`--unsafe-package` doesn't normalize hyphens/underscores

[ntjess]

Pip resolves package-name and package_name to the same dependency. However, the unsafe package specifier doesn't take this into account on the latest released version.

Example: pip-compile --unsafe-package opencv_python --no-allow-unsafe still installs opencv-python in the final output.

[webknjaz]

Sounds like a normalization issue. Is it still reproducible on main? I think there were some PRs related to normalizing the dist names in the summer.

[webknjaz]

A good starting point would be submitting a PR with regression tests.

[ntjess]

Here's my reproduction:

# in a new environment
pip install "pip-tools@git+https://github.com/jazzband/pip-tools@main"
pip-compile --version
# pip-compile, version 7.4.2.dev87

# tmp.in contains just `opencv-python`
pip-compile tmp.in --no-allow-unsafe --unsafe-package opencv_python

Outputs:

#
# This file is autogenerated by pip-compile with Python 3.12
# by the following command:
#
#    pip-compile --unsafe-package=opencv_python tmp.in
#
numpy==2.2.1
    # via opencv-python
opencv-python==4.10.0.84
    # via -r tmp.in

If you change --unsafe-package to opencv-python, it works as expected