generate-requirements.sh

#!/bin/bash -e

if [ -z $1 ]; then
  echo "Must specify a python requirement"
  exit 1
fi

curdir=$(pwd)
dir=$(mktemp -d)
output="${curdir}/requirements.txt"
(
  cd $dir
  pip download "$1"
  (
    echo "# Dependencies for $1"
    for f in $(find . -name '*.whl' -o -name '*.gz'); do
      dep=$(basename $(echo $f | cut -d - -f 1))
      ver=$(echo $f | cut -d - -f 2)
      echo "$dep==${ver%.tar.gz} --hash=sha256:$(sha256sum $f | cut -d ' ' -f 1)"
    done | sort
  ) | tee $output
)
echo "
Work dir: $dir
Generated $output"

sample-output.txt

$ ./generate-requirements.sh pylons==1.0.2

# Dependencies for pylons
Beaker==1.8.0 --hash=sha256:740165bb2d86b17460ea759ae075d82b52313860357393675d765bbf67b5c3fb
beautifulsoup4==4.5.1 --hash=sha256:bb3dba571c2f7ddcaf3e70ad8b67878a85ac41889dcba75a30b8f7b0b5960b6d
decorator==4.0.10 --hash=sha256:5aff536ed9a65c99e8465c774d5859e56e52300aea0a5012c7a1c4a781fbdddb
FormEncode==1.3.1 --hash=sha256:ada2f51792b1b484e5bb7b6cc14acfc1bc11fafc967cf015cd57e856053ca7f6
funcsigs==1.0.2 --hash=sha256:330cc27ccbf7f1e992e69fef78261dc7c6569012cf397db8d3de0234e6c937ca
Mako==1.0.4 --hash=sha256:fed99dbe4d0ddb27a33ee4910d8708aca9ef1fe854e668387a9ab9a90cbf9059
MarkupSafe==0.23 --hash=sha256:a4ec1aff59b95a14b45eb2e23761a0179e98319da5a7eb76b56ea8cdc7b871c3
nose==1.3.7 --hash=sha256:dadcddc0aefbf99eea214e0f1232b94f2fa9bd98fa8353711dacb112bfcbbb2a
Paste==2.0.3 --hash=sha256:9d17d06cd95d700acb7be449a02c13db28449de2adaf0f45339f4a310601f096
PasteDeploy==1.5.2 --hash=sha256:39973e73f391335fac8bc8a8a95f7d34a9f42e2775600ce2dc518d93b37
PasteScript==2.0.2 --hash=sha256:6533bb357d44fd8e0b10abf2775e8089252dd3ed58eba56d9c07e43
Pygments==2.1.3 --hash=sha256:485602129949b14247e8b124d28af4654dffbd076537c4a9c44a
Pylons==1.0.2 --hash=sha256:918fd04b8bdb9515ebb8ccbb981df43276aeaf865a0d4
repoze.lru==0.6 --hash=sha256:0f7a323bf716d3cb6cb3910cd4fccbee0b3d3793322
Routes==2.3.1 --hash=sha256:98c380b5dc1190b873463be07383728ada18f66d26155
simplejson==3.8.2 --hash=sha256:d58439c548433adcda98e695be53e526ba940a4b9
six==1.10.0 --hash=sha256:0ff78c403d9bccf5a425a6d31a12aa6b47f1c21ca4dc257
Tempita==0.5.2 --hash=sha256:cacecf0baa674d356641f1d406b8bff1d756d739c46b
waitress==1.0.0 --hash=sha256:e27afdce0d4dc76d0f7cb515cbe7f87dc04a79e9797
WebError==0.13.1 --hash=sha256:20c0533041deda47291314ddb2a64ed580cfc453ea
WebHelpers==1.3 --hash=sha256:ea86f284e929366b77424ba9a89341f43ae8dee3cbe
WebOb==1.6.1 --hash=sha256:509ce06406bd9c63fc6fba4ea5e96d17f6080f126d6303
WebTest==2.0.23 --hash=sha256:0831371d415fac39177d1fab4e180510713401a71ed