Dependency.to_pep_508() creates invalid PEP508 requirements strings.

• Poetry version: 1.4.2

• Python version: 3.10.9

• OS version and name: macOs 13.3.1

• pyproject.toml: https://gist.github.com/d-tw/f5905245a05332aba77bfbf1601edde3

• I am on the latest stable Poetry version, installed using a recommended method.

• I have searched the issues of this repo and believe that this is not a duplicate.

• I have consulted the FAQ and blog for any relevant entries or release notes.

• If an exception occurs when executing a command, I executed it again in debug mode (-vvv option) and have included the output below.

Issue

I'm writing a script to extract certain parts of the poetry.lock file for dependency analysis. Version strings are stored in the poetry.lock using poetry-specific notation:

[[package]]
name = "google-cloud-core"
version = "2.3.2"
description = "Google Cloud API client core library"
category = "main"
optional = false
python-versions = ">=3.7"
files = [
    {file = "google-cloud-core-2.3.2.tar.gz", hash = "sha256:b9529ee7047fd8d4bf4a2182de619154240df17fbe60ead399078c1ae152af9a"},
    {file = "google_cloud_core-2.3.2-py2.py3-none-any.whl", hash = "sha256:8417acf6466be2fa85123441696c4badda48db314c607cf1e5d543fa8bdc22fe"},
]

[package.dependencies]
google-api-core = ">=1.31.6,<2.0.0 || >2.3.0,<3.0.0dev"
google-auth = ">=1.25.0,<3.0dev"

I'm using the to_pep_508() method on the Dependency instance to try to obtain 508-compliant requirement strings, but in some cases the output is non-compliant.

# Assuming `dep` is <Dependency google-api-core (>=1.31.5,<2.0.0 || >2.3.0,<3.0.0dev)>
dep.to_pep_508() # => Returns 'google-api-core (>=1.31.5,<2.0.0 || >2.3.0,<3.0.0dev)', which is non-compliant

During a quick test, I can reproduce the issue in isolation:

from poetry.core.packages.dependency import Dependency

dep = Dependency.create_from_pep_508('google-api-core >= 1.31.5, <3.0.0dev,!=2.0.*,!=2.1.*,!=2.2.*,!=2.3.0')

dep.to_pep_508() # => Returns 'google-api-core (>=1.31.5,<2.0.0 || >2.3.0,<3.0.0dev)'

Dependency.create_from_pep_508(dep.to_pep_508()) # Raises

I was expecting to be able to round-trip the version string. If this is not a bug, is there a way to retrieve the original version constraint string from the poetry.lock?

Start with poetry.core.packages.dependency.Dependency, especially create_from_pep_508() and to_pep_508(), using the reproducer in the issue. Check how the version constraint is serialized, then verify that the returned string is valid PEP 508 and can be parsed again by create_from_pep_508().