How to override the "unsafeFlags" behavior of Swift Package Manager?

Question

Swift Pacakage Manager allows a package manifest (Package.swift) file to specify build settings for targets.

As a security measure, some build settings can only be specified using "unsafeFlags" parameter. For example, specifying a framework search path outside the current directory using the -F build flag is considered "unsafe" because it could lead to code execution outside the package's own directory.

For packages downloaded from the internet, this could be considered an undesirable behavior. However, for locally-declared packages, this could be what we want to do.

However the design of SPM is such that any package that uses "unsafeFlags" cannot be depended on by another package.

Is there any override for this, for example, if we want to use unsafeFlags somewhere in a dependency structure of various locally-declared Swift packages?

Like, is there a setting we can supply for a package, framework, or app, so that it's allowed to depend on packages that use "unsafeFlags"?

Answer 1

Swift Package Manager allows unsafeOptions for dependencies specified by a commit hash. They're not allowed for versioned dependencies.

Example here.