From c31dfb4bbff8ddd976e980e48780ab2dd9b56d93 Mon Sep 17 00:00:00 2001
From: Jan Lindemann <jan@janware.com>
Date: Fri, 11 Sep 2026 10:48:21 +0200
Subject: [PATCH] lib.version.Dependency: Reject unsupported spec operators

The spec split pattern ([=><]+) tokenizes only the =, > and < characters,
so a PEP 440 operator like ~= or != leaves its ~ or ! glued to the package
name: Dependency('pkg~=1.0') parses to base name 'pkg~' with operator '='.
App.__get_project_refs() carries the same pattern inline, so the same specs
corrupt the module name used for the -devel subpackage check. The split
also tolerates operator strings the language does not support, most visibly
==, which parses and renders but raises NotImplementedError only when
expansion is requested.

The spec language supports exactly =, <, <=, > and >=, and boundary
expansion implements all of them. Extend the split pattern with ~ and ! so
that foreign operators tokenize as operator strings, and reject every
operator outside the supported set in Dependency.__parsed_spec() with
Dependency.Error, naming the supported operators. Route
App.__get_project_refs() through Dependency for the name and module parts
instead of the second inline split, so the validation lives in one place.
The catch all in Dependency.__version_boundaries() stays as a backstop
against drift between the allow list and the expansion cases.

The tests drop == from the accepted operator loop, drop the now-unreachable
not-expandable case, and assert that ~=, !=, ~, ==, ===, << and >> are
rejected at parse time with a message naming the operator.

Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v0.85.1
Signed-off-by: Jan Lindemann <jan@janware.com>
---
 src/python/jw/pkg/App.py                    |  5 ++--
 src/python/jw/pkg/lib/version/Dependency.py |  8 +++++-
 test/unit/python/jw/pkg/lib/version/test.py | 30 ++++++++++++++-------
 3 files changed, 31 insertions(+), 12 deletions(-)

diff --git a/src/python/jw/pkg/App.py b/src/python/jw/pkg/App.py
index af9b9311..32a4db97 100644
--- a/src/python/jw/pkg/App.py
+++ b/src/python/jw/pkg/App.py
@@ -209,8 +209,9 @@ class App(Base):
         scope: Scope,
         names_only: bool,
     ) -> None:
-        name = self.strip_module_from_spec(spec)
-        mod = re.split('([=><]+)', spec)[0].strip()
+        dep = Dependency(spec)
+        name = dep.base_name
+        mod = dep.full_name
         if names_only:
             spec = name
         if spec in buf:
diff --git a/src/python/jw/pkg/lib/version/Dependency.py b/src/python/jw/pkg/lib/version/Dependency.py
index 8ed8ee3b..01c710c8 100644
--- a/src/python/jw/pkg/lib/version/Dependency.py
+++ b/src/python/jw/pkg/lib/version/Dependency.py
@@ -22,7 +22,7 @@ class Dependency:  # export
     class Error(ValueError):
         pass
 
-    __SPLIT_RE: ClassVar[re.Pattern[str]] = re.compile('([=><]+)')
+    __SPLIT_RE: ClassVar[re.Pattern[str]] = re.compile('([~=><!]+)')
 
     @property
     def __target_prefix(self) -> str:
@@ -45,6 +45,12 @@ class Dependency:  # export
             case 3:
                 if not parts[0] or not parts[2]:
                     self.__raise(f'Invalid dependency spec "{self.__spec}"')
+                if parts[1] not in ('=', '<', '<=', '>', '>='):
+                    self.__raise(
+                        f'Spec "{self.__spec}": unsupported operator '
+                        f'"{parts[1]}", supported operators are =, <, '
+                        '<=, > and >='
+                    )
                 if parts[2] == 'REVISION':
                     self.__raise(
                         f'Spec "{self.__spec}": a bare REVISION renders as a '
diff --git a/test/unit/python/jw/pkg/lib/version/test.py b/test/unit/python/jw/pkg/lib/version/test.py
index 91783ae3..07817f87 100644
--- a/test/unit/python/jw/pkg/lib/version/test.py
+++ b/test/unit/python/jw/pkg/lib/version/test.py
@@ -40,7 +40,7 @@ assert d.base_name == 'dev'
 assert d.full_name == 'dev'
 
 # Operators with and without whitespace
-for op in ['=', '==', '<', '<=', '>', '>=']:
+for op in ['=', '<', '<=', '>', '>=']:
     d = Dependency(f'foo {op} 1.0')
     assert d.base_name == 'foo'
     assert d.full_name == 'foo'
@@ -135,14 +135,6 @@ d = Dependency('foo = 1.2.3', app.get_version)
 assert d.constraint_str(as_range = True) == 'foo = 1.2.3'
 d = Dependency('foo = 1.0-rc1', app.get_version)
 assert d.constraint_str(as_range = True) == 'foo = 1.0-rc1'
-# unimplemented operators raise
-d = Dependency('foo == 1.2.3-45', app.get_version)
-try:
-    d.constraint_str(as_range = True)
-    assert False, 'Should have raised'
-except NotImplementedError:
-    pass
-
 # Default syntax is SEM_VER
 d = Dependency('foo < 2.0')
 assert d.constraint_str(untemplated = False) == 'foo < 2.0'
@@ -238,6 +230,26 @@ for bad in ['', 'foo =', ' = 1.0']:
     except Dependency.Error:
         pass
 
+# Operators outside the supported set are rejected when parsed,
+# not folded into the package name or deferred to expansion
+for bad in [
+    'foo ~= 1.0',
+    'foo~=1.0',
+    'foo ~ 1.0',
+    'foo != 1.0',
+    'foo!=1.0',
+    'foo == 1.0',
+    'foo==1.0',
+    'foo === 1.0',
+    'foo << 1.0',
+    'foo >> 1.0',
+]:
+    try:
+        Dependency(bad).full_name
+        assert False, f'Should have raised for {bad!r}'
+    except Dependency.Error as e:
+        assert 'unsupported operator' in str(e)
+
 # str
 assert str(Dependency('foo-devel >= 1.0')) == 'foo-devel >= 1.0'
 assert str(Dependency('foo')) == 'foo'