Add additional python requirements

[garymm]

These are used by some of the python code in the package, e.g.,

onnxruntime/onnxruntime/python/tools/transformers/optimizer.py

Line 25 in 0292356

import coloredlogs

onnxruntime/onnxruntime/python/tools/symbolic_shape_infer.py

Line 10 in c8270c2

import sympy

onnxruntime/onnxruntime/python/tools/transformers/torch_onnx_export_helper.py

Line 9 in 0292356

from packaging.version import Version

[thiagocrepaldi]

I believe you need to add its license at ThirdPartyNotice.txt

Refer to the commit below as an example

commit ef20efe
Author: Thiago Crepaldi [email protected]
Date: Mon Aug 17 15:03:54 2020 -0700

Register cerberus license into ThirdPartyNotices.txt (#4828)

You also have to ensure the Governance Compliance component check is passing (the CI does not fail when an issue is found, but it is logged instead)

[garymm]

Thanks @thiagocrepaldi .

I believe you need to add its license at ThirdPartyNotice.txt

We're not distributing this software ourselves (e.g. by including any part of it in our packages), just declaring deps, so I don't think so.
Notice for example that numpy is not mentioned in that file.
But if I'm wrong could you please explain what the criteria is for being included in that file?

You also have to ensure the Governance Compliance component check is passing (the CI does not fail when an issue is found, but it is logged instead)

I don't see that in the list of checks. Do I need to trigger it manually? How?

[baijumeswani]

@snnn does the file need to be named as requirements.txt (without the .in suffix) for component governance stuff?

[thiagocrepaldi]

Thanks @thiagocrepaldi .

I believe you need to add its license at ThirdPartyNotice.txt

We're not distributing this software ourselves (e.g. by including any part of it in our packages), just declaring deps, so I don't think so. Notice for example that numpy is not mentioned in that file. But if I'm wrong could you please explain what the criteria is for being included in that file?

AFAIK cerberus and other projects are not redistributed as well, but I don't remember the exact criterium. Someone reached out to me at the time and asked me to do for compliance. Are tensorboard, tensorboardX or mpi4py distributed by us? They are in the aforementioned file.

You also have to ensure the Governance Compliance component check is passing (the CI does not fail when an issue is found, but it is logged instead)

I don't see that in the list of checks. Do I need to trigger it manually? How?
IIRC it is part of Linux CPU Pipeline. Possibly the Component Detection step right here

[thiagocrepaldi]

Thanks @thiagocrepaldi .

I believe you need to add its license at ThirdPartyNotice.txt

We're not distributing this software ourselves (e.g. by including any part of it in our packages), just declaring deps, so I don't think so. Notice for example that numpy is not mentioned in that file. But if I'm wrong could you please explain what the criteria is for being included in that file?

AFAIK cerberus and other projects are not redistributed as well, but I don't remember the exact criterium. Someone reached out to me at the time and asked me to do for compliance. Are tensorboard, tensorboardX or mpi4py distributed by us? They are in the aforementioned file.

You also have to ensure the Governance Compliance component check is passing (the CI does not fail when an issue is found, but it is logged instead)

I don't see that in the list of checks. Do I need to trigger it manually? How?
IIRC it is part of Linux CPU Pipeline. Possibly the Component Detection step right here

Just talked to @snnn and he said (only) The ones we ship in our packages or docker images

[snnn]

@snnn does the file need to be named as requirements.txt (without the .in suffix) for component governance stuff?

We use this file to generate a requirements.txt in the build folder. I believe component governance scans build folder as well. So, it's fine.

comments addressed

[garymm]

Can someone please approve or critique?

[thiagocrepaldi]

LGTM