Cog malformed requirements.txt

[dsinha244]

Following is my requirements.txt file

requirements.txt

This is my cog file

build:
  system_packages:
    - "libgl1-mesa-glx"
    - "libglib2.0-0"
    - wget
  python_version: "3.10"
  python_requirements: "lib/requirements.txt"
  run:
    - wget -q https://storage.googleapis.com/labelbox-assets/clip_market1501.pt
    - python -c 'from boxmot import DeepOCSORT;from pathlib import Path;DeepOCSORT(model_weights=Path("clip_market1501.pt"), device="cpu", fp16=False)'
predict: "aws_rekognition.py:AWSRekognition"

When i run cog build it is erroring out with the following message

9.21 ERROR: Could not find a version that satisfies the requirement ython_version<"3.13" (from versions: none)
19.21 ERROR: No matching distribution found for ython_version<"3.13"
19.23 
19.23 [notice] A new release of pip is available: 23.0.1 -> 25.0.1
19.23 [notice] To update, run: pip install --upgrade pip

Upon further inspection when i check the requirements.txt file in .cog/tmp/build.****. I see a malformed requirements.txt as follows

--extra-index-url https://download.pytorch.org/whl/cpu
annotated-types==0.7.0
anyio==4.8.0
asttokens==2.4.1
attrs==22.2.0
backports-tarfile==1.2.0
beautifulsoup4==4.13.3
build==1.2.2.post1
cachecontrol==0.14.2
cachetools==5.5.2
certifi==2025.1.31
cffi==1.17.1
charset-normalizer==3.4.1
cleo==2.1.0
click==8.1.8
cog==0.14.7
colorama==0.4.6
crashtest==0.4.1
cryptography==43.0.3
decorator==5.2.1
deepmerge==1.1.1
devtools==0.12.2
distlib==0.3.9
distro==1.9.0
dulwich==0.22.8
exceptiongroup==1.2.2
executing==2.2.0
fastapi==0.115.11
fastjsonschema==2.21.1
filelock==3.18.0
findpython==0.6.3
google-api-core==1.34.1
google-auth==2.38.0
google-cloud-secret-manager==2.16.4
google-crc32c==1.6.0
googleapis-common-protos==1.69.0
grpc-google-iam-v1==0.14.1
grpcio-status==1.48.2
grpcio==1.70.0
h11==0.14.0
httpcore==1.0.7
httptools==0.6.4
httpx==0.28.1
idna==3.10
importlib-metadata==8.6.1
iniconfig==2.0.0
installer==0.7.0
jaraco-classes==3.4.0
jaraco-context==6.0.1
jaraco-functools==4.1.0
jeepney==0.9.0
jiter==0.8.2
keyring==25.6.0
levenshtein==0.24.0
ython_version < "3.13"
more-itertools==10.6.0
msgpack==1.1.0
numpy==1.26.4
openai==1.65.4
packaging==24.2
pbs-installer==2025.4.9
pillow==11.1.0
pkginfo==1.12.1.2
platformdirs==4.3.7
pluggy==1.5.0
poetry-core==2.1.2
poetry-plugin-export==1.9.0
poetry==2.1.2
proto-plus==1.26.0
protobuf==3.20.3
py==1.11.0
pyasn1-modules==0.4.1
pyasn1==0.6.1
pycparser==2.22
pydantic-core==2.27.2
pydantic==2.10.6
pygments==2.19.1
pypdf==4.3.1
pyproject-hooks==1.2.0
pytest==7.4.4
python-dotenv==1.0.1
python-levenshtein==0.24.0
pywin32-ctypes==0.2.3
pyyaml==6.0.2
rapidfuzz==3.12.2
regex==2024.11.6
requests-toolbelt==1.0.0
requests==2.32.3
retry==0.9.2
rsa==4.9
secretstorage==3.3.3
shellingham==1.5.4
six==1.17.0
sniffio==1.3.1
soupsieve==2.6
starlette==0.46.0
structlog==24.4.0
tiktoken==0.7.0
tomli==2.2.1
tomlkit==0.13.2
tqdm==4.67.1
trove-classifiers==2025.3.19.19
typing-extensions==4.12.2
urllib3==1.26.20
uvicorn==0.34.0
uvloop==0.21.0
virtualenv==20.30.0
watchfiles==1.0.4
version < "3.13"
websockets==15.0
xattr==1.1.4
zipp==3.21.0
zstandard==0.23.0
boto3==1.33.12
torch==2.2.1
numpy==1.26.4
boxmot==10.0.79
opencv-python==4.7.0.72

Notice the malformed ython_version < "3.13" and version < "3.13" lines in the file. Using cog cli (0.14.7). Anyone has any idea what is going on?

[bzikst]

I have simular problem, but in my case some lines of generated requirements.txt are broken into two lines in a random position.

Original lines in a middle of requirements.txt:

...
requests==2.32.3
resampy==0.4.3
rich==14.0.0
rotary-embedding-torch==0.6.5
ruamel-yaml-clib==0.2.12
ruamel-yaml==0.18.10
...

Generated lines (as I can see using --debug flag)

...
requests==2.32.3
resampy==0.4.3
rich==14.0.0
rota
ry-embedding-torch==0.6.5
ruamel-yaml-clib==0.2.12
ruamel-yaml==0.18.10
...

If I add four spaces after rich==14.0.0 line it works. Looks like some string/regex manipulations are incorrect maybe.

[danfairs]

I have a similar issue. It's pretty wild. I have output like this (truncated, because it's massive):

Generated requirements.txt:
--extra-index-url https://download.pytorch.org/whl/cu124
antlr4-python3-runtime==4.9.3
colorama==0.4.6
contourpy==1.3.2
0f6db315fa4d70f1d8ab514e527f0366ec021ff853d7ed6a2d33605cf4b83     --hash=sha256:f26b383144cf2d2c29f01a1e8170f50dacf0eac02d64139dcd709a8ac4eb3cfe
cycler==0.12.1
filelock==3.18.0
fonttools==4.57.0
fsspec==2025.3.2
hydra-core==1.3.2
iopath==0.1.10
jinja2==3.1.6
kiwisolver==1.4.8
1fc9a09     --hash=sha256:23454ff084b07ac54ca8be535f4174170c1094a4cff78fbae4f73a4bcc0d4dab     --hash=sha256:23d5f023bdc8c7e54eb65f03ca5d5bb25b601eac4d7f1a042888a1f45237987e     --hash=sha256:257af1622860e51b1a9d0ce387bf5c2c4f36a90594cb9514f55b074bcc787cfc     --hash=sha256:291331973c64bb9cce50bbe871fb2e675c4331dab4f31abe89f175ad7679a4d7     --hash=sha256:2f0121b07b356a22fb0414cec4666bbe36fd6d0d759db3d37228f496ed67c880     --hash=sha256:3452046c37c7692bd52b0e752b87954ef86ee2224e624ef7ce6cb21e8c41cc1b     --hash=sha256:34d142fba9c464bc3bbfeff15c96eab0e7310343d6aefb62a79d51421fcc5f1b     --hash=sha256:36dbbfd34838500a31f52c9786990d00150860e46cd5041386f217101350f0d3     --hash=sha256:370fd2df41660ed4e26b8c9d6bbcad668fbe2560462cba151a721d49e5b6628c     --hash=sha256:3a96c0e790ee875d65e340ab383700e2b4891677b7fcd30a699146f9384a2bb0     --hash=sha256:3b9b4d2892fefc886f30301cdd80debd8bb01ecdf165a449eb6e78f79f0fabd6     --hash=sha256:3cd3bc628b25f74aedc6d374d5babf0166a92ff1317f46267f12d2ed54bc1d30     --hash=sha256:3ddc373e0eef45b59197de815b1b28ef89ae3955e7722cc9710fb91cd77b7f47     --hash=sha256:54a62808ac74b5e55a04a408cda6156f986cefbcf0ada13572696b507cc92fa1     --hash=sha256:577facaa411c10421314598b50413aa1ebcf5126f704f1e5d72d7e4e9f020d90     --hash=sha256:68269e60ee4929893aad82666821aaacbd455284124817af45c11e50a4b42e3c     --hash=sha256:69b5637c3f316cab1ec1c9a12b8c5f4750a4c4b71af9157645bf32830e39c03a     --hash=sha256:7506488470f41169b86d8c9aeff587293f530a23a23a49d6bc64dab66bedc71e     --hash=sha256:768cade2c2df13db52475bd28d3a3fac8c9eff04b0e9e2fda0f3760f20b3f7fc     --hash=sha256:77e6f57a20b9bd4e1e2cedda4d0b986ebd0216236f0106e55c28aea3d3d69b16     --hash=sha256:782bb86f245ec18009890e7cb8d13a5ef54dcf2ebe18ed65f795e635a96a1c6a     --hash=sha256:7a3ad337add5148cf51ce0b55642dc551c0b9d6248458a757f98796ca7348712     --hash=sha256:7e9a60b50fe8b2ec6f448fe8d81b07e40141bfced7f896309df271a0b92f80f3     --hash=sha256:84a2f830d42707de1d191b9490ac186bf7997a9495d4e9072210a1296345f7dc     --hash=sha256:856b269c4d28a5c0d5e6c1955ec36ebfd1651ac00e1ce0afa3e28da95293b561     --hash=sha256:858416b7fb777a53f0c59ca08190ce24e9abbd3cffa18886a5781b8e3e26f65d     --hash=sha256:87b287251ad6488e95b4f0b4a79a6d04d3ea35fde6340eb38fbd1ca9cd35bbbc     --hash=sha256:893f5525bb92d3d735878ec00f781b2de998333659507d29ea4466208df37bed     --hash=sha256:918139571133f366e8362fa4a297aeba86c7816b7ecf0bc79168080e2bd79957     --hash=sha256:99cea8b9dd34ff80c521aef46a1dddb0dcc0283cf18bde6d756f1e6f31772165     --hash=sha256:a17b7c4f5b2c51bb68ed379defd608a03954a1845dfed7cc0117f1cc8a9b7fd2     --hash=sha256:a3c44cb68861de93f0c4a8175fbaa691f0aa22550c331fefef02b618a9dcb476     --hash=sha256:a4d3601908c560bdf880f07d94f31d734afd1bb71e96585cace0e38ef44c6d84     --hash=sha256:a5ce1e481a74b44dd5e92ff03ea0cb371ae7a0268318e202be06c8f04f4f1246     --hash=sha256:a66f60f8d0c87ab7f59b6fb80e642ebb29fec354a4dfad687ca4092ae69d04f4     --hash=sha256:b21dbe165081142b1232a240fc6383fd32cdd877ca6cc89eab93e5f5883e1c25     --hash=sha256:b47a465040146981dc9db8647981b8cb96366fbc8d452b031e4f8fdffec3f26d     --hash=sha256:b83dc6769ddbc57613280118fb4ce3cd08899cc3369f7d0e0fab518a7cf37fdb     --hash=sha256:bade438f86e21d91e0cf5dd7c0ed00cda0f77c8c1616bd83f9fc157fa6760d31     --hash=sha256:be4816dc51c8a471749d664161b434912eee82f2ea66bd7628bd14583a833e85     --hash=sha256:c2b9a96e0f326205af81a15718a9073328df1173a2619a68553decb7097fd5d7     --hash=sha256:c5020c83e8553f770cb3b5fc13faac40f17e0b205bd237aebd21d53d733adb03     --hash=sha256:cc978a80a0db3a66d25767b03688f1147a69e6237175c0f4ffffaaedf744055a     --hash=sha256:d47cfb2650f0e103d4bf68b0b5804c68da97272c84bb12850d877a95c056bd67     --hash=sha256:d6af5e8815fd02997cb6ad9bbed0ee1e60014438ee1a5c2444c96f87b8843502     --hash=sha256:d6d6bd87df62c27d4185de7c511c6248040afae67028a8a22012b010bc7ad062     --hash=sha256:dace81d28c787956bfbfbbfd72fdcef014f37d9b48830829e488fdb32b49d954     --hash=sha256:e063ef9f89885a1d68dd8b2e18f5ead48653176d10a0e324e3b0030e3a69adeb     --
hash=sha256:eaa973f1e05131de5ff3569bbba7f5fd07ea0595d3870ed4a526d486fe57fa1b     --hash=sha256:ed33ca2002a779a2e20eeb06aea7721b6e47f2d4b8a8ece979d8ba9e2a167e34     --hash=sha256:fc2ace710ba7c1dfd1a3b42530b62b9ceed115f19a1656adefce7b1782a37794
markupsafe==3.0.2
matplotlib==3.10.1

My requirements.txt file is in the following form:

# This file was autogenerated by uv via the following command:
#    uv export --format=requirements-txt
antlr4-python3-runtime==4.9.3 \
    --hash=sha256:f224469b4168294902bb1efa80a8bf7855f24c99aef99cbefc1bcd3cce77881b
colorama==0.4.6 ; sys_platform == 'win32' \
    --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
    --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
contourpy==1.3.2 \
    --hash=sha256:0475b1f6604896bc7c53bb070e355e9321e1bc0d381735421a2d2068ec56531f \
    --hash=sha256:106fab697af11456fcba3e352ad50effe493a90f893fca6c2ca5c033820cea92 \
    --hash=sha256:15ce6ab60957ca74cff444fe66d9045c1fd3e92c8936894ebd1f3eef2fff075f \
    --hash=sha256:1c48188778d4d2f3d48e4643fb15d8608b1d01e4b4d6b0548d9b336c28fc9b6f \
    --hash=sha256:3859783aefa2b8355697f16642695a5b9792e7a46ab86da1118a4a23a51a33d7 \
    --hash=sha256:3d80b2c0300583228ac98d0a927a1ba6a2ba6b8a742463c564f1d419ee5b211e \
    --hash=sha256:3f9e896f447c5c8618f1edb2bafa9a4030f22a575ec418ad70611450720b5b08 \
... etc ...

As you can tell from the top, I have a step where requirements.txt is generated from our "real" dependencies in the uv.lock file.

Using cog version 0.14.7 (built 2025-04-21T19:03:21Z) on macOS.

[danfairs]

I believe I have found an issue in the code that scans the requirements.txt file. In my case, it's triggered by a very long line (with continuations) in requirements.txt. I'll see if I can get a PR together with a fix.

[danfairs]

@dsinha244 @bzikst I've prepared a PR in #2281 - give it a try and let me know how you get on. I don't know for sure that you were having the exact same problem as me, but I'm pretty sure this bug could break requirements files.

[bzikst]

@danfairs, sorry for a late reply. In version v0.14.8 with your PR merged is all okay now. Thanks you!

[danfairs]

@danfairs, sorry for a late reply. In version v0.14.8 with your PR merged is all okay now. Thanks you!

Great, thanks. Does that mean this issue can be closed?

[bzikst]

Great, thanks. Does that mean this issue can be closed?

From my side — absolutely yes. But I'm not the original issue creator. Hey @dsinha244 can you have a look?