"only-best-candidates" can get wrong candidate with self.version

[simesy]

When I set only-best-candidates flag, there is a situation I've found where Composer is calculating the wrong package. I cannot be sure it's a satis problem. I've not finished testing this, but wanted to capture the beginning of what I have.

The full satis.json is:

{
    "name": "govcms/satis-test",
    "homepage": "https://satis.govcms.gov.au",
    "repositories": [
        { "type": "composer", "url": "https://packagist.org" },
        { "type": "composer", "url": "https://packages.drupal.org/8" },
        { "type": "composer", "url": "https://asset-packagist.org" },
        { "type": "vcs", "url": "https://github.com/simesy/scaffold-tooling" }
    ],
    "require": {
        "govcms/govcms": "1.0-beta6",
        "simesy/scaffold-tooling": "dev-master"
    },
    "require-dependencies": true,
    "only-best-candidates": true
}

govcms/govcms:1.0-beta6 requires drupal/chosen:2.6, while the latest version is 2.7. The relevant parts of the "chosen" packages coming from https://packages.drupal.org/8.

drupal/chosen

 "2.7.0":{
	"homepage":"https:\/\/www.drupal.org\/project\/chosen",
	"version":"2.7.0",
	"version_normalized":"2.7.0.0",
	"type":"drupal-module",
	"name":"drupal\/chosen",
	"require":{
	   "drupal\/chosen_lib":"*",
	   "drupal\/core":"~8.0"
	}
 },
 "2.6.0":{
	"homepage":"https:\/\/www.drupal.org\/project\/chosen",
	"version":"2.6.0",
	"version_normalized":"2.6.0.0",
	"type":"drupal-module",
	"name":"drupal\/chosen",
	"require":{
	   "drupal\/chosen_lib":"*",
	   "drupal\/core":"~8.0"
	}
 },

drupal/chosen_lib

 "2.7.0":{
	"homepage":"https:\/\/www.drupal.org\/project\/chosen",
	"version":"2.7.0",
	"version_normalized":"2.7.0.0",
	"type":"metapackage",
	"name":"drupal\/chosen_lib",
	"require":{
	   "drupal\/chosen":"self.version",
	   "drupal\/core":"~8.0"
	}
 },
 "2.6.0":{
	"homepage":"https:\/\/www.drupal.org\/project\/chosen",
	"version":"2.6.0",
	"version_normalized":"2.6.0.0",
	"type":"metapackage",
	"name":"drupal\/chosen_lib",
	"require":{
	   "drupal\/chosen":"self.version",
	   "drupal\/core":"~8.0"
	}
 },
 

The resulting satis repo, when used as a source for govcms/govcms:1.0-beta6, results in only chosen 2.7. But logically, when getting the "best candidate" for drupal/chosen_lib, composer should determine that govcms requires chosen 2.6, which is constrained to chosen_lib 2.6.

I feel the use of "self.version" is having an impact here.

When building a site the outcome is:

Loading composer repositories with package information
Updating dependencies (including require-dev)
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - drupal/chosen_lib 2.7.0 requires drupal/chosen 2.7.0 -> satisfiable by drupal/chosen[2.7.0].
    - drupal/chosen 2.6.0 requires drupal/chosen_lib * -> satisfiable by drupal/chosen_lib[2.7.0].
    - Can only install one of: drupal/chosen[2.7.0, 2.6.0].
    - govcms/govcms 1.0.0-beta6 requires drupal/chosen 2.6.0 -> satisfiable by drupal/chosen[2.6.0].
    - Installation request for govcms/govcms * -> satisfiable by govcms/govcms[1.0.0-beta6].