requirements.txt mis-parses lines that contain --hash

[alex]

In a requirements.txt file, a dependency may be written like:

boto3==1.26.121 --hash=sha256:f87d694c351eba1dfd19b5bef5892a1047e7adb09c57c2c00049de209a8ab55d

This specifies both the package version as well as the packages hash. However, Parse mishandles this and generates:

lockfile.PackageDetails{
    Name:"boto3",
    Version:"1.26.121 --hash=sha256:f87d694c351eba1dfd19b5bef5892a1047e7adb09c57c2c00049de209a8ab55d",
    Commit:"",
    Ecosystem:"PyPI",
    CompareAs:"PyPI"
}

Note how Version just contains the remainder of the line, not merely the version portion.

[G-Rath]

ah yup, I missed this section when implementing the parser (also https://pip.pypa.io/en/stable/topics/secure-installs/).

I'd say we just want to split on the first space, and use the first element - @robotdana this could be a good one for you to pick up.