Add tag limit and glob format

Use [wax] to validate globs. Since it checks for both `.` and `..`
components, disallow both for paths and globs, except at the start of an
expression.  May or may not switch away from wax in the future, since
its syntax is somewhat different from gitignore. For now, though, the
RFC has been [updated] to reflect this change.

Also limit the number of tags to 32, also reflecting a recent RFC
change.

  [wax]: https://crates.io/crates/wax
  [updated]: pgxn/rfcs@4021dee

Author: theory

CHANGELOG.md

@@ -7,8 +7,22 @@ All notable changes to this project will be documented in this file. It uses the
   [Semantic Versioning]: https://semver.org/spec/v2.0.0.html
     "Semantic Versioning 2.0.0"
 
+## [v0.6.1] — Unreleased
+
 ## [v0.6.0] — 2025-03-25
 
+### ⚡ Improvements
+
+*   Added a limit to the number of tags in the v2 schema to 32.
+*   Added glob format and validation using [wax].
+*   Disallow parent directory components (`..`) in globs (already disallowed
+    in paths)
+*   Disallow current directory components (`.`) in paths and globs except at
+    the start of the expression (e.g., `./README`).
+
+  [v0.6.1]: https://github.com/pgxn/meta/compare/v0.6.0...v0.6.1
+  [wax]: https://crates.io/crates/wax
+
 ### ⬆️ Dependency Updates
 
 *   Upgraded all dependencies.

schema/v2/glob.schema.json

@@ -5,7 +5,7 @@
   "description": "*Glob* defines a pattern to identify one or more files in the distribution.",
   "type": "string",
   "minLength": 2,
-  "format": "",
+  "format": "glob",
   "pattern": "^(?:[^\\\\]|\\\\\\\\)+$",
   "$comment": "https://regex101.com/r/d49AVj; Crates: fast-glob or wax",
   "examples": ["/.git", "src/private.c", "doc/*.html"]

schema/v2/tags.schema.json

@@ -5,6 +5,7 @@
   "description": "A list of keywords that describe the distribution.",
   "type": "array",
   "minItems": 1,
+  "maxItems": 32,
   "uniqueItems": true,
   "items": {
     "title": "Tag",

src/tests/common.rs

@@ -200,6 +200,14 @@ pub fn test_tags_schema(mut compiler: Compiler, version: u8) -> Result<(), Error
         }
     }
 
+    if version > 1 {
+        let strings: [String; 33] = core::array::from_fn(|i| format!("string {i}"));
+        let val = serde_json::to_value(&strings[..]).unwrap();
+        if schemas.validate(&val, idx).is_ok() {
+            panic!("too many tags unexpectedly passed!")
+        }
+    }
+
     Ok(())
 }
 

src/tests/v2.rs

@@ -76,6 +76,7 @@ fn test_v2_glob() -> Result<(), Error> {
         json!("foo.?tml"),
         json!("[xX]_*.*"),
         json!("[a-z]*.txt"),
+        json!("**/*.(?i){jpg,jpeg,png}"),
         json!("this\\\\and\\\\that.txt"),
     ] {
         if let Err(e) = schemas.validate(&valid, idx) {
@@ -86,6 +87,8 @@ fn test_v2_glob() -> Result<(), Error> {
     // Test invalid globs.
     for invalid in [
         json!("this\\and\\that.txt"),
+        json!("/src/../pair.c"),
+        json!("../outside/path"),
         json!(null),
         json!(""),
         json!("C:\\foo"),

src/valid/compiler/mod.rs

@@ -27,14 +27,18 @@ pub fn new() -> Compiler {
 }
 
 /// Creates a new boon::compiler with format assertions enabled and validation
-/// for the custom `path` and `license` formats.
+/// for the custom `path`, `glob`, and `license` formats.
 pub fn spec_compiler() -> Compiler {
     let mut compiler = Compiler::new();
     compiler.enable_format_assertions();
     compiler.register_format(boon::Format {
         name: "path",
         func: is_path,
     });
+    compiler.register_format(boon::Format {
+        name: "glob",
+        func: is_glob,
+    });
     compiler.register_format(boon::Format {
         name: "license",
         func: is_license,
@@ -46,11 +50,25 @@ pub fn spec_compiler() -> Compiler {
 fn is_path(v: &Value) -> Result<(), Box<dyn std::error::Error>> {
     let Value::String(s) = v else { return Ok(()) };
 
-    let path = RelativePath::new(s);
+    let path = RelativePath::new(s.strip_prefix("./").unwrap_or(s));
     for c in path.components() {
-        if c == Component::ParentDir {
-            Err("references parent dir")?
-        };
+        match c {
+            Component::ParentDir => Err("references parent directory")?,
+            Component::CurDir => Err("references current directory")?,
+            _ => (),
+        }
+    }
+
+    Ok(())
+}
+
+/// Returns an error if v is not a valid glob.
+fn is_glob(v: &Value) -> Result<(), Box<dyn std::error::Error>> {
+    let Value::String(s) = v else { return Ok(()) };
+
+    let path = wax::Glob::new(s.strip_prefix("./").unwrap_or(s))?;
+    if path.has_semantic_literals() {
+        Err("references parent or current directory")?
     }
 
     Ok(())
@@ -77,6 +95,7 @@ mod tests {
             json!("\\foo.md"),
             json!("this\\and\\that.txt"),
             json!("/absolute/path"),
+            json!("./relative/path"),
             json!(""),
             json!("C:\\foo"),
             json!("README.txt"),
@@ -92,11 +111,20 @@ mod tests {
 
         // Test invalid paths.
         for (name, invalid, err) in [
-            ("parent", json!("../outside/path"), "references parent dir"),
+            (
+                "parent",
+                json!("../outside/path"),
+                "references parent directory",
+            ),
+            (
+                "current",
+                json!("/./outside/path"),
+                "references current directory",
+            ),
             (
                 "sub parent",
                 json!("thing/../other"),
-                "references parent dir",
+                "references parent directory",
             ),
         ] {
             match is_path(&invalid) {
@@ -106,6 +134,42 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_glob() {
+        // Test valid globs.
+        for valid in [
+            json!(".gitignore"),
+            json!(".git*"),
+            json!("/git*"),
+            json!("./git*"),
+            json!(""),
+            json!("README.*"),
+            json!("**/*.(?i){jpg,jpeg}"),
+            json!("**/{*.{go,rs}}"),
+            json!("src/**/*.rs"),
+        ] {
+            if let Err(e) = is_glob(&valid) {
+                panic!("{} failed: {e}", valid);
+            }
+        }
+
+        // Test invalid paths.
+        for (name, invalid) in [
+            ("parent", json!("../*.c")),
+            ("current", json!("/./*.c")),
+            ("sub parent", json!("/**/../passwd")),
+        ] {
+            match is_glob(&invalid) {
+                Ok(_) => panic!("{name} unexpectedly passed!"),
+                Err(e) => assert_eq!(
+                    "references parent or current directory",
+                    e.to_string(),
+                    "{name}"
+                ),
+            }
+        }
+    }
+
     #[test]
     fn test_license() {
         // Test valid relative licenses.
@@ -163,7 +227,7 @@ mod tests {
     fn test_spec_compiler() -> Result<(), Error> {
         let mut c = spec_compiler();
         let id = "format";
-        // Compile simple schema to validate license and path.
+        // Compile simple schema to validate license, path, and glob.
         c.add_resource(
             id,
             json!({
@@ -173,6 +237,10 @@ mod tests {
                         "type": "string",
                         "format": "path",
                     },
+                    "glob": {
+                        "type": "string",
+                        "format": "glob",
+                    },
                     "license": {
                         "type": "string",
                         "format": "license",
@@ -198,7 +266,12 @@ mod tests {
             (
                 "parent path",
                 json!({"path": "../foo"}),
-                "'../foo' is not valid path: references parent dir",
+                "'../foo' is not valid path: references parent directory",
+            ),
+            (
+                "parent glob",
+                json!({"glob": "../*.c"}),
+                "'../*.c' is not valid glob: references parent or current directory",
             ),
         ] {
             match schemas.validate(&json, idx) {