pip-compile Annotated requirements.txt
A pip-compile output where every pin carries a `# via` annotation naming the requirement that pulled it in: the only place the transitive graph survives in a pip workflow. Every package, version, hash and licence is fictional: the tree describes nothing real.
# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
# This file is autogenerated by pip-compile with Python 3.12 (fictional run).
# To update, run:
#
# pip-compile --output-file=requirements.txt
example-router==2.1.3
# via -r requirements.in
example-http-core==1.8.0
# via -r requirements.in
example-metrics==4.0.0
# via -r requirements.in
example-cache==0.9.2
# via -r requirements.in
example-crypto-shim==1.2.0
# via -r requirements.in
example-logger==3.4.1
# via
# example-router
# example-http-core
# example-metrics
example-retry==1.0.4
# via example-router
example-json-path==2.0.5
# via
# example-http-core
# example-yaml-lite
example-yaml-lite==1.1.7
# via example-cache
Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- pip-tools
- Requirements
- 9
- Annotations
- # via comments
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Recover the dependency graph from pip-compile's comment annotations.
- Expected result
- Parsing the `# via` blocks yields the same parent/child edges as the JSON dependency graph fixture, including three parents for example-logger.
What is a .txt file?
TXT is a plain-text file containing unformatted character data with no styling or structure beyond line breaks. Its interpretation depends on character encoding, most commonly UTF-8, and on line-ending convention. It is the most universal and portable text container.
How to use this file
Use an example TXT to test encoding detection, line-ending (LF versus CRLF) handling, and any tool that reads or streams raw text input.
How to use this file for testing
“pip-compile Annotated requirements.txt” is a deterministic Testaroo fixture for Config parsing, Graph data, Conversion testing. TOML and INI configuration files with nested sections and typed values, for testing config parsers and loaders.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such, expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented, never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Generated by generation/supply_chain.py. Free for any use, no attribution required, license.
Related files
- spdxSPDX 2.3 SBOM Relationship Graph (Tag-Value)An SPDX tag-value SBOM emphasising its relationship block: one DESCRIBES edge and ten DEPENDS_ON edges that form the same two diamonds as the CycloneDX graph fixture. Every package, version, hash and licence is fictional: the tree describes nothing real.

- lockCargo.lock (version 3, Legacy)The same fictional Rust tree pinned by a version 3 Cargo.lock, for testing that a reader keys on the declared version rather than assuming the newest format. Every package, version, hash and licence is fictional: the tree describes nothing real.

- lockCargo.lock (version 4)A Rust Cargo.lock in the version 4 format: TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional: the tree describes nothing real.

- txtcargo tree OutputCargo's tree output, which writes versions with a leading `v` and marks already-shown subtrees with `(*)`: close enough to npm's tree to fool a parser, different enough to break one. Every package, version, hash and licence is fictional: the tree describes nothing real.

- jsonCycloneDX SBOM With Diamond Dependency GraphA CycloneDX 1.6 SBOM whose dependencies array contains two diamonds: the fictional example-logger is reached through three parents and example-json-path through two, both resolving to a single node. Every package, version, hash and licence is fictional: the tree describes nothing real.

- graphmlDependency Graph (GraphML)The dependency graph in GraphML, with typed attribute keys for node version, licence and depth and for edge range: the interchange format graph databases and analysis tools import. Every package, version, hash and licence is fictional: the tree describes nothing real.
