audit: detect self-referential depends_on (spack#42456)

lib/spack/spack/audit.py

@@ -796,10 +796,30 @@ def check_virtual_with_variants(spec, msg):
                 except spack.repo.UnknownPackageError:
                     # This dependency is completely missing, so report
                     # and continue the analysis
+                    summary = f"{pkg_name}: unknown package '{dep_name}' in 'depends_on' directive"
+                    details = [f" in {filename}"]
+                    errors.append(error_cls(summary=summary, details=details))
+                    continue
+
+                # Check for self-referential specs similar to:
+                #
+                # depends_on("foo@X.Y", when="^foo+bar")
+                #
+                # That would allow clingo to choose whether to have foo@X.Y+bar in the graph.
+                problematic_edges = [
+                    x for x in when.edges_to_dependencies(dep_name) if not x.virtuals
+                ]
+                if problematic_edges and not dep.patches:
                     summary = (
-                        f"{pkg_name}: unknown package '{dep_name}' in " "'depends_on' directive"
+                        f"{pkg_name}: dependency on '{dep.spec}' when '{when}' is self-referential"
                     )
-                    details = [f" in {filename}"]
+                    details = [
+                        (
+                            f" please specify better using '^[virtuals=...] {dep_name}', or "
+                            f"substitute with an equivalent condition on '{pkg_name}'"
+                        ),
+                        f" in {filename}",
+                    ]
                     errors.append(error_cls(summary=summary, details=details))
                     continue