Filter out the user provided unsafe packages

piptools/scripts/compile.py

@@ -599,6 +599,7 @@ def cli(
     )
     writer.write(
         results=results,
+        unsafe_packages=resolver.unsafe_packages,
         unsafe_requirements=resolver.unsafe_constraints,
         markers={
             key_from_ireq(ireq): ireq.markers for ireq in constraints if ireq.markers

piptools/writer.py

@@ -16,7 +16,6 @@
 
 from .logging import log
 from .utils import (
-    UNSAFE_PACKAGES,
     comment,
     dedup,
     format_requirement,
@@ -177,11 +176,15 @@ def _iter_lines(
         self,
         results: set[InstallRequirement],
         unsafe_requirements: set[InstallRequirement] | None = None,
+        unsafe_packages: set[str] | None = None,
         markers: dict[str, Marker] | None = None,
         hashes: dict[InstallRequirement, set[str]] | None = None,
     ) -> Iterator[str]:
         # default values
         unsafe_requirements = unsafe_requirements or set()
+        if unsafe_packages is None:
+            unsafe_packages = set()
+        unsafe_packages = unsafe_packages if not self.allow_unsafe else set()
         markers = markers or {}
         hashes = hashes or {}
 
@@ -199,12 +202,10 @@ def _iter_lines(
             yield line
             yielded = True
 
-        unsafe_requirements = (
-            {r for r in results if r.name in UNSAFE_PACKAGES}
-            if not unsafe_requirements
-            else unsafe_requirements
-        )
-        packages = {r for r in results if r.name not in UNSAFE_PACKAGES}
+        unsafe_requirements = unsafe_requirements or {
+            r for r in results if r.name in unsafe_packages
+        }
+        packages = {r for r in results if r.name not in unsafe_packages}
 
         if packages:
             for ireq in sorted(packages, key=self._sort_key):
@@ -247,6 +248,7 @@ def write(
         self,
         results: set[InstallRequirement],
         unsafe_requirements: set[InstallRequirement],
+        unsafe_packages: set[str],
         markers: dict[str, Marker],
         hashes: dict[InstallRequirement, set[str]] | None,
     ) -> None:
@@ -259,7 +261,9 @@ def write(
                 line_buffering=True,
             )
         try:
-            for line in self._iter_lines(results, unsafe_requirements, markers, hashes):
+            for line in self._iter_lines(
+                results, unsafe_requirements, unsafe_packages, markers, hashes
+            ):
                 if self.dry_run:
                     # Bypass the log level to always print this during a dry run
                     log.log(line)

tests/test_cli_compile.py

@@ -1536,6 +1536,59 @@ def test_allow_unsafe_option(pip_conf, monkeypatch, runner, option, expected):
     assert out.stdout == expected
 
 
+@pytest.mark.parametrize(
+    ("unsafe_package", "expected"),
+    (
+        (
+            "small-fake-with-deps",
+            dedent(
+                """\
+                small-fake-a==0.1
+                small-fake-b==0.3
+
+                # The following packages are considered to be unsafe in a requirements file:
+                # small-fake-with-deps
+                """
+            ),
+        ),
+        (
+            "small-fake-a",
+            dedent(
+                """\
+                small-fake-b==0.3
+                small-fake-with-deps==0.1
+
+                # The following packages are considered to be unsafe in a requirements file:
+                # small-fake-a
+                """
+            ),
+        ),
+    ),
+)
+def test_unsafe_package_option(pip_conf, monkeypatch, runner, unsafe_package, expected):
+    monkeypatch.setattr("piptools.resolver.UNSAFE_PACKAGES", {"small-fake-with-deps"})
+    with open("requirements.in", "w") as req_in:
+        req_in.write("small-fake-b\n")
+        req_in.write("small-fake-with-deps")
+
+    out = runner.invoke(
+        cli,
+        [
+            "--output-file",
+            "-",
+            "--quiet",
+            "--no-header",
+            "--no-emit-options",
+            "--no-annotate",
+            "--unsafe-package",
+            unsafe_package,
+        ],
+    )
+
+    assert out.exit_code == 0, out
+    assert out.stdout == expected
+
+
 @pytest.mark.parametrize(
     ("option", "attr", "expected"),
     (("--cert", "cert", "foo.crt"), ("--client-cert", "client_cert", "bar.pem")),