configurations that select an optional dependency from a dependency can poison other configurations

[schveiguy]

System information

DUB version 1.25.0, built on Apr 23 2021
Linux Ubuntu 20.04
DMD64 D Compiler v2.096.1

Bug Description

You can optionally specify a dependency in a configuration. However, if any of your dependencies optionally also can use that dependency, it gets selected. This means that the dependency can infect configurations with dependencies that nobody has selected.

As an example, consider 3 projects, project1, project2, and projectdep. projectdep is the optional dependency selected by project1. It's dub file isn't important.

project1 has the following dub file:

name "project1"
dependency "projectdep" version="*" optional=true

project2 has the following dub file:

name "project2"
dependency "project1" version="8"
targetType "executable"
configuration "withdep" {
	dependency "projectdep" version="*"
}
configuration "nodep" {
}

Expected Behavior

What I would expect is that dub would build WITH projectdep by default, but WITHOUT projectdep when the nodep configuration is selected. Instead, it always builds with projectdep.

What I believe happens is that dub downloads all possible dependencies of all possible configurations (there are numerous bug reports on this). Then the project1 dependency sees that projectdep is in the dub.selections.json, and adds it to the mix, even though nobody else requested it.

This happens even if the nodep configuration is requested on the first build (with no dub.selections.json file yet)

Some interesting behavior:

1. If I generate the dub.selections.json, and then remove the withdep config dependency, it still builds with the dependency.
2. If I instead comment out the optional dependency in project1, THEN it is not built with projectdep even though it's in the selections file.
3. If I comment out the withdep depedency, AND remove dub.selections.json, then it is build without the dependency.

I have attached a tarball with a sample directory structure and simple app that prints "has dep" or "no dep" to signify whether the dependency is included.

dubtest.tar.gz

[Geod24]

I'm pretty sure this is just another symptom of #2023

[Geod24]

#1217 / #1706