Add certifi dependency

[robin-nitrokey]

This PR adds the certifi dependency and also introduces a new CI job that makes sure that a clean install with pip works. To be able to do that, we have to move the version from nethsm/VERSION into nethsm/__init__.py.

Fixes: #33

CI runs:

• The version check before releases had to be adapted but should still work, see: https://github.com/Nitrokey/nethsm-sdk-py/actions/runs/6578036489/job/17870927268
• The CI should now fail if we forget to include a required dependency, see: https://github.com/Nitrokey/nethsm-sdk-py/actions/runs/6578103384/job/17871112964

@mmerklinger As this touches the CI, esp. the version check before releases, could you please have a look?

[codecov]

Codecov Report

Attention: 3 lines in your changes are missing coverage. Please review.

Comparison is base (08a2a10) 79.31% compared to head (4af6e71) 79.44%.
Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #47      +/-   ##
==========================================
+ Coverage   79.31%   79.44%   +0.12%     
==========================================
  Files         782      782              
  Lines       13382    13387       +5     
==========================================
+ Hits        10614    10635      +21     
+ Misses       2768     2752      -16     

Files	Coverage Δ
nethsm/__init__.py	77.59% <97.08%> (+1.06%)	⬆️

... and 6 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[q-nk]

Did I understand correctly that the version has to be hard coded in init.py?

In #33 you wrote

it tries to load the module to check the computed version (which does not work).

Why exactly is it no possible to fill the variable __version__ by code that is executed when the module is loaded?
E.g., something like

def get_version():
  with open("VERSION", r) as fd:
    version = fd.read()
    #do some checks
    return version

__version__ = get_version()    

If I understand you correctly, you tried this?
I mean it would be more beautiful, as the same data is not stored in two places.
It would also avoid the, in my opinion rather extensive version determination in aaf81ba#diff-f95d5c25ce613cd9c56121fda16cda61e200c9e9bbb68a3ac410b27dfdde447c

Further is the VERSION file no longer needed an can now be deleted, right?

[robin-nitrokey]

You are right, I forgot to delete the VERSION file. I fixed that. So the information is not duplicated, it is moved.

If I understand you correctly, you tried this?

This is basically the same code that we currently have, right? It does not work because flit wants to determine the version before installing the package. But it cannot load the module because it tries to import from the pynitrokey package that is not installed yet. This is what pypa/flit#386 is about.

It would also avoid the, in my opinion rather extensive version determination in aaf81ba#diff-f95d5c25ce613cd9c56121fda16cda61e200c9e9bbb68a3ac410b27dfdde447c

This script is only executed in the CI when making a new release, so I don’t think this is an issue. And I wouldn’t call it expensive. Sure, more effort than reading out a file, but still very cheap.

[q-nk]

Yeah its quite the same code, but I see the issue now, thanks.

[daringer]

lgtm, would go so far to admit that a VERSION file is anyways bad :/