I wanted to update py-setuptools-rust to the newest version and ran into something that might be a bug regarding the chosen download path.

I updated the package to use pypi as default but wanted to keep the existing checksum for the old package (to avoid breaking anything), so my package.py looks like this:

from spack import *


class PySetuptoolsRust(PythonPackage):
    """Setuptools rust extension plugin."""

    homepage = "https://github.com/PyO3/setuptools-rust"
    pypi = "setuptools-rust/setuptools-rust-0.12.1.tar.gz"

    version('0.12.1', sha256='647009e924f0ae439c7f3e0141a184a69ad247ecb9044c511dabde232d3d570e')
    version('0.10.6', sha256='1446d3985e4aaf4cc679fda8a48a73ac1390b627c8ae1bebe7d9e08bb3b33769',
            url="https://github.com/PyO3/setuptools-rust/archive/v0.10.6.tar.gz")

    depends_on('python@3.6:', when='@0.12:', type=('build', 'run'))
    depends_on('py-setuptools@46.1:', when='@0.12:', type='build')
    depends_on('py-setuptools', when='@:0.11', type='build')
    depends_on('py-semantic-version@2.6.0:', type=('build', 'run'))
    depends_on('py-toml@0.9.0:', type=('build', 'run'))
    depends_on('rust', type='run')

When running spack checksum py-setuptools-rust for the latest package, spack still uses the github url

==> How many would you like to checksum? (default is 1, q to abort)  
==> Fetching https://github.com/PyO3/setuptools-rust/archive/refs/tags/v0.12.1.tar.gz

Wheras if I remove url=.... from version 0.10.6, version 0.12.1 is correctly fetched from pypi. But this means that 0.10.6 is broken since it does not exist there (and if so the checksum would be wrong).

==> How many would you like to checksum? (default is 1, q to abort)
==> Fetching https://files.pythonhosted.org/packages/12/22/6ba3031e7cbd6eb002e13ffc7397e136df95813b6a2bd71ece52a8f89613/setuptools-rust-0.12.1.tar.gz#sha256=647009e924f0ae439c7f3e0141a184a69ad247ecb9044c511dabde232d3d570e

I thought the download mechanism works like this:

1. try the default url (here pypi)
2. if a version specific url is defined use this one instead only for that version

Do I understand something wrong here or is this a bug?

A workaround is to define url_for_version in this case but I still wanted to report the behaviour

Information on your system

• Spack: 0.13.4-8544-c8868f1922
• Python: 3.5.3
• Platform: linux-debian9-piledriver
• Concretizer: clingo

Additional information

• I have run spack debug report and reported the version of Spack/Python/Platform
• I have searched the issues of this repo and believe this is not a duplicate