support for peep about freeze-requirements

[flupke]

I'm not sure it would be useful at all:

• merged requirements include both requirements and their dependencies, keeping the peep comments only for top-level requirements makes no sense, it doesn't solve the security issues.
• generating peep checksums for dependencies doesn't solve security issues either

You can however use peep in place of pip with --pip /path/to/peep, so top-level requirements checksums are checked when freeze-requirements downloads the packages. Then you know at least top-level packages in your --output-dir are OK...

Did I miss something?

[avoine]

No your right. We can't know the checksums before freeze-requirements runs.