[NVIDIA] Fix bandit warnings, update release tags (openvinotoolkit#651)

* [NVIDIA] Fix bandit warnings, update release tags

* Update README.md

* Update README.md

modules/nvidia_plugin/README.md

@@ -5,7 +5,7 @@ OpenVINO™ NVIDIA GPU plugin is developed in order to enable deep neural networ
 The plugin uses custom kernels and [cuBLAS, cuDNN, cuTENSOR libraries\*] as a backend.
 
 ## Supported Platforms
-OpenVINO™ NVIDIA GPU plugin is supported and validated on the following platforms: 
+OpenVINO™ NVIDIA GPU plugin is supported and validated on the following platforms:
 
 OS                     | GPU                   | Driver               |
 ---------------------- | --------------------- |--------------------- |
@@ -48,20 +48,19 @@ Afterwards plugin build procedure is as following:
 
 1. Clone `openvino_contrib` repository:
 ```bash
-git clone --recurse-submodules --single-branch --branch=master https://github.com/openvinotoolkit/openvino_contrib.git 
+git clone --recurse-submodules --single-branch --branch=2022.3.0 https://github.com/openvinotoolkit/openvino_contrib.git
 ```
 2. Go to plugin directory:
 ```bash
 cd openvino_contrib/modules/nvidia_plugin
-git checkout develop
 ```
 3. Prepare a build folder:
 ```bash
 mkdir build && cd build
 ```
 4. Build plugin
 
-    First of all, switch OpenVINO™ to tag _2022.1.0_ and then build it according the instruction [How to build](https://github.com/openvinotoolkit/openvino/wiki#how-to-build)
+    First of all, switch OpenVINO™ to tag _2022.3.0_ and then build it according the instruction [How to build](https://github.com/openvinotoolkit/openvino/wiki#how-to-build)
 
     Then build CUDA Plugin with one of 2 options:
 - Using `build.sh`
@@ -72,20 +71,20 @@ mkdir build && cd build
   export OPENVINO_CONTRIB=<OpenVINOContrib packages source directory>
   export OPENVINO_BUILD_PATH=<OpenVINO build directory>
   ```
-  
-  Then run one of the following commands: 
+
+  Then run one of the following commands:
   ```bash
   # Run cmake configuration (if necessary) and then build
   ../build.sh --build
-  
+
   # Run cmake configuration
   ../build.sh --setup
-  
+
   # For old build delete old configuration, generate new one and then build
   ../build.sh --rebuild
   ```
 - Using _OpenVINODeveloperPackage_
-  
+
   Run the following command:
   ```bash
   cmake -DOpenVINODeveloperPackage_DIR=<path to OpenVINO package build folder> -DCMAKE_BUILD_TYPE=Release ..
@@ -98,12 +97,11 @@ If python available the CUDA Plugin could be compiled with setup.py script as fo
 
 1. Clone `openvino_contrib` repository:
 ```bash
-git clone --recurse-submodules --single-branch --branch=master https://github.com/openvinotoolkit/openvino_contrib.git 
+git clone --recurse-submodules --single-branch --branch=2022.3.0 https://github.com/openvinotoolkit/openvino_contrib.git
 ```
 2. Go to plugin directory:
 ```bash
 cd openvino_contrib/modules/nvidia_plugin
-git checkout develop
 ```
 3. Setup `CUDACXX` environment variable to point to the CUDA _nvcc_ compiler like the next (use yours path)
 ```bash
@@ -156,13 +154,13 @@ In order to build openvino_nvidia_gpu_plugin in docker, follow the steps:
 
 1. Enter the docker container:
 ```bash
-docker run --gpus all -it openvino/cudaplugin-2022.1 bin/bash
+docker run --gpus all -it openvino/cudaplugin-2022.3 bin/bash
 ```
 2. Build the OpenVINO and openvino_nvidia_gpu_plugin according the steps described in [## How to build](#how-to-build),
    except 3), 4), 5) steps (this packages already installed in image)
 3. Commit all your changes in container:
 ```bash
-docker commit openvino/cudaplugin-2022.1 <name of new image>
+docker commit openvino/cudaplugin-2022.3 <name of new image>
 ```
 
 ## Supported Configuration Parameters
@@ -200,7 +198,7 @@ The plugin supports IRv10 and higher. The list of supported layers and its limit
 * I8 - Not supported
 * I16 - Not supported
 
-## Supported Output Precision 
+## Supported Output Precision
 * FP32 – Supported
 * FP16 - Not supported
 
@@ -216,8 +214,8 @@ By contributing to the project, you agree to the license and copyright terms the
 and release your contribution under these terms.
 
 ## How to Contribute
-We welcome community contributions to `openvino_contrib` repository. 
-If you have an idea how to improve the modules, please share it with us. 
+We welcome community contributions to `openvino_contrib` repository.
+If you have an idea how to improve the modules, please share it with us.
 All guidelines for contributing to the repository can be found [here](../../CONTRIBUTING.md).
 
 ---

modules/nvidia_plugin/build.sh

@@ -10,7 +10,7 @@ fi
 BUILD_JOBS=${BUILD_JOBS:-$(nproc)}
 BUILD_TYPE=${BUILD_TYPE:-Release}
 BUILD_TARGETS=${BUILD_TARGETS:-"CudaFuncTests CudaUnitTests openvino_nvidia_gpu_plugin benchmark_app"}
-WHEEL_VERSION=${WHEEL_VERSION:-"2022.1.0"}
+WHEEL_VERSION=${WHEEL_VERSION:-"2022.3.0"}
 ENABLE_TESTS=${ENABLE_TESTS:-"ON"}
 
 [[ -n "${OPENVINO_HOME}" ]] || { echo "OPENVINO_HOME environment variable is expected"; exit 1; }

modules/nvidia_plugin/docker.sh

@@ -33,16 +33,17 @@ function build() {
     fi
 
     pushd "${CUDA_PACKAGES_PATH}"
-    docker build -t openvino/cudaplugin-2022.1 .
+    docker build -t openvino/cudaplugin-2022.3 .
     if [[ ! ./Dockerfile -ef ${CUDA_PACKAGES_PATH}/Dockerfile ]]; then
         rm -f "${CUDA_PACKAGES_PATH}"/Dockerfile
     fi
     popd
 }
 
 function run() {
-    OPENVINO_TEMP_PATH=$OPENVINO_HOME/inference-engine/temp
-    OPENCV_PATH=$OPENVINO_TEMP_PATH/opencv_4.5.1_ubuntu18/opencv
+    OPENVINO_TEMP_PATH=$OPENVINO_HOME/temp
+    TEMPCV_DIR=${OPENVINO_TEMP_PATH}/opencv_4*
+    OPENCV_PATH=$(ls -d -1 ${TEMPCV_DIR} )
     TBB_PATH=$OPENVINO_TEMP_PATH/tbb
     LD_LIBRARY_PATH="${LD_LIBRARY_PATH:+LD_LIBRARY_PATH:}${TBB_PATH}/lib:${OPENCV_PATH}/lib:${OPENVINO_HOME}/bin/intel64/${BUILD_TYPE}/lib"
 
@@ -51,7 +52,7 @@ function run() {
                           -v "${PWD}:${PWD}" \
                           -v "${OPENVINO_TEMP_PATH}:${OPENVINO_TEMP_PATH}" \
                           -v "${USER_SHARE_PATH}:${USER_SHARE_PATH}" \
-                          -w "${PWD}" openvino/cudaplugin-2022.1 \
+                          -w "${PWD}" openvino/cudaplugin-2022.3 \
                           ${USER_APP}
 }
 

modules/nvidia_plugin/wheel/openvino_nvidia/__init__.py

@@ -1,7 +1,12 @@
 import os
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
+from defusedxml import defuse_stdlib
 import platform
 
+# defuse_stdlib provide patched version of xml.etree.ElementTree which allows to use objects from xml.etree.ElementTree
+# in a safe manner without including unsafe xml.etree.ElementTree
+ET_defused = defuse_stdlib()[ET]
+Element = ET_defused.Element
 
 def _get_lib_file_extension() -> str:
     platform_name = platform.system()
@@ -21,13 +26,14 @@ def _register_nvidia_plugin():
     openvino_nvidia_gpu_library = os.path.join(openvino_nvidia_gpu_package_dir, f"../libopenvino_nvidia_gpu_plugin.{_get_lib_file_extension()}")
 
     xml_file = os.path.join(openvino_package_libs_dir, "plugins.xml")
-    tree = ET.parse(xml_file)
+    tree = ET.parse(xml_file).getroot()
     plugins = tree.find("plugins")
     if all(plugin.get('name') != 'NVIDIA' for plugin in plugins.iter('plugin')):
-        plugins.append(ET.Element('plugin', {'name': 'NVIDIA', 'location': openvino_nvidia_gpu_library}))
-        tree.write(xml_file)
+        plugins.append(Element('plugin', {'name': 'NVIDIA', 'location': openvino_nvidia_gpu_library}))
+        with open(xml_file, "w") as f:
+            f.write(ET.tostring(tree).decode('utf8'))
 
 
 _register_nvidia_plugin()
 
-__version__ = "2022.1.0"
+__version__ = "2022.3.0"

modules/nvidia_plugin/wheel/requirements-dev.txt

@@ -1,3 +1,4 @@
 setuptools>=53.0.0
 wheel>=0.36.2
 python-decouple>=3.4
+defusedxml>=0.7.1

modules/nvidia_plugin/wheel/requirements.txt

@@ -1 +1 @@
-openvino==2022.1.0
+openvino==2022.3.0

modules/nvidia_plugin/wheel/setup.py

@@ -6,14 +6,15 @@
 import pathlib
 import sys
 import abc
-import subprocess
+import subprocess # nosec - disable B404:import-subprocess check
 import platform
 import shutil
 import glob
 import errno
 import multiprocessing
 import typing
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
+from defusedxml import defuse_stdlib
 
 from pathlib import Path
 from setuptools import setup
@@ -23,18 +24,26 @@
 from distutils import log
 from typing import Optional
 
+import wheel.vendored.packaging.tags as tags
+import wheel.bdist_wheel
+import wheel.vendored.packaging.tags
+
+# defuse_stdlib provide patched version of xml.etree.ElementTree which allows to use objects from xml.etree.ElementTree
+# in a safe manner without including unsafe xml.etree.ElementTree
+ET_defused = defuse_stdlib()[ET]
+Element = ET_defused.Element
+
 platforms = ['linux', 'win32', 'darwin']
 if not any(pl in sys.platform for pl in platforms):
     sys.exit(f'Unsupported platform: {sys.platform}, expected: linux, win32, darwin')
 
 PACKAGE_NAME = config('WHEEL_PACKAGE_NAME', 'openvino-nvidia')
 OPENVINO_REPO_URI = config('OPENVINO_REPO_DOWNLOAD_URL', 'https://github.com/openvinotoolkit/openvino.git')
-WHEEL_VERSION = config('WHEEL_VERSION', '2022.1.0')
+WHEEL_VERSION = config('WHEEL_VERSION', '2022.3.0')
 OPENVINO_REPO_TAG = config('OPENVINO_REPO_TAG', WHEEL_VERSION)
 NVIDIA_PLUGIN_CMAKE_TARGET_NAME = 'openvino_nvidia_gpu_plugin'
 LIBS_RPATH = '$ORIGIN' if sys.platform == 'linux' else '@loader_path'
 OPENVINO_INSTALL_BUILD_DEPS_SCRIPT = "install_build_dependencies.sh"
-OPENVINO_SETUP_PY_PATH = "inference-engine/ie_bridges/python/wheel/setup.py"
 
 openvino_src_dir: Optional[str] = None
 
@@ -138,10 +147,15 @@ def create_pip_command(*options):
 
 def run_command(command, cwd: str = None, on_fail_msg: str = '', env=None):
     try:
-        subprocess.check_call(command, cwd=cwd, env=env)
+        subprocess.check_call(command, cwd=cwd, env=env) # nosec - disable B603:subprocess_without_shell_equals_true check
     except subprocess.CalledProcessError as e:
         raise RuntimeError(on_fail_msg) from e
 
+def get_command_output(command, cwd: str = None, on_fail_msg: str = '', env=None):
+    try:
+        return subprocess.check_output(command, cwd=cwd, env=env).decode() # nosec - disable B603:subprocess_without_shell_equals_true check
+    except subprocess.CalledProcessError as e:
+        raise RuntimeError(on_fail_msg) from e
 
 class AbsPlatformSpecific(abc.ABC):
     @abc.abstractmethod
@@ -194,7 +208,7 @@ def finalize_options(self):
         self.cmake_exec = shutil.which("cmake")
         self.build_configuration_name = 'Debug' if self.debug else 'Release'
         self.nvidia_plugin_src_dir = os.path.abspath(os.path.dirname(__file__))
-        self.build_lib_dir = os.path.join(self.nvidia_plugin_src_dir, "build/lib")
+        self.build_lib_dir = os.path.join(self.nvidia_plugin_src_dir, "../build/lib")
         self.openvino_contrib_src_dir = os.path.normpath(os.path.join(self.nvidia_plugin_src_dir, "../../.."))
         self.deps_dir = os.path.abspath(os.path.join(self.build_temp, "deps"))
         self.openvino_src_dir = os.path.join(self.deps_dir, "openvino")
@@ -240,8 +254,6 @@ def configure_openvino_cmake(self):
                              f'-DCMAKE_BUILD_TYPE={self.build_configuration_name}',
                              '-DENABLE_PYTHON=ON',
                              f'-DPYTHON_EXECUTABLE={sys.executable}',
-                             '-DNGRAPH_ONNX_IMPORT_ENABLE=ON',
-                             '-DNGRAPH_PYTHON_BUILD_ENABLE=ON',
                              f'-DWHEEL_VERSION={WHEEL_VERSION}',
                              '-DENABLE_WHEEL=ON']
         self.announce("Configuring OpenVINO CMake Project", level=3)
@@ -324,6 +336,7 @@ def locate_built_lib(self):
 class InstallCMakeLib(install_lib):
     def finalize_options(self):
         super().finalize_options()
+        self.git_exec = shutil.which("git")
         self.force = None
         self.set_undefined_options('install', ('force', 'force'))
 
@@ -343,11 +356,17 @@ def run(self):
 
     def install_openvino_package_and_other_dependencies(self):
         if self.force:
-            setup_py_path = os.path.join(openvino_src_dir, OPENVINO_SETUP_PY_PATH)
-            self.announce(f"Installing OpenVINO package with {setup_py_path}", level=3)
-            openvino_install_py = create_setup_py_command(setup_py_path)
+            py_tag=tags.interpreter_name() + tags.interpreter_version()
+            abi_tag=wheel.bdist_wheel.get_abi_tag()
+            platform_tag=next(tags.platform_tags())
+            git_commits=get_command_output([self.git_exec, 'rev-list', '--count', '--first-parent', 'HEAD'],
+                    cwd=openvino_src_dir, on_fail_msg='Failed to count OpenVINO commits').strip()
+            openvino_wheel_name="-".join(["openvino", WHEEL_VERSION, git_commits, py_tag, abi_tag, platform_tag]) + ".whl"
+            wheels_path = os.path.abspath(os.path.join(openvino_src_dir, "build/wheels", openvino_wheel_name))
+            self.announce(f"Installing OpenVINO package with {wheels_path}", level=3)
+            openvino_install_py = create_pip_command(wheels_path)
             run_command(openvino_install_py,
-                        on_fail_msg=f'Failed to install OpenVINO wheel package with {setup_py_path}')
+                        on_fail_msg=f'Failed to install OpenVINO wheel package with {wheels_path}')
 
         path_to_requirements_txt = os.path.join(os.path.abspath(os.path.dirname(__file__)), "requirements.txt")
         requirements_py = create_pip_command('-r', path_to_requirements_txt)
@@ -367,26 +386,28 @@ def register_nvidia_plugin(self):
                                                    f"libopenvino_nvidia_gpu_plugin.{platform_specifics.get_lib_file_extension()}")
 
         xml_file = os.path.join(openvino_package_libs_dir, "plugins.xml")
-        tree = ET.parse(xml_file)
+        tree = ET.parse(xml_file).getroot()
         plugins = tree.find("plugins")
         if all(plugin.get('name') != 'NVIDIA' for plugin in plugins.iter('plugin')):
-            plugins.append(ET.Element('plugin', {'name': 'NVIDIA', 'location': openvino_nvidia_gpu_library}))
-            tree.write(xml_file)
+            plugins.append(Element('plugin', {'name': 'NVIDIA', 'location': openvino_nvidia_gpu_library}))
+            with open(xml_file, "w") as f:
+                f.write(ET.tostring(tree).decode('utf8'))
 
     def unregister_nvidia_plugin(self):
         openvino_package_libs_dir = self.get_openvino_package_dir()
 
         xml_file = os.path.join(openvino_package_libs_dir, "plugins.xml")
-        tree = ET.parse(xml_file)
+        tree = ET.parse(xml_file).getroot()
         plugins = tree.find("plugins")
         for plugin in plugins.iter('plugin'):
             if plugin.get('name') == 'NVIDIA':
                 plugins.remove(plugin)
-                tree.write(xml_file)
+                with open(xml_file, "w") as f:
+                    f.write(ET.tostring(tree).decode('utf8'))
                 break
 
     def test_nvidia_plugin(self):
-        from openvino.inference_engine import IECore
+        from openvino.runtime import Core
         test_model_convert_fp32 = """
             <?xml version="1.0"?>
             <net name="Function_1208" version="10">
@@ -418,10 +439,10 @@ def test_nvidia_plugin(self):
                 </edges>
             </net>
             """.encode('ascii')
-        ie = IECore()
-        net = ie.read_network(model=test_model_convert_fp32, weights=b'', init_from_buffer=True)
+        core = Core()
+        model = core.read_model(model=test_model_convert_fp32)
         try:
-            ie.load_network(network=net, device_name="NVIDIA")
+            core.compile_model(model=model, device_name="NVIDIA")
         except RuntimeError as e:
             recommendations_msg = ''
             if not self.force: