Implementation:Microsoft Onnxruntime CgManifest

Knowledge Sources	Microsoft_Onnxruntime
Domains	Compliance, Dependencies, Governance
Last Updated	2026-02-10 04:00 GMT

Overview

A Component Governance (CG) manifest file declaring all third-party dependencies used by the ONNX Runtime project for compliance and license tracking purposes.

Description

The `cgmanifest.json` file is a Component Detection manifest (schema: `component-detection-manifest.json`) that enumerates all third-party components consumed by ONNX Runtime. Each registration includes the component type, identification details, and optional comments. The manifest includes:

• Maven components (development dependencies):

 - `junit-platform-console-standalone` 1.6.2 (JUnit test framework)
 - `protobuf-java` 3.25.5 (Protocol Buffers for Java)

• Git-sourced components:

 - HalideIR, dlpack, dmlc-core (from dmlc project)
 - mkl-dnn (Intel Math Kernel Library for DNN)
 - TensorFlow, libpng, g3log, zlib, CNTK
 - NumPy, PyTorch, scikit-learn, Caffe
 - BoringSSL, c-ares, libcxx, libcxxabi (LLVM)
 - upb (Google protobuf), mpi4py
 - Android ML framework, UCX (middleware for InfiniBand)
 - Node.js (for JS bindings), smhasher (MurmurHash3)
 - gtest-ios-framework, dlfcn-win32
 - Pillow (anti-aliasing logic for Resize CPU kernel)

• Other (binary/download) components:

 - LLVM 9.0.0, FreeBSD GetOpt 12.0.0, Boost 1.69.0
 - Go 1.12.6, OpenMPI 4.0.0 and 4.0.4
 - NCCL 2.4.8, SQLite3 3.22.0

Each component entry specifies either a git commit hash with repository URL, or a download URL with name and version. Development dependencies are flagged with `"DevelopmentDependency": true`.

Usage

This manifest is consumed by Microsoft's Component Governance tooling during CI/CD builds to track third-party component usage, verify license compliance, and detect security vulnerabilities in dependencies.

Code Reference

Source Location

• Repository: Microsoft_Onnxruntime
• File: cgmanifests/cgmanifest.json
• Lines: 1-351

Signature

{
  "$schema": "https://json.schemastore.org/component-detection-manifest.json",
  "Registrations": [
    {
      "component": {
        "Type": "maven",
        "maven": {
          "GroupId": "org.junit.platform",
          "ArtifactId": "junit-platform-console-standalone",
          "Version": "1.6.2"
        },
        "DevelopmentDependency": true
      }
    },
    {
      "component": {
        "type": "git",
        "git": {
          "commitHash": "...",
          "repositoryUrl": "https://github.com/..."
        }
      }
    },
    {
      "component": {
        "Type": "other",
        "Other": {
          "Name": "LLVM",
          "Version": "9.0.0",
          "DownloadUrl": "https://releases.llvm.org/..."
        }
      }
    }
  ],
  "Version": 1
}

Import

// This file is consumed automatically by Component Governance tools
// No explicit import required

I/O Contract

Component Type	Count	Examples	Description
Maven	2	JUnit, protobuf-java	Java build/test dependencies
Git	~25	PyTorch, TensorFlow, NumPy, Node.js, Pillow	Source dependencies tracked by commit hash
Other	~8	LLVM, Boost, OpenMPI, NCCL, SQLite3, Go	Binary/download dependencies tracked by version

Usage Examples

// Example: Adding a new git dependency
{
  "component": {
    "type": "git",
    "git": {
      "commitHash": "abc123def456...",
      "repositoryUrl": "https://github.com/org/repo.git"
    }
  },
  "comments": "Description of why this dependency is needed"
}

Related Pages

• Implementation:Microsoft_Onnxruntime_WindowsAI_NuGet_Pipeline