rpm itself is pretty wide open about the characters in the version or release. However, in order to sanely parse nvr and nvra strings, koji must assume that they do not contain hyphens. If a build like this is imported, it causes numerous problems in the UI, so better to block them.
In the future, we can expand these sanity checks, but starting with the most basic for now.
+1
rebased
Pull-Request has been merged by mikem