Launch the process
    proc = subprocess.Popen(shlex.split(cmd), stdout=subprocess.PIPE, env=env)
</code></pre>
I think this is clever, and maybe even necessary, but feels risky to do on unaudited third-party Python libraries.<p>Maybe I'm misunderstanding something?