Even without changing one byte of the actual binary they could get pretty far by just evicting all the test files for those packages they're including. And, related to that, it seems that dist-info/RECORD ends up at 1,050,544 because the onnx folks decided it was important that they cryptographically sign all those test data files they're choosing to ship :-/