From 2762c3ddfcf6caa056163f7b5b465a7946f65878 Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Fri, 13 Mar 2026 15:56:00 +0100
Subject: [PATCH 01/12] initial proposal. still needs to be tested.

---
 scripts/zwik_client.py | 183 ++++++++++++++++++++++++-----------------
 1 file changed, 108 insertions(+), 75 deletions(-)

diff --git a/scripts/zwik_client.py b/scripts/zwik_client.py
index 27cb5b7..d84b904 100644
--- a/scripts/zwik_client.py
+++ b/scripts/zwik_client.py
@@ -28,7 +28,7 @@
 from logging.handlers import RotatingFileHandler
 from typing import Optional
 
-__version__ = "5.16"
+__version__ = "5.17"
 min_supported_conda_version = "4.5.4"
 max_supported_conda_version = "24.3.0"
 min_supported_bootstrap_version = 7
@@ -727,7 +727,9 @@ def from_yaml(cls, zwik_settings, yaml_file, working_dir=None):
         yaml = import_yaml()
 
         with open(obj.yaml_path) as fp:
-            obj.env_data = yaml.load(fp)
+            value = yaml.load(fp)
+            # When debugging in PyCharm obj.env_data = yaml.load(fp) will set env_data to None
+            obj.env_data = value
         if obj.env_data:
             if "channels" in obj.env_data:
                 channels = obj.env_data["channels"]
@@ -822,12 +824,26 @@ def conda_envs_dir(self):
     def yaml_hash(self):
         if not self._yaml_hash:
             import hashlib
+            import re
+
+            use_legacy = True
+            script_ver = "NONE FOUND"
+            if self.lock_data and self.lock_data.get("script_version"):
+                script_ver = str(self.lock_data["script_version"])
+                from conda.exports import VersionOrder
+                if VersionOrder(script_ver) > VersionOrder("5.16"):
+                    use_legacy = False
 
             hash_md5 = hashlib.md5()
             with open(self.yaml_path, "r") as f:
                 for line in f.readlines():
+                    if use_legacy:
+                        line = re.sub(r'\s*#\s*CAUTION:\s*(UNSAFE|OBSOLETE)\s*PACKAGE.*', '', line)
+                    else:
+                        line = line.split('#')[0].rstrip() + '\n'
                     hash_md5.update(line.encode("utf-8"))
             self._yaml_hash = hash_md5.hexdigest()
+
         return self._yaml_hash
 
     @property
@@ -893,8 +909,13 @@ def read_version_lock(self):
                 raise LockfileError("lock file seems corrupt")
             with open(path, "r") as fp:
                 data = yaml.load(fp)
+
+                # Temporarily set lock_data so yaml_hash can read the script_version
+                self.lock_data = data
+
                 if "yaml_hash" not in data:
                     raise LockfileError("lock file seems incomplete")
+
                 if data["yaml_hash"] == self.yaml_hash:
                     channel_alias = (
                         data.get("channel_alias"),
@@ -904,8 +925,6 @@ def read_version_lock(self):
                         raise LockfileError("lock file conda alias mismatch")
                     lock_file_channels = ";".join(data.get("channels", []))
                     env_channels = ";".join(self.channels)
-                    # also compare with list of default channels
-                    #  for backwards compatibility
                     def_channels = ";".join(self.settings.default_channels)
                     if lock_file_channels not in (env_channels, def_channels):
                         raise LockfileError("lock file conda channel mismatch")
@@ -917,7 +936,7 @@ def read_version_lock(self):
         log.info("No version lock file found")
         return None
 
-    def write_version_lock(self, lock_dep, obsolete_pkgs=(), unsafe_pkgs=()):
+    def write_version_lock(self, lock_dep):
         import getpass
         import hashlib
         import io
@@ -939,14 +958,6 @@ def write_version_lock(self, lock_dep, obsolete_pkgs=(), unsafe_pkgs=()):
             "dependencies": sorted(lock_dep),
         }
 
-        labels = {}
-        for p in obsolete_pkgs:
-            labels[p] = "obsolete"
-        for p in unsafe_pkgs:
-            labels[p] = "unsafe"
-        if labels:
-            data["labels"] = labels
-
         stream = io.StringIO()
         yaml.dump(data, stream)
         output = stream.getvalue()
@@ -1013,15 +1024,17 @@ def create_lockfile(self, additional_dependencies=()):
             PackagesNotFoundError,
             ResolvePackageNotFound,
             UnsatisfiableError,
+            UnavailableInvalidChannel,
         )
         from conda.exports import subdir
 
         obsolete_pkgs = set()
         unsafe_pkgs = set()
         last_exception = None
-        # First check only the original urls, then also the obsolete labels
-        #  and finally also unsafe labels
+
+        # Keep the loop for performance: only query obsolete/unsafe if standard fails
         for labels in ((), ("obsolete",), ("obsolete", "unsafe")):
+            print(f"Checking labels {labels}")
             solver = self.get_solver(dependencies, labels)
             try:
                 link_precs = solver.solve_final_state()
@@ -1030,35 +1043,41 @@ def create_lockfile(self, additional_dependencies=()):
                     for prec in link_precs:
                         split_channel = prec.channel.name.split("/")
                         if len(split_channel) > 1:
-                            # Format is <channel>/labels/<label>
-                            _, _, label = split_channel
+                            label = split_channel[-1]
                             if label == "obsolete":
                                 obsolete_pkgs.add(prec.name)
-                            else:
+                            elif label == "unsafe":
                                 unsafe_pkgs.add(prec.name)
-                    if unsafe_pkgs:
-                        self.handle_unsafe_pkgs(unsafe_pkgs)
+
+                # Enforce safety comments immediately if unsafe packages are found
+                if unsafe_pkgs:
+                    self.handle_unsafe_pkgs(unsafe_pkgs)
                 break
             except (
-                PackagesNotFoundError,
-                ResolvePackageNotFound,
-                UnsatisfiableError,
+                    PackagesNotFoundError,
+                    ResolvePackageNotFound,
+                    UnsatisfiableError,
+                    UnavailableInvalidChannel,
             ) as exception:
                 last_exception = exception
         else:
             raise last_exception
 
-        if obsolete_pkgs:
-            log.warning(
-                "WARNING: These packages are marked as obsolete,"
-                " try to update or find an alternative:\n%s"
-                ", ".join(obsolete_pkgs),
-            )
-        if unsafe_pkgs:
+        # Handle Obsolete Warnings
+        for pkg_name in obsolete_pkgs:
+            comment = self.get_dependency_comment(pkg_name)
+            if not comment.startswith("# CAUTION: OBSOLETE PACKAGE"):
+                log.warning(
+                    "WARNING: The package '%s' is marked as obsolete, "
+                    "try to update or find an alternative. "
+                    "Add '# CAUTION: OBSOLETE PACKAGE' to suppress this warning.",
+                    pkg_name
+                )
+
             log.warning(
-                "WARNING: Packages below are marked as UNSAFE."
-                " Client continues because of comment in environment file.\n%s"
-                ", ".join(unsafe_pkgs),
+                "WARNING: The package '%s' is marked as UNSAFE. "
+                "Client continues because of comment in environment file.",
+                pkg_name
             )
 
         solved_dep_list = link_precs.item_list
@@ -1077,11 +1096,7 @@ def create_lockfile(self, additional_dependencies=()):
                 "dependencies": sorted(self.env_data["dependencies"][:]),
             }
         else:
-            self.write_version_lock(
-                lockfile_deps,
-                obsolete_pkgs,
-                unsafe_pkgs,
-            )
+            self.write_version_lock(lockfile_deps)
             self.lock_data = self.read_version_lock()
             assert self.lock_data
 
@@ -1135,30 +1150,27 @@ def get_solver(self, dependencies, labels):
             specs_to_add=dependencies.get_specs(self.settings),
         )
 
-    def handle_unsafe_pkgs(self, unsafe_pkgs):
+    def get_dependency_comment(self, pkg_name):
         from conda.exports import MatchSpec
+        for index, env_dep in enumerate(self.env_data.get("dependencies", [])):
+            env_dep_spec = MatchSpec(env_dep)
+            if env_dep_spec.name == pkg_name:
+                comment = self.get_yaml_comment(self.env_data["dependencies"], index)
+                return comment.strip() if comment else ""
+        return ""
 
-        for pkg_name in unsafe_pkgs:
-            for index, env_dep in enumerate(self.env_data["dependencies"]):
-                env_dep_spec = MatchSpec(env_dep)
-                if env_dep_spec.name == pkg_name:
-                    comment = self.get_yaml_comment(
-                        self.env_data["dependencies"],
-                        index,
-                    )
-                    if comment and comment.strip().startswith(
-                        "# CAUTION: UNSAFE PACKAGE"
-                    ):
-                        break
-            else:
-                from conda import CondaError
+    def handle_unsafe_pkgs(self, unsafe_pkgs):
+        from conda import CondaError
 
+        for pkg_name in unsafe_pkgs:
+            comment = self.get_dependency_comment(pkg_name)
+            if not comment.startswith("# CAUTION: UNSAFE PACKAGE"):
                 raise CondaError(
-                    "ERROR: The following package is UNSAFE,"
-                    " check {}/unsafe"
-                    " for more info: {}".format(
-                        self.settings.website_url,
+                    "ERROR: The package '{}' is UNSAFE. "
+                    "You MUST add '# CAUTION: UNSAFE PACKAGE' comment next to the package in"
+                    "the environment file to proceed.".format(
                         pkg_name,
+                        self.settings.website_url,
                     )
                 )
 
@@ -1217,34 +1229,55 @@ def create_env(self):
         self._check_installation()
 
         specs_to_add = self.lock_data["dependencies"]
-        channels = self.settings.resolve_channels(
-            self.lock_data["channels"],
-        )
-        obsolete_channels = self.settings.resolve_channels(
-            self.lock_data["channels"], ("obsolete",)
-        )
+
+        # Pre-resolve all channel variations
+        channels = self.settings.resolve_channels(self.lock_data["channels"])
+        obsolete_channels = self.settings.resolve_channels(self.lock_data["channels"], ("obsolete",))
+        unsafe_channels = self.settings.resolve_channels(self.lock_data["channels"], ("unsafe",))
+
         subdirs = [self.lock_data["subdir"], "noarch"]
         link_precs = []
 
         for spec in specs_to_add:
             spec_name, _ = spec.split("=", maxsplit=1)
-            search_channels = channels
-            label = self.lock_data.get("labels", {}).get(spec_name)
-            if label:
-                search_channels = self.settings.resolve_channels(
-                    self.lock_data["channels"], ("", label)
-                )
-            result = SubdirData.query_all(spec, search_channels, subdirs)
+
+            is_obsolete = False
+            is_unsafe = False
+
+            # 1. Try Standard Channels
+            result = SubdirData.query_all(spec, channels, subdirs)
+
             if not result:
+                # 2. Try Obsolete Channels
                 result = SubdirData.query_all(spec, obsolete_channels, subdirs)
                 if result:
+                    is_obsolete = True
+                else:
+                    # 3. Try Unsafe Channels
+                    result = SubdirData.query_all(spec, unsafe_channels, subdirs)
+                    if result:
+                        is_unsafe = True
+
+            if not result:
+                raise AssertionError("Package not found in standard, obsolete, or unsafe channels: {}".format(spec))
+
+            comment = self.get_dependency_comment(spec_name)
+
+            if is_obsolete:
+                if not comment.startswith("# CAUTION: OBSOLETE PACKAGE"):
                     log.warning(
-                        "The package '%s' is obsolete,"
-                        " please review the environment",
-                        spec_name,
+                        "WARNING: The package '%s' is being loaded from an OBSOLETE channel. "
+                        "Add '# CAUTION: OBSOLETE PACKAGE' to suppress this warning.", spec_name
                     )
-                else:
-                    raise AssertionError("Package not found: {}".format(spec))
+            elif is_unsafe:
+                log.warning("WARNING: The package '%s' is being loaded from an UNSAFE channel.", spec_name)
+                if not comment.startswith("# CAUTION: UNSAFE PACKAGE"):
+                    from conda import CondaError
+                    raise CondaError(
+                        "ERROR: The following package is UNSAFE: {}. "
+                        "You MUST add '# CAUTION: UNSAFE PACKAGE' to the environment file to proceed.".format(spec_name)
+                    )
+
             if self._multiple_packages_found(result):
                 log.warning("Multiple packages found for '%s'.", spec)
                 result = self._filter_package_from_default_channels(result, spec)

From 49af93716492a334789f313d0c073f246943df7e Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Fri, 13 Mar 2026 15:57:35 +0100
Subject: [PATCH 02/12] fix loop

---
 scripts/zwik_client.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/zwik_client.py b/scripts/zwik_client.py
index d84b904..6ce59a9 100644
--- a/scripts/zwik_client.py
+++ b/scripts/zwik_client.py
@@ -1074,6 +1074,7 @@ def create_lockfile(self, additional_dependencies=()):
                     pkg_name
                 )
 
+        for pkg_name in unsafe_pkgs:
             log.warning(
                 "WARNING: The package '%s' is marked as UNSAFE. "
                 "Client continues because of comment in environment file.",

From 2603ff9f1707196b9c54f81b561fcd33288395eb Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Tue, 17 Mar 2026 13:32:39 +0100
Subject: [PATCH 03/12] change how the yaml hash is handled. Now always uses
 the modern method and only when legacy is encountered will calculate a new
 hash the old way

---
 scripts/zwik_client.py | 73 +++++++++++++++++++++++++++---------------
 1 file changed, 47 insertions(+), 26 deletions(-)

diff --git a/scripts/zwik_client.py b/scripts/zwik_client.py
index 6ce59a9..648090e 100644
--- a/scripts/zwik_client.py
+++ b/scripts/zwik_client.py
@@ -824,28 +824,40 @@ def conda_envs_dir(self):
     def yaml_hash(self):
         if not self._yaml_hash:
             import hashlib
-            import re
+            hash_md5 = hashlib.md5()
 
-            use_legacy = True
-            script_ver = "NONE FOUND"
-            if self.lock_data and self.lock_data.get("script_version"):
-                script_ver = str(self.lock_data["script_version"])
-                from conda.exports import VersionOrder
-                if VersionOrder(script_ver) > VersionOrder("5.16"):
-                    use_legacy = False
+            if self.env_data:
+                if "channels" in self.env_data:
+                    for channel in self.env_data["channels"]:
+                        hash_md5.update(str(channel).encode("utf-8"))
+
+                if "dependencies" in self.env_data:
+                    env_deps = self.get_dependencies(additional_dependencies=[])
+
+                    # Convert the MatchSpec objects to strings and sort them natively
+                    deps_to_hash = sorted([str(spec) for spec in env_deps.specs])
+
+                    for dep in deps_to_hash:
+                        hash_md5.update(dep.encode("utf-8"))
 
-            hash_md5 = hashlib.md5()
-            with open(self.yaml_path, "r") as f:
-                for line in f.readlines():
-                    if use_legacy:
-                        line = re.sub(r'\s*#\s*CAUTION:\s*(UNSAFE|OBSOLETE)\s*PACKAGE.*', '', line)
-                    else:
-                        line = line.split('#')[0].rstrip() + '\n'
-                    hash_md5.update(line.encode("utf-8"))
             self._yaml_hash = hash_md5.hexdigest()
 
         return self._yaml_hash
 
+    def get_legacy_yaml_hash(self):
+        import hashlib
+        import re
+
+        hash_md5 = hashlib.md5()
+        with open(self.yaml_path, "r") as f:
+            for line in f.readlines():
+                # Legacy method ONLY strips UNSAFE package comments
+                # OBSOLETE comments are deliberately ignored so adding them forces a regeneration
+                line = re.sub(r'\s*#\s*CAUTION:\s*UNSAFE\s*PACKAGE.*', '', line)
+                hash_md5.update(line.encode("utf-8"))
+
+        return hash_md5.hexdigest()
+
     @property
     def env_name(self):
         return self.lockfile_hash
@@ -910,13 +922,24 @@ def read_version_lock(self):
             with open(path, "r") as fp:
                 data = yaml.load(fp)
 
-                # Temporarily set lock_data so yaml_hash can read the script_version
                 self.lock_data = data
 
                 if "yaml_hash" not in data:
                     raise LockfileError("lock file seems incomplete")
 
+                # 1. Check against the modern hash first
+                hash_matches = False
                 if data["yaml_hash"] == self.yaml_hash:
+                    hash_matches = True
+                else:
+                    # 2. Fallback: Check if it's a legacy lock file (<= 5.16)
+                    from conda.exports import VersionOrder
+                    script_ver = data.get("script_version", "0")
+                    if VersionOrder(str(script_ver)) <= VersionOrder("5.16"):
+                        if data["yaml_hash"] == self.get_legacy_yaml_hash():
+                            hash_matches = True
+
+                if hash_matches:
                     channel_alias = (
                         data.get("channel_alias"),
                         data.get("channel_alias").replace("http:", "https:"),
@@ -929,6 +952,7 @@ def read_version_lock(self):
                     if lock_file_channels not in (env_channels, def_channels):
                         raise LockfileError("lock file conda channel mismatch")
                     return data
+
                 log.info(
                     "The lock file is not aligned with the actual environment file"
                 )
@@ -1066,7 +1090,7 @@ def create_lockfile(self, additional_dependencies=()):
         # Handle Obsolete Warnings
         for pkg_name in obsolete_pkgs:
             comment = self.get_dependency_comment(pkg_name)
-            if not comment.startswith("# CAUTION: OBSOLETE PACKAGE"):
+            if "CAUTION: OBSOLETE PACKAGE" not in comment:
                 log.warning(
                     "WARNING: The package '%s' is marked as obsolete, "
                     "try to update or find an alternative. "
@@ -1165,14 +1189,11 @@ def handle_unsafe_pkgs(self, unsafe_pkgs):
 
         for pkg_name in unsafe_pkgs:
             comment = self.get_dependency_comment(pkg_name)
-            if not comment.startswith("# CAUTION: UNSAFE PACKAGE"):
+            if "CAUTION: UNSAFE PACKAGE" not in comment:
                 raise CondaError(
                     "ERROR: The package '{}' is UNSAFE. "
-                    "You MUST add '# CAUTION: UNSAFE PACKAGE' comment next to the package in"
-                    "the environment file to proceed.".format(
-                        pkg_name,
-                        self.settings.website_url,
-                    )
+                    "You MUST add '# CAUTION: UNSAFE PACKAGE' comment next to the package in "
+                    "the environment file to proceed.".format(pkg_name)
                 )
 
     def partially_update_lockfile(self, update_list):
@@ -1265,14 +1286,14 @@ def create_env(self):
             comment = self.get_dependency_comment(spec_name)
 
             if is_obsolete:
-                if not comment.startswith("# CAUTION: OBSOLETE PACKAGE"):
+                if "CAUTION: OBSOLETE PACKAGE" not in comment:
                     log.warning(
                         "WARNING: The package '%s' is being loaded from an OBSOLETE channel. "
                         "Add '# CAUTION: OBSOLETE PACKAGE' to suppress this warning.", spec_name
                     )
             elif is_unsafe:
                 log.warning("WARNING: The package '%s' is being loaded from an UNSAFE channel.", spec_name)
-                if not comment.startswith("# CAUTION: UNSAFE PACKAGE"):
+                if "CAUTION: UNSAFE PACKAGE" not in comment:
                     from conda import CondaError
                     raise CondaError(
                         "ERROR: The following package is UNSAFE: {}. "

From 886f6ab80dc152f10c9c854edd2c52f4be410df4 Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Tue, 17 Mar 2026 14:07:16 +0100
Subject: [PATCH 04/12] replace print statement with log.debug

---
 scripts/zwik_client.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/zwik_client.py b/scripts/zwik_client.py
index 648090e..ec831c0 100644
--- a/scripts/zwik_client.py
+++ b/scripts/zwik_client.py
@@ -1058,7 +1058,7 @@ def create_lockfile(self, additional_dependencies=()):
 
         # Keep the loop for performance: only query obsolete/unsafe if standard fails
         for labels in ((), ("obsolete",), ("obsolete", "unsafe")):
-            print(f"Checking labels {labels}")
+            log.debug("Checking labels %s", labels)
             solver = self.get_solver(dependencies, labels)
             try:
                 link_precs = solver.solve_final_state()

From feebec7f64784164b63ed3a50f83c8d57ef959e5 Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Tue, 17 Mar 2026 14:24:52 +0100
Subject: [PATCH 05/12] clarify comment

---
 scripts/zwik_client.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/zwik_client.py b/scripts/zwik_client.py
index ec831c0..852273b 100644
--- a/scripts/zwik_client.py
+++ b/scripts/zwik_client.py
@@ -834,7 +834,8 @@ def yaml_hash(self):
                 if "dependencies" in self.env_data:
                     env_deps = self.get_dependencies(additional_dependencies=[])
 
-                    # Convert the MatchSpec objects to strings and sort them natively
+                    # Convert the MatchSpec objects to strings and sort them.
+                    # This allows us to reorder the yaml file and not trigger regeneration
                     deps_to_hash = sorted([str(spec) for spec in env_deps.specs])
 
                     for dep in deps_to_hash:

From 9793e13ba69285335d96dab9ef554371e05422fd Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Tue, 17 Mar 2026 14:30:06 +0100
Subject: [PATCH 06/12] remove redundant code

---
 scripts/zwik_client.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/scripts/zwik_client.py b/scripts/zwik_client.py
index 852273b..a59bfb1 100644
--- a/scripts/zwik_client.py
+++ b/scripts/zwik_client.py
@@ -923,8 +923,6 @@ def read_version_lock(self):
             with open(path, "r") as fp:
                 data = yaml.load(fp)
 
-                self.lock_data = data
-
                 if "yaml_hash" not in data:
                     raise LockfileError("lock file seems incomplete")
 

From 12889fad0384e7e3f7ed5deb9b46a54a2f484de8 Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Tue, 17 Mar 2026 16:50:35 +0100
Subject: [PATCH 07/12] update tests

---
 scripts/zwik_client.py | 62 +++++++++++++++++++++++++++---------------
 tests/test_labels.py   | 35 ++++++++++++------------
 2 files changed, 57 insertions(+), 40 deletions(-)

diff --git a/scripts/zwik_client.py b/scripts/zwik_client.py
index a59bfb1..296f741 100644
--- a/scripts/zwik_client.py
+++ b/scripts/zwik_client.py
@@ -727,9 +727,7 @@ def from_yaml(cls, zwik_settings, yaml_file, working_dir=None):
         yaml = import_yaml()
 
         with open(obj.yaml_path) as fp:
-            value = yaml.load(fp)
-            # When debugging in PyCharm obj.env_data = yaml.load(fp) will set env_data to None
-            obj.env_data = value
+            obj.env_data = yaml.load(fp)
         if obj.env_data:
             if "channels" in obj.env_data:
                 channels = obj.env_data["channels"]
@@ -824,6 +822,7 @@ def conda_envs_dir(self):
     def yaml_hash(self):
         if not self._yaml_hash:
             import hashlib
+
             hash_md5 = hashlib.md5()
 
             if self.env_data:
@@ -835,8 +834,9 @@ def yaml_hash(self):
                     env_deps = self.get_dependencies(additional_dependencies=[])
 
                     # Convert the MatchSpec objects to strings and sort them.
-                    # This allows us to reorder the yaml file and not trigger regeneration
-                    deps_to_hash = sorted([str(spec) for spec in env_deps.specs])
+                    # This allows us to reorder the yaml file and not
+                    # trigger regeneration
+                    deps_to_hash = sorted([str(s) for s in env_deps.specs])
 
                     for dep in deps_to_hash:
                         hash_md5.update(dep.encode("utf-8"))
@@ -853,8 +853,9 @@ def get_legacy_yaml_hash(self):
         with open(self.yaml_path, "r") as f:
             for line in f.readlines():
                 # Legacy method ONLY strips UNSAFE package comments
-                # OBSOLETE comments are deliberately ignored so adding them forces a regeneration
-                line = re.sub(r'\s*#\s*CAUTION:\s*UNSAFE\s*PACKAGE.*', '', line)
+                # OBSOLETE comments are deliberately ignored so
+                # adding them forces a regeneration
+                line = re.sub(r"\s*#\s*CAUTION:\s*UNSAFE\s*PACKAGE.*", "", line)
                 hash_md5.update(line.encode("utf-8"))
 
         return hash_md5.hexdigest()
@@ -933,6 +934,7 @@ def read_version_lock(self):
                 else:
                     # 2. Fallback: Check if it's a legacy lock file (<= 5.16)
                     from conda.exports import VersionOrder
+
                     script_ver = data.get("script_version", "0")
                     if VersionOrder(str(script_ver)) <= VersionOrder("5.16"):
                         if data["yaml_hash"] == self.get_legacy_yaml_hash():
@@ -1046,8 +1048,8 @@ def create_lockfile(self, additional_dependencies=()):
         from conda.exceptions import (
             PackagesNotFoundError,
             ResolvePackageNotFound,
-            UnsatisfiableError,
             UnavailableInvalidChannel,
+            UnsatisfiableError,
         )
         from conda.exports import subdir
 
@@ -1077,10 +1079,10 @@ def create_lockfile(self, additional_dependencies=()):
                     self.handle_unsafe_pkgs(unsafe_pkgs)
                 break
             except (
-                    PackagesNotFoundError,
-                    ResolvePackageNotFound,
-                    UnsatisfiableError,
-                    UnavailableInvalidChannel,
+                PackagesNotFoundError,
+                ResolvePackageNotFound,
+                UnsatisfiableError,
+                UnavailableInvalidChannel,
             ) as exception:
                 last_exception = exception
         else:
@@ -1094,14 +1096,14 @@ def create_lockfile(self, additional_dependencies=()):
                     "WARNING: The package '%s' is marked as obsolete, "
                     "try to update or find an alternative. "
                     "Add '# CAUTION: OBSOLETE PACKAGE' to suppress this warning.",
-                    pkg_name
+                    pkg_name,
                 )
 
         for pkg_name in unsafe_pkgs:
             log.warning(
                 "WARNING: The package '%s' is marked as UNSAFE. "
                 "Client continues because of comment in environment file.",
-                pkg_name
+                pkg_name,
             )
 
         solved_dep_list = link_precs.item_list
@@ -1176,6 +1178,7 @@ def get_solver(self, dependencies, labels):
 
     def get_dependency_comment(self, pkg_name):
         from conda.exports import MatchSpec
+
         for index, env_dep in enumerate(self.env_data.get("dependencies", [])):
             env_dep_spec = MatchSpec(env_dep)
             if env_dep_spec.name == pkg_name:
@@ -1191,7 +1194,8 @@ def handle_unsafe_pkgs(self, unsafe_pkgs):
             if "CAUTION: UNSAFE PACKAGE" not in comment:
                 raise CondaError(
                     "ERROR: The package '{}' is UNSAFE. "
-                    "You MUST add '# CAUTION: UNSAFE PACKAGE' comment next to the package in "
+                    "You MUST add '# CAUTION: UNSAFE PACKAGE' "
+                    "comment next to the package in "
                     "the environment file to proceed.".format(pkg_name)
                 )
 
@@ -1253,8 +1257,12 @@ def create_env(self):
 
         # Pre-resolve all channel variations
         channels = self.settings.resolve_channels(self.lock_data["channels"])
-        obsolete_channels = self.settings.resolve_channels(self.lock_data["channels"], ("obsolete",))
-        unsafe_channels = self.settings.resolve_channels(self.lock_data["channels"], ("unsafe",))
+        obsolete_channels = self.settings.resolve_channels(
+            self.lock_data["channels"], ("obsolete",)
+        )
+        unsafe_channels = self.settings.resolve_channels(
+            self.lock_data["channels"], ("unsafe",)
+        )
 
         subdirs = [self.lock_data["subdir"], "noarch"]
         link_precs = []
@@ -1280,23 +1288,33 @@ def create_env(self):
                         is_unsafe = True
 
             if not result:
-                raise AssertionError("Package not found in standard, obsolete, or unsafe channels: {}".format(spec))
+                raise AssertionError(
+                    "Package not found in standard, obsolete, "
+                    "or unsafe channels: {}".format(spec)
+                )
 
             comment = self.get_dependency_comment(spec_name)
 
             if is_obsolete:
                 if "CAUTION: OBSOLETE PACKAGE" not in comment:
                     log.warning(
-                        "WARNING: The package '%s' is being loaded from an OBSOLETE channel. "
-                        "Add '# CAUTION: OBSOLETE PACKAGE' to suppress this warning.", spec_name
+                        "WARNING: The package '%s' is "
+                        "being loaded from an OBSOLETE channel. "
+                        "Add '# CAUTION: OBSOLETE PACKAGE' to suppress this warning.",
+                        spec_name,
                     )
             elif is_unsafe:
-                log.warning("WARNING: The package '%s' is being loaded from an UNSAFE channel.", spec_name)
+                log.warning(
+                    "WARNING: The package '%s' is being loaded from an UNSAFE channel.",
+                    spec_name,
+                )
                 if "CAUTION: UNSAFE PACKAGE" not in comment:
                     from conda import CondaError
+
                     raise CondaError(
                         "ERROR: The following package is UNSAFE: {}. "
-                        "You MUST add '# CAUTION: UNSAFE PACKAGE' to the environment file to proceed.".format(spec_name)
+                        "You MUST add '# CAUTION: UNSAFE PACKAGE' to "
+                        "the environment file to proceed.".format(spec_name)
                     )
 
             if self._multiple_packages_found(result):
diff --git a/tests/test_labels.py b/tests/test_labels.py
index 3a3d003..d9c38c8 100644
--- a/tests/test_labels.py
+++ b/tests/test_labels.py
@@ -4,6 +4,7 @@
 from unittest.mock import patch
 
 import conda
+from conda import CondaError
 
 from tests.utils import DummyServerEnvironmentTest, DummyZwikServer
 
@@ -50,10 +51,6 @@ def get_lock_data(env_settings, package_name):
                 "{}=1.0=0".format(self.dummy_server.dummy_name),
                 lock_data["dependencies"],
             )
-            self.assertEqual(
-                lock_data["labels"][self.dummy_server.dummy_name],
-                "obsolete",
-            )
 
         with self.subTest("unsafe package"):
             self.dummy_server.dummy_name = "dummy-package-unsafe"
@@ -72,16 +69,12 @@ def get_lock_data(env_settings, package_name):
                 "{}=1.0=0".format(self.dummy_server.dummy_name),
                 lock_data["dependencies"],
             )
-            self.assertEqual(
-                lock_data["labels"][self.dummy_server.dummy_name],
-                "unsafe",
-            )
 
     @patch("conda.core.link.UnlinkLinkTransaction.execute")
     def test_create_environment(self, link_exec_mock):
         from scripts.zwik_client import ZwikEnvironment, ZwikSettings
 
-        def generate_lock_data(name, label=None):
+        def generate_lock_data(name):
             lock_data = {
                 "dependencies": [
                     "{}=1.0=0".format(name),
@@ -91,10 +84,7 @@ def generate_lock_data(name, label=None):
                 ],
                 "subdir": "linux-64",
             }
-            if label:
-                lock_data["labels"] = {
-                    name: label,
-                }
+
             return lock_data
 
         settings = ZwikSettings()
@@ -120,11 +110,10 @@ def generate_lock_data(name, label=None):
             ) as cm:
                 env.lock_data = generate_lock_data(
                     self.dummy_server.dummy_name,
-                    "obsolete",
                 )
                 env.create_env()
                 # No warning expected when lock data specifies label
-                self.assertEqual(len(cm.output), 0)
+                self.assertTrue("# CAUTION: OBSOLETE PACKAGE" in cm.output[0])
 
                 env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
                 env.create_env()
@@ -133,11 +122,21 @@ def generate_lock_data(name, label=None):
             self.dummy_server.dummy_name = "dummy-link-pkg-unsafe"
             self.dummy_server.dummy_label = "unsafe"
             env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
-            with self.assertRaises(AssertionError):
+            with self.assertRaises(CondaError):
                 env.create_env()
 
-            env.lock_data = generate_lock_data(self.dummy_server.dummy_name, "unsafe")
-            env.create_env()
+        with self.subTest("unsafe package fixed with comment"):
+            self.dummy_server.dummy_name = "dummy-link-pkg-unsafe"
+            self.dummy_server.dummy_label = "unsafe"
+            env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
+
+            # Mock the comment fetcher to simulate the user adding the required comment
+            with patch.object(
+                env, "get_dependency_comment", return_value="# CAUTION: UNSAFE PACKAGE"
+            ):
+                env.create_env()
+
+            self.assertTrue(link_exec_mock.called)
 
     @patch("conda.core.link.UnlinkLinkTransaction.execute")
     def test_multiple_packages_with_default(self, link_exec_mock):

From 6e995feefe48b9a8c40dd51ba008bcac624308a3 Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Wed, 18 Mar 2026 10:39:12 +0100
Subject: [PATCH 08/12] add additional tests to check if CAUTION comments work
 as expected and correct yaml_hash is generated

---
 tests/test_client.py | 115 +++++++++++++++++++++++++++++++++++++++++++
 tests/test_labels.py |  34 ++++++++++++-
 2 files changed, 147 insertions(+), 2 deletions(-)

diff --git a/tests/test_client.py b/tests/test_client.py
index 44d948d..e63ca72 100644
--- a/tests/test_client.py
+++ b/tests/test_client.py
@@ -114,6 +114,121 @@ def test_invalid_lock_file(self, mock_lock_path):
         env = ZwikEnvironment.from_yaml(ZwikSettings(), self.yaml_file)
         self.assertIsNone(env.lock_data)
 
+    def test_legacy_hash_fallback(self):
+        import hashlib
+        import io
+
+        from scripts.zwik_client import import_yaml
+
+        settings = ZwikSettings()
+
+        def write_mock_lock_file(lock_path, data):
+            yaml = import_yaml()
+            stream = io.StringIO()
+            yaml.dump(data, stream)
+            output = stream.getvalue()
+
+            # Reproduce the script's exact lockfile integrity hashing
+            new_hash = hashlib.md5()
+            for line in output.splitlines():
+                new_hash.update(line.strip().encode())
+            integrity_hash = new_hash.hexdigest()
+
+            os.makedirs(os.path.dirname(lock_path), exist_ok=True)
+            with open(lock_path, "w") as fp:
+                fp.write("# lockfile integrity: {}\n".format(integrity_hash))
+                fp.write(output)
+
+        # Setup base legacy yaml file
+        yaml_content = "dependencies:\n  - python\n  - foobar\n"
+        with open(self.yaml_file, "w") as fp:
+            fp.write(yaml_content)
+
+        env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+
+        # Calculate both hashes explicitly to show their difference
+        legacy_hash = env.get_legacy_yaml_hash()
+        modern_hash = env.yaml_hash
+
+        self.assertNotEqual(legacy_hash, modern_hash)
+
+        lock_data = {
+            "script_version": "5.16",  # Mark as a legacy version
+            "yaml_hash": legacy_hash,
+            "channel_alias": env.settings.channel_alias,
+            "channels": env.channels,
+            "dependencies": ["foobar=1.0=0", "python=3.9=0"],
+            "subdir": "linux-64",
+        }
+
+        write_mock_lock_file(env.version_lock_path, lock_data)
+
+        # Fallback succeeds because script <= 5.16 and legacy hashes match
+        with self.subTest("legacy lock file without comments"):
+            env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+
+            self.assertTrue(env.has_valid_lockfile())
+            # Verify the client accepted the legacy hash over the modern one
+            self.assertEqual(env.lock_data["yaml_hash"], legacy_hash)
+
+        # Add UNSAFE comment. The regex strips it, so
+        # the legacy hash should remain the same.
+        with self.subTest("legacy lock file with UNSAFE comment"):
+            yaml_content_unsafe = (
+                "dependencies:\n  - python\n  - foobar # CAUTION: UNSAFE PACKAGE\n"
+            )
+            with open(self.yaml_file, "w") as fp:
+                fp.write(yaml_content_unsafe)
+
+            env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+
+            # Legacy hash ignored the UNSAFE comment
+            self.assertEqual(env.get_legacy_yaml_hash(), legacy_hash)
+            self.assertTrue(env.has_valid_lockfile())
+
+        # Add OBSOLETE comment. The regex DOES NOT strip it,
+        # so the legacy hash should change.
+        with self.subTest("legacy lock file with OBSOLETE comment"):
+            yaml_content_obsolete = (
+                "dependencies:\n  - python\n  - foobar # CAUTION: OBSOLETE PACKAGE\n"
+            )
+            with open(self.yaml_file, "w") as fp:
+                fp.write(yaml_content_obsolete)
+
+            env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+
+            new_legacy_hash = env.get_legacy_yaml_hash()
+
+            # The legacy hash changed because the obsolete comment was parsed
+            self.assertNotEqual(new_legacy_hash, legacy_hash)
+
+            # Validation should fail, forcing the environment to regenerate
+            self.assertFalse(env.has_valid_lockfile())
+
+        # Modern script ignores legacy fallback completely
+        with self.subTest("modern script version with legacy hash"):
+            # Restore base yaml
+            with open(self.yaml_file, "w") as fp:
+                fp.write(yaml_content)
+
+            # Pretend this lockfile was written by v5.17,
+            # but still holds the old legacy hash
+            lock_data["script_version"] = "5.17"
+            write_mock_lock_file(env.version_lock_path, lock_data)
+
+            env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+
+            # Fails validation because version > 5.16,
+            # meaning it only accepted modern_hash
+            self.assertFalse(env.has_valid_lockfile())
+
+            # If we update the file to the modern_hash,
+            # it immediately becomes valid again
+            lock_data["yaml_hash"] = modern_hash
+            write_mock_lock_file(env.version_lock_path, lock_data)
+            env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+            self.assertTrue(env.has_valid_lockfile())
+
     def test_envs_dir_override(self):
         env = ZwikEnvironment.from_prefix(ZwikSettings(), "abcde")
         self.assertEqual(
diff --git a/tests/test_labels.py b/tests/test_labels.py
index d9c38c8..b5d9791 100644
--- a/tests/test_labels.py
+++ b/tests/test_labels.py
@@ -112,12 +112,41 @@ def generate_lock_data(name):
                     self.dummy_server.dummy_name,
                 )
                 env.create_env()
-                # No warning expected when lock data specifies label
+                # Expect a warning that suggests adding the OBSOLETE PACKAGE comment
                 self.assertTrue("# CAUTION: OBSOLETE PACKAGE" in cm.output[0])
 
                 env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
                 env.create_env()
 
+        with self.subTest("obsolete package fixed with comment"):
+            self.dummy_server.dummy_name = "dummy-link-pkg-obsolete"
+            self.dummy_server.dummy_label = "obsolete"
+            env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
+            logger = logging.getLogger("zwik_client")
+            records = []
+
+            class _ListHandler(logging.Handler):
+                def emit(self, record):
+                    records.append(record)
+
+            handler = _ListHandler(level=logging.WARNING)
+            logger.addHandler(handler)
+            try:
+                # Mock the comment fetcher to simulate
+                # the user adding the required comment
+                with patch.object(
+                    env,
+                    "get_dependency_comment",
+                    return_value="# CAUTION: OBSOLETE PACKAGE",
+                ):
+                    env.create_env()
+            finally:
+                logger.removeHandler(handler)
+            self.assertTrue(link_exec_mock.called)
+            self.assertFalse(
+                any(record.levelno >= logging.WARNING for record in records)
+            )
+
         with self.subTest("unsafe package"):
             self.dummy_server.dummy_name = "dummy-link-pkg-unsafe"
             self.dummy_server.dummy_label = "unsafe"
@@ -126,6 +155,7 @@ def generate_lock_data(name):
                 env.create_env()
 
         with self.subTest("unsafe package fixed with comment"):
+            link_exec_mock.reset_mock()
             self.dummy_server.dummy_name = "dummy-link-pkg-unsafe"
             self.dummy_server.dummy_label = "unsafe"
             env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
@@ -136,7 +166,7 @@ def generate_lock_data(name):
             ):
                 env.create_env()
 
-            self.assertTrue(link_exec_mock.called)
+            link_exec_mock.assert_called_once()
 
     @patch("conda.core.link.UnlinkLinkTransaction.execute")
     def test_multiple_packages_with_default(self, link_exec_mock):

From 34fce0da90afa9abe4dd21ef58c6d385800269fc Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Thu, 19 Mar 2026 15:06:21 +0100
Subject: [PATCH 09/12] update the client according to new strategy where
 allow_unsafe section replaces the CAUTION  comments for unsafe packages.
 Update relevant tests.

---
 scripts/zwik_client.py | 129 +++++++++++++++++++++++------------------
 tests/test_client.py   |  30 ++++++----
 tests/test_labels.py   |  72 +++++++++--------------
 3 files changed, 116 insertions(+), 115 deletions(-)

diff --git a/scripts/zwik_client.py b/scripts/zwik_client.py
index 296f741..d205bfb 100644
--- a/scripts/zwik_client.py
+++ b/scripts/zwik_client.py
@@ -836,7 +836,7 @@ def yaml_hash(self):
                     # Convert the MatchSpec objects to strings and sort them.
                     # This allows us to reorder the yaml file and not
                     # trigger regeneration
-                    deps_to_hash = sorted([str(s) for s in env_deps.specs])
+                    deps_to_hash = sorted([str(spec) for spec in env_deps.specs])
 
                     for dep in deps_to_hash:
                         hash_md5.update(dep.encode("utf-8"))
@@ -847,16 +847,30 @@ def yaml_hash(self):
 
     def get_legacy_yaml_hash(self):
         import hashlib
-        import re
 
         hash_md5 = hashlib.md5()
         with open(self.yaml_path, "r") as f:
+            in_allow_unsafe_block = False
             for line in f.readlines():
-                # Legacy method ONLY strips UNSAFE package comments
-                # OBSOLETE comments are deliberately ignored so
-                # adding them forces a regeneration
-                line = re.sub(r"\s*#\s*CAUTION:\s*UNSAFE\s*PACKAGE.*", "", line)
-                hash_md5.update(line.encode("utf-8"))
+                if line.startswith("allow_unsafe:"):
+                    in_allow_unsafe_block = True
+                    continue
+
+                if in_allow_unsafe_block:
+                    # Skip empty lines, comments, and indented lines
+                    if (
+                        not line.strip()
+                        or line.startswith(" ")
+                        or line.startswith("\t")
+                        or line.startswith("#")
+                    ):
+                        continue
+                    else:
+                        # Reached a new root-level key, stop skipping
+                        in_allow_unsafe_block = False
+
+                if not in_allow_unsafe_block:
+                    hash_md5.update(line.encode("utf-8"))
 
         return hash_md5.hexdigest()
 
@@ -1054,10 +1068,9 @@ def create_lockfile(self, additional_dependencies=()):
         from conda.exports import subdir
 
         obsolete_pkgs = set()
-        unsafe_pkgs = set()
+        unsafe_pkgs = {}
         last_exception = None
 
-        # Keep the loop for performance: only query obsolete/unsafe if standard fails
         for labels in ((), ("obsolete",), ("obsolete", "unsafe")):
             log.debug("Checking labels %s", labels)
             solver = self.get_solver(dependencies, labels)
@@ -1072,9 +1085,7 @@ def create_lockfile(self, additional_dependencies=()):
                             if label == "obsolete":
                                 obsolete_pkgs.add(prec.name)
                             elif label == "unsafe":
-                                unsafe_pkgs.add(prec.name)
-
-                # Enforce safety comments immediately if unsafe packages are found
+                                unsafe_pkgs[prec.name] = prec.version
                 if unsafe_pkgs:
                     self.handle_unsafe_pkgs(unsafe_pkgs)
                 break
@@ -1088,21 +1099,18 @@ def create_lockfile(self, additional_dependencies=()):
         else:
             raise last_exception
 
-        # Handle Obsolete Warnings
         for pkg_name in obsolete_pkgs:
-            comment = self.get_dependency_comment(pkg_name)
-            if "CAUTION: OBSOLETE PACKAGE" not in comment:
-                log.warning(
-                    "WARNING: The package '%s' is marked as obsolete, "
-                    "try to update or find an alternative. "
-                    "Add '# CAUTION: OBSOLETE PACKAGE' to suppress this warning.",
-                    pkg_name,
-                )
+            log.warning(
+                "WARNING: The package '%s' is marked as OBSOLETE. "
+                "Consider updating to a newer version.",
+                pkg_name,
+            )
 
         for pkg_name in unsafe_pkgs:
             log.warning(
                 "WARNING: The package '%s' is marked as UNSAFE. "
-                "Client continues because of comment in environment file.",
+                "Client continues because it is explicitly allowed "
+                "in the environment file.",
                 pkg_name,
             )
 
@@ -1176,28 +1184,39 @@ def get_solver(self, dependencies, labels):
             specs_to_add=dependencies.get_specs(self.settings),
         )
 
-    def get_dependency_comment(self, pkg_name):
+    def handle_unsafe_pkgs(self, unsafe_pkgs):
+        from conda import CondaError
         from conda.exports import MatchSpec
 
-        for index, env_dep in enumerate(self.env_data.get("dependencies", [])):
-            env_dep_spec = MatchSpec(env_dep)
-            if env_dep_spec.name == pkg_name:
-                comment = self.get_yaml_comment(self.env_data["dependencies"], index)
-                return comment.strip() if comment else ""
-        return ""
+        allow_unsafe_data = self.env_data.get("allow_unsafe") or {}
+        confirm_msg = allow_unsafe_data.get("confirm", "")
+        allowed_pkgs = allow_unsafe_data.get("packages") or []
 
-    def handle_unsafe_pkgs(self, unsafe_pkgs):
-        from conda import CondaError
+        allowed_pkg_names = [MatchSpec(p).name for p in allowed_pkgs]
 
-        for pkg_name in unsafe_pkgs:
-            comment = self.get_dependency_comment(pkg_name)
-            if "CAUTION: UNSAFE PACKAGE" not in comment:
-                raise CondaError(
-                    "ERROR: The package '{}' is UNSAFE. "
-                    "You MUST add '# CAUTION: UNSAFE PACKAGE' "
-                    "comment next to the package in "
-                    "the environment file to proceed.".format(pkg_name)
-                )
+        for pkg_name, pkg_version in unsafe_pkgs.items():
+            # Check if the risk is accepted AND the package is listed
+            if (
+                confirm_msg == "Risk of unsafe packages is accepted"
+                and pkg_name in allowed_pkg_names
+            ):
+                continue
+
+            error_msg = (
+                f"\nERROR: The package '{pkg_name}' is marked as UNSAFE.\n"
+                f"To continue using this package, "
+                f"you must explicitly allow it by adding "
+                f"the 'allow_unsafe' section to your "
+                f"zwik_environment.yaml file.\n\n"
+                f"Example:\n\n"
+                f"dependencies:\n"
+                f"- your_packages\n\n"
+                f"allow_unsafe:\n"
+                f'  confirm: "Risk of unsafe packages is accepted"\n'
+                f"  packages:\n"
+                f"    - {pkg_name}=={pkg_version}\n"
+            )
+            raise CondaError(error_msg)
 
     def partially_update_lockfile(self, update_list):
         from conda.exports import MatchSpec
@@ -1250,6 +1269,7 @@ def create_env(self):
         from conda import __version__ as conda_version
         from conda.api import SubdirData
         from conda.core.link import PrefixSetup, UnlinkLinkTransaction
+        from conda.exports import MatchSpec
 
         self._check_installation()
 
@@ -1293,29 +1313,24 @@ def create_env(self):
                     "or unsafe channels: {}".format(spec)
                 )
 
-            comment = self.get_dependency_comment(spec_name)
-
             if is_obsolete:
-                if "CAUTION: OBSOLETE PACKAGE" not in comment:
-                    log.warning(
-                        "WARNING: The package '%s' is "
-                        "being loaded from an OBSOLETE channel. "
-                        "Add '# CAUTION: OBSOLETE PACKAGE' to suppress this warning.",
-                        spec_name,
-                    )
+                log.warning(
+                    "WARNING: The package '%s' is being loaded "
+                    "from an OBSOLETE channel. "
+                    "Consider updating to a newer version.",
+                    spec_name,
+                )
             elif is_unsafe:
                 log.warning(
-                    "WARNING: The package '%s' is being loaded from an UNSAFE channel.",
+                    "WARNING: The package '%s' is being loaded from "
+                    "an UNSAFE channel. Client continues because it "
+                    "is explicitly allowed in the environment file",
                     spec_name,
                 )
-                if "CAUTION: UNSAFE PACKAGE" not in comment:
-                    from conda import CondaError
 
-                    raise CondaError(
-                        "ERROR: The following package is UNSAFE: {}. "
-                        "You MUST add '# CAUTION: UNSAFE PACKAGE' to "
-                        "the environment file to proceed.".format(spec_name)
-                    )
+                ms = MatchSpec(spec)
+                pkg_version = str(ms.version) if ms.version else "<version>"
+                self.handle_unsafe_pkgs({ms.name: pkg_version})
 
             if self._multiple_packages_found(result):
                 log.warning("Multiple packages found for '%s'.", spec)
diff --git a/tests/test_client.py b/tests/test_client.py
index e63ca72..5e35075 100644
--- a/tests/test_client.py
+++ b/tests/test_client.py
@@ -164,42 +164,48 @@ def write_mock_lock_file(lock_path, data):
         write_mock_lock_file(env.version_lock_path, lock_data)
 
         # Fallback succeeds because script <= 5.16 and legacy hashes match
-        with self.subTest("legacy lock file without comments"):
+        with self.subTest("legacy lock file without allow_unsafe"):
             env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
 
             self.assertTrue(env.has_valid_lockfile())
             # Verify the client accepted the legacy hash over the modern one
             self.assertEqual(env.lock_data["yaml_hash"], legacy_hash)
 
-        # Add UNSAFE comment. The regex strips it, so
-        # the legacy hash should remain the same.
-        with self.subTest("legacy lock file with UNSAFE comment"):
+        # Add allow_unsafe block. It should be skipped for yaml
+        # hash calculation, so legacy hash should remain identical.
+        with self.subTest("legacy lock file with allow_unsafe block"):
             yaml_content_unsafe = (
-                "dependencies:\n  - python\n  - foobar # CAUTION: UNSAFE PACKAGE\n"
+                "dependencies:\n"
+                "  - python\n"
+                "  - foobar\n"
+                "allow_unsafe:\n"
+                '  confirm: "Risk of unsafe packages is accepted"\n'
+                "  packages:\n"
+                "    - foobar==1.0\n"
             )
             with open(self.yaml_file, "w") as fp:
                 fp.write(yaml_content_unsafe)
 
             env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
 
-            # Legacy hash ignored the UNSAFE comment
+            # Legacy hash successfully skipped the allow_unsafe block
             self.assertEqual(env.get_legacy_yaml_hash(), legacy_hash)
             self.assertTrue(env.has_valid_lockfile())
 
-        # Add OBSOLETE comment. The regex DOES NOT strip it,
+        # Add a new dependency. The hasher DOES NOT skip this,
         # so the legacy hash should change.
-        with self.subTest("legacy lock file with OBSOLETE comment"):
-            yaml_content_obsolete = (
-                "dependencies:\n  - python\n  - foobar # CAUTION: OBSOLETE PACKAGE\n"
+        with self.subTest("legacy lock file with new dependency"):
+            yaml_content_new_dep = (
+                "dependencies:\n" "  - python\n" "  - foobar\n" "  - new_pkg\n"
             )
             with open(self.yaml_file, "w") as fp:
-                fp.write(yaml_content_obsolete)
+                fp.write(yaml_content_new_dep)
 
             env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
 
             new_legacy_hash = env.get_legacy_yaml_hash()
 
-            # The legacy hash changed because the obsolete comment was parsed
+            # The legacy hash changed because a new package was added
             self.assertNotEqual(new_legacy_hash, legacy_hash)
 
             # Validation should fail, forcing the environment to regenerate
diff --git a/tests/test_labels.py b/tests/test_labels.py
index b5d9791..aff967f 100644
--- a/tests/test_labels.py
+++ b/tests/test_labels.py
@@ -13,7 +13,7 @@ class TestChannelLabels(DummyServerEnvironmentTest):
     def test_create_lockfile(self):
         from scripts.zwik_client import ZwikEnvironment, ZwikSettings
 
-        def get_lock_data(env_settings, package_name):
+        def get_lock_data(env_settings, package_name, allow_unsafe_data=None):
             env = ZwikEnvironment(env_settings)
             env._installation_checked = True
             env.env_data = {
@@ -21,6 +21,8 @@ def get_lock_data(env_settings, package_name):
                     package_name,
                 ],
             }
+            if allow_unsafe_data:
+                env.env_data["allow_unsafe"] = allow_unsafe_data
 
             env.lock_data = None
             with tempfile.TemporaryDirectory() as tmp_dir:
@@ -40,7 +42,6 @@ def get_lock_data(env_settings, package_name):
                 "{}=1.0=0".format(self.dummy_server.dummy_name),
                 lock_data["dependencies"],
             )
-            self.assertFalse(lock_data.get("labels"))
 
         with self.subTest("obsolete package"):
             self.dummy_server.dummy_name = "dummy-package-obsolete"
@@ -56,15 +57,20 @@ def get_lock_data(env_settings, package_name):
             self.dummy_server.dummy_name = "dummy-package-unsafe"
             self.dummy_server.dummy_label = "unsafe"
 
+            # Should fail without allow_unsafe block
             with self.assertRaises(conda.CondaError):
                 get_lock_data(settings, self.dummy_server.dummy_name)
 
-            with patch(
-                "scripts.zwik_client.ZwikEnvironment.get_yaml_comment",
-                return_value="# CAUTION: UNSAFE PACKAGE",
-            ):
-                with self.assertLogs("zwik_client", level=logging.WARNING):
-                    lock_data = get_lock_data(settings, self.dummy_server.dummy_name)
+            # Provide the allow_unsafe block
+            allow_unsafe_data = {
+                "confirm": "Risk of unsafe packages is accepted",
+                "packages": [f"{self.dummy_server.dummy_name}==1.0.0"],
+            }
+
+            with self.assertLogs("zwik_client", level=logging.WARNING):
+                lock_data = get_lock_data(
+                    settings, self.dummy_server.dummy_name, allow_unsafe_data
+                )
             self.assertIn(
                 "{}=1.0=0".format(self.dummy_server.dummy_name),
                 lock_data["dependencies"],
@@ -94,7 +100,6 @@ def generate_lock_data(name):
         env.override_prefix = "dummy"
 
         with self.subTest("normal package"):
-
             self.dummy_server.dummy_name = "dummy-link-pkg-normal"
             self.dummy_server.dummy_label = None
             env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
@@ -112,60 +117,35 @@ def generate_lock_data(name):
                     self.dummy_server.dummy_name,
                 )
                 env.create_env()
-                # Expect a warning that suggests adding the OBSOLETE PACKAGE comment
-                self.assertTrue("# CAUTION: OBSOLETE PACKAGE" in cm.output[0])
+                # Verify that a warning was displayed
+                self.assertTrue("OBSOLETE" in cm.output[0])
 
                 env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
                 env.create_env()
 
-        with self.subTest("obsolete package fixed with comment"):
-            self.dummy_server.dummy_name = "dummy-link-pkg-obsolete"
-            self.dummy_server.dummy_label = "obsolete"
-            env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
-            logger = logging.getLogger("zwik_client")
-            records = []
-
-            class _ListHandler(logging.Handler):
-                def emit(self, record):
-                    records.append(record)
-
-            handler = _ListHandler(level=logging.WARNING)
-            logger.addHandler(handler)
-            try:
-                # Mock the comment fetcher to simulate
-                # the user adding the required comment
-                with patch.object(
-                    env,
-                    "get_dependency_comment",
-                    return_value="# CAUTION: OBSOLETE PACKAGE",
-                ):
-                    env.create_env()
-            finally:
-                logger.removeHandler(handler)
-            self.assertTrue(link_exec_mock.called)
-            self.assertFalse(
-                any(record.levelno >= logging.WARNING for record in records)
-            )
-
         with self.subTest("unsafe package"):
             self.dummy_server.dummy_name = "dummy-link-pkg-unsafe"
             self.dummy_server.dummy_label = "unsafe"
             env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
+            # Fails immediately without allow_unsafe block
             with self.assertRaises(CondaError):
                 env.create_env()
 
-        with self.subTest("unsafe package fixed with comment"):
+        with self.subTest("unsafe package explicitly allowed"):
             link_exec_mock.reset_mock()
             self.dummy_server.dummy_name = "dummy-link-pkg-unsafe"
             self.dummy_server.dummy_label = "unsafe"
             env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
 
-            # Mock the comment fetcher to simulate the user adding the required comment
-            with patch.object(
-                env, "get_dependency_comment", return_value="# CAUTION: UNSAFE PACKAGE"
-            ):
-                env.create_env()
+            # Simulate the user adding the allow_unsafe block to their environment yaml
+            env.env_data = {
+                "allow_unsafe": {
+                    "confirm": "Risk of unsafe packages is accepted",
+                    "packages": [f"{self.dummy_server.dummy_name}==1.0"],
+                }
+            }
 
+            env.create_env()
             link_exec_mock.assert_called_once()
 
     @patch("conda.core.link.UnlinkLinkTransaction.execute")

From 969b4a956b2bd0f4f5870ba748165a315804a2e1 Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Tue, 24 Mar 2026 13:42:39 +0100
Subject: [PATCH 10/12] refactor get_legacy_yaml_hash to use regex instead
 if/else blocks. Raise CondaError if env_data does not exists when yaml_hash
 is calculated.

---
 scripts/zwik_client.py | 24 +++++++++++-------------
 tests/test_client.py   | 12 ++++++++++++
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/scripts/zwik_client.py b/scripts/zwik_client.py
index d205bfb..306c353 100644
--- a/scripts/zwik_client.py
+++ b/scripts/zwik_client.py
@@ -820,6 +820,8 @@ def conda_envs_dir(self):
 
     @property
     def yaml_hash(self):
+        from conda import CondaError
+
         if not self._yaml_hash:
             import hashlib
 
@@ -834,12 +836,17 @@ def yaml_hash(self):
                     env_deps = self.get_dependencies(additional_dependencies=[])
 
                     # Convert the MatchSpec objects to strings and sort them.
-                    # This allows us to reorder the yaml file and not
+                    # This allows the user to reorder the yaml file and not
                     # trigger regeneration
                     deps_to_hash = sorted([str(spec) for spec in env_deps.specs])
 
                     for dep in deps_to_hash:
                         hash_md5.update(dep.encode("utf-8"))
+            else:
+                raise CondaError(
+                    "env_data could not be loaded, "
+                    "check is zwik_environment.yaml is defined."
+                )
 
             self._yaml_hash = hash_md5.hexdigest()
 
@@ -856,18 +863,9 @@ def get_legacy_yaml_hash(self):
                     in_allow_unsafe_block = True
                     continue
 
-                if in_allow_unsafe_block:
-                    # Skip empty lines, comments, and indented lines
-                    if (
-                        not line.strip()
-                        or line.startswith(" ")
-                        or line.startswith("\t")
-                        or line.startswith("#")
-                    ):
-                        continue
-                    else:
-                        # Reached a new root-level key, stop skipping
-                        in_allow_unsafe_block = False
+                elif in_allow_unsafe_block and re.match(r"^[^\s#]", line):
+                    # Reached a new root-level key, stop skipping
+                    in_allow_unsafe_block = False
 
                 if not in_allow_unsafe_block:
                     hash_md5.update(line.encode("utf-8"))
diff --git a/tests/test_client.py b/tests/test_client.py
index 5e35075..6fc04a5 100644
--- a/tests/test_client.py
+++ b/tests/test_client.py
@@ -235,6 +235,18 @@ def write_mock_lock_file(lock_path, data):
             env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
             self.assertTrue(env.has_valid_lockfile())
 
+    def test_yaml_hash_without_env_data(self):
+        from conda import CondaError
+        from scripts.zwik_client import ZwikEnvironment, ZwikSettings
+
+        env = ZwikEnvironment(ZwikSettings())
+
+        # Explicitly ensure env_data is not set
+        env.env_data = None
+
+        with self.assertRaises(CondaError):
+            _ = env.yaml_hash
+
     def test_envs_dir_override(self):
         env = ZwikEnvironment.from_prefix(ZwikSettings(), "abcde")
         self.assertEqual(

From 72adece1e6127f8b625db8e77c3247127e76d3e6 Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Tue, 24 Mar 2026 14:32:39 +0100
Subject: [PATCH 11/12] apply isort

---
 tests/test_client.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/test_client.py b/tests/test_client.py
index 6fc04a5..3cbcb52 100644
--- a/tests/test_client.py
+++ b/tests/test_client.py
@@ -237,6 +237,7 @@ def write_mock_lock_file(lock_path, data):
 
     def test_yaml_hash_without_env_data(self):
         from conda import CondaError
+
         from scripts.zwik_client import ZwikEnvironment, ZwikSettings
 
         env = ZwikEnvironment(ZwikSettings())

From 6b54df8fc81bc5d0dcc5651b6f8aaaaad00dabb6 Mon Sep 17 00:00:00 2001
From: Rudolfs Praulins <92643844+rudispr@users.noreply.github.com>
Date: Thu, 26 Mar 2026 10:13:08 +0100
Subject: [PATCH 12/12] improve logging messages

---
 scripts/zwik_client.py | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/scripts/zwik_client.py b/scripts/zwik_client.py
index 306c353..54888de 100644
--- a/scripts/zwik_client.py
+++ b/scripts/zwik_client.py
@@ -845,7 +845,7 @@ def yaml_hash(self):
             else:
                 raise CondaError(
                     "env_data could not be loaded, "
-                    "check is zwik_environment.yaml is defined."
+                    "check if zwik_environment.yaml is defined."
                 )
 
             self._yaml_hash = hash_md5.hexdigest()
@@ -1099,14 +1099,14 @@ def create_lockfile(self, additional_dependencies=()):
 
         for pkg_name in obsolete_pkgs:
             log.warning(
-                "WARNING: The package '%s' is marked as OBSOLETE. "
+                "The package '%s' is marked as OBSOLETE. "
                 "Consider updating to a newer version.",
                 pkg_name,
             )
 
         for pkg_name in unsafe_pkgs:
             log.warning(
-                "WARNING: The package '%s' is marked as UNSAFE. "
+                "The package '%s' is marked as UNSAFE. "
                 "Client continues because it is explicitly allowed "
                 "in the environment file.",
                 pkg_name,
@@ -1208,7 +1208,7 @@ def handle_unsafe_pkgs(self, unsafe_pkgs):
                 f"zwik_environment.yaml file.\n\n"
                 f"Example:\n\n"
                 f"dependencies:\n"
-                f"- your_packages\n\n"
+                f"- {pkg_name}\n\n"
                 f"allow_unsafe:\n"
                 f'  confirm: "Risk of unsafe packages is accepted"\n'
                 f"  packages:\n"
@@ -1313,15 +1313,14 @@ def create_env(self):
 
             if is_obsolete:
                 log.warning(
-                    "WARNING: The package '%s' is being loaded "
-                    "from an OBSOLETE channel. "
+                    "The package '%s' is OBSOLETE. "
                     "Consider updating to a newer version.",
                     spec_name,
                 )
             elif is_unsafe:
                 log.warning(
-                    "WARNING: The package '%s' is being loaded from "
-                    "an UNSAFE channel. Client continues because it "
+                    "The package '%s' is UNSAFE. "
+                    "Client continues because it "
                     "is explicitly allowed in the environment file",
                     spec_name,
                 )