build: tight control over Python dependencies

[fortaa]

Use PDM for that purpose.

Issue: TBD

[github-actions]

MLCommons CLA bot:
Thank you very much for your submission, we really appreciate it. Before we can accept your contribution, we ask that you sign the MLCommons CLA (Apache 2). Please use this [Google form] (https://forms.gle/Ew1KkBVpyeJDuRw67) to initiate authorization. If you are from an MLCommons member organization, we will request that you be added to the CLA. If you are not from a member organization, we will email you a CLA to sign. For any questions, please contact support@mlcommons.org.
0 out of 1 committers have signed the MLCommons CLA.
❌ @fortaa
_{You can retrigger this bot by commenting recheck in this Pull Request}

[FileSystemGuy]

Hi,

You submitted this PR against the MLPerf Storage repo, and we're very glad for your contribution, but I'd like to ask a few questions if you don't mind.

We need to know that you (and/or your employer) grant us a license to use the code changes you've offered. Could you please let us know...?

Thanks,
Curtis
(Co-Chair of MLPerf Storage)

[FileSystemGuy]

Just checking in again. We'd very much like your contribution to be added to our repo, but we cannot do that until/unless we know that you are granting MLCommons a license to use the code changes you suggested. Please let us know...

[fortaa]

Hi there,

The section 5 of your license applies here, doesn't it?

[FileSystemGuy]

Thank you for responding!

That's a great question! I've asked MLCommons leadership your question. Since submitting a PR is a pretty "intentional act", it seems clear enough. MLCommons' lawyers may have a more conservative interpretation, but let's see how they respond. Given that most participants in the WG are doing so while being paid by their employers to contribute, it's actually their employers who own the code being contributed, and they may not trust their employees to make those decisions. Personally, I don't think that's a very respectful attitude toward employees, but then that's just my opinion.

So, again, thank you for responding. I would very much like to merge your contribution into the repo. I don't have a mapping from github handle back to your name and/or email address, so if you're comfortable letting me know that, I'd appreciate it. You can email it to curtis@mlcommons.org if you'd prefer. I ask for two reasons, one it's easier to communicate, and two if your employer had (or has since) signed the CLA, then all the above drama becomes moot and I can accept the code in spite of the somewhat Luddite view of open source licenses by MLCommons' lawyers.

[FileSystemGuy]

Good news! MLCommon's lawyers responded with a variation on what I described above about organizational ownership as a strong reason to prefer CLAs, but both the Apache-2.0 license and section 6 of github.com's Terms of Service say that if a repo has a posted license like MLPerf Storage does, PR's submitted against that repo are assumed to grant that license to the repo's owner. In sum, I have been authorized to accept your PR!

So, thank you again for your contribution!