Validate run_constrained specs (#5359)

* Validate run_constrained items

* add news

conda_build/metadata.py

@@ -480,6 +480,24 @@ def _check_circular_dependencies(
         raise exceptions.RecipeError(error)
 
 
+def _check_run_constrained(metadata_tuples):
+    errors = []
+    for _, metadata in metadata_tuples:
+        for dep in _get_all_dependencies(metadata, envs=("run_constrained",)):
+            if "{{" in dep:
+                # skip Jinja content; it might have not been rendered yet; we'll get it next call
+                continue
+            try:
+                MatchSpec(dep)
+            except ValueError as exc:
+                errors.append(
+                    f"- Output '{metadata.name()}' has invalid run_constrained item: {dep}. "
+                    f"Reason: {exc}"
+                )
+    if errors:
+        raise exceptions.RecipeError("\n".join(["", *errors]))
+
+
 def _variants_equal(metadata, output_metadata):
     match = True
     for key, val in metadata.config.variant.items():
@@ -2755,6 +2773,7 @@ def get_output_metadata_set(
                 m.final = True
                 final_conda_packages.append((out_d, m))
             output_tuples = final_conda_packages + non_conda_packages
+        _check_run_constrained(output_tuples)
         return output_tuples
 
     def get_loop_vars(self):

news/5359-validate-run-constrained

@@ -0,0 +1,19 @@
+### Enhancements
+
+* Validate `run_constrained` dependencies to prevent faulty specs reaching final repodata. (#5047 via #5359)
+
+### Bug fixes
+
+* <news item>
+
+### Deprecations
+
+* <news item>
+
+### Docs
+
+* <news item>
+
+### Other
+
+* <news item>

tests/test-recipes/metadata/_run_constrained_error/meta.yaml

@@ -0,0 +1,10 @@
+package:
+  name: test_run_constrained_error
+  version: 1.0
+
+requirements:
+  run_constrained:
+    # obtained from https://github.com/conda-forge/willow-feedstock/blob/67d9ac1c5232295ccaac41b131e3982a335b365b/recipe/meta.yaml#L29
+    - pillow-heif  >=0.10.0,<1.0.0<py312|>=0.13.0,<1.0.0>=py312
+    - {{ 'another-package' }} {{ '>=0.20.0,<2.0.0<py310|>=0.23.0,<2.0.0>=py310' }}
+

tests/test_api_build.py

@@ -41,6 +41,7 @@
     DependencyNeedsBuildingError,
     OverDependingError,
     OverLinkingError,
+    RecipeError,
 )
 from conda_build.os_utils.external import find_executable
 from conda_build.render import finalize_metadata
@@ -1464,6 +1465,12 @@ def test_run_constrained_stores_constrains_info(testing_config):
     assert info_contents["constrains"][0] == "bzip2  1.*"
 
 
+def test_run_constrained_is_validated(testing_config: Config):
+    recipe = os.path.join(metadata_dir, "_run_constrained_error")
+    with pytest.raises(RecipeError):
+        api.build(recipe, config=testing_config)
+
+
 @pytest.mark.sanity
 def test_no_locking(testing_config):
     recipe = os.path.join(metadata_dir, "source_git_jinja2")