`Warning: No advisory sources configured!` must not be raised if advisory sources were passed via CLI about skjold

[AIGeneratedUsername]

By the way, (because I do not want to create many issues), is it expected that subsequent skjold calls every time take 3 minutes? Why is it so slow? Without changing files calling the command two times takes 6 minutes, three times - 9 minutes, etc.

Can cache be improved so if skjold is called again without a big pause and without changed files, then it will not take again 3 minutes? For example, if files are the same and less than N minutes from the previous scan, then skip some checks.

Anyway, 3 minutes on every call is very slow. I will need to inspect the source code to see what is happening here...

[twu]

👋 Thanks for taking the time to raise those issues and sorry for the late reply! :)

RE "Warning: No advisory sources configured!": Great point! The logic could definitely use a refactor to not print a warning when specifying sources via the CLI. I'm happy to review/merge a PR if you want to tackle it?

RE "Caching": Without more information it is hard to tell whether things should be faster or not. Using all sources at once might also a little bit of overkill as there is probably a lot of overlap between them. Either way skjold was definitely not optimized for speed e.g. the gemnasium source reads and parses all YAML files from an archive (https://github.com/twu/skjold/blob/master/src/skjold/sources/gemnasium.py#L115) on every invocation etc. It has a very basic (and hopefully working 😅) caching mechanism built in though (See https://github.com/twu/skjold/blob/master/src/skjold/core.py#L128-L136 and https://github.com/twu/skjold/blob/master/src/skjold/core.py#L93-L97).

I'm currently a little busy with work/private life but I will try to give it a deeper look this weekend along with any bugs or issues you find along the way. I'm also happy to review/merge any PRs tackling bugs if you are up for it? :)

P.S.: I also have mentioning this in the README.md on my TODO list as well but just so you are aware: skjold was created in a time way before PyPA released pip-audit which has way smarter and more dedicated people working on it (e.g. Dustin Ingram,...). I'm assuming they optimized for speed already with the amount of people using it. It might also be a far superior option depending on your use case :)