pip-compile Annotated requirements.txt
A pip-compile output where every pin carries a `# via` annotation naming the requirement that pulled it in — the only place the transitive graph survives in a pip workflow. Every package, version, hash and licence is fictional — the tree describes nothing real.
# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
# This file is autogenerated by pip-compile with Python 3.12 (fictional run).
# To update, run:
#
# pip-compile --output-file=requirements.txt
example-router==2.1.3
# via -r requirements.in
example-http-core==1.8.0
# via -r requirements.in
example-metrics==4.0.0
# via -r requirements.in
example-cache==0.9.2
# via -r requirements.in
example-crypto-shim==1.2.0
# via -r requirements.in
example-logger==3.4.1
# via
# example-router
# example-http-core
# example-metrics
example-retry==1.0.4
# via example-router
example-json-path==2.0.5
# via
# example-http-core
# example-yaml-lite
example-yaml-lite==1.1.7
# via example-cache
Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- pip-tools
- Requirements
- 9
- Annotations
- # via comments
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Recover the dependency graph from pip-compile's comment annotations.
- Expected result
- Parsing the `# via` blocks yields the same parent/child edges as the JSON dependency graph fixture, including three parents for example-logger.
What is a .txt file?
TXT is a plain-text file containing unformatted character data with no styling or structure beyond line breaks. Its interpretation depends on character encoding, most commonly UTF-8, and on line-ending convention. It is the most universal and portable text container.
How to use this file
Use an example TXT to test encoding detection, line-ending (LF versus CRLF) handling, and any tool that reads or streams raw text input.
How to use this file for testing
“pip-compile Annotated requirements.txt” is a deterministic Novus Examples fixture for Config parsing, Graph data, Conversion testing. TOML and INI configuration files with nested sections and typed values — for testing config parsers and loaders.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Related files
- spdxSPDX 2.3 SBOM Relationship Graph (Tag-Value)An SPDX tag-value SBOM emphasising its relationship block: one DESCRIBES edge and ten DEPENDS_ON edges that form the same two diamonds as the CycloneDX graph fixture. Every package, version, hash and licence is fictional — the tree describes nothing real.

- lockCargo.lock (version 3, Legacy)The same fictional Rust tree pinned by a version 3 Cargo.lock, for testing that a reader keys on the declared version rather than assuming the newest format. Every package, version, hash and licence is fictional — the tree describes nothing real.

- lockCargo.lock (version 4)A Rust Cargo.lock in the version 4 format — TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional — the tree describes nothing real.

- txtcargo tree OutputCargo's tree output, which writes versions with a leading `v` and marks already-shown subtrees with `(*)` — close enough to npm's tree to fool a parser, different enough to break one. Every package, version, hash and licence is fictional — the tree describes nothing real.

- jsonCycloneDX SBOM With Diamond Dependency GraphA CycloneDX 1.6 SBOM whose dependencies array contains two diamonds: the fictional example-logger is reached through three parents and example-json-path through two, both resolving to a single node. Every package, version, hash and licence is fictional — the tree describes nothing real.

- graphmlDependency Graph (GraphML)The dependency graph in GraphML, with typed attribute keys for node version, licence and depth and for edge range — the interchange format graph databases and analysis tools import. Every package, version, hash and licence is fictional — the tree describes nothing real.

Generated by generation/supply_chain.py. Free for any use, no attribution required — license.