url stats: add `--show-issues` option (#25792)

* tests: make `spack url [stats|summary]` work on mock packages

Mock packages have historically had mock hashes, but this means they're also invalid
as far as Spack's hash detection is concerned.

- [x] convert all hashes in mock package to md5 or sha256
- [x] ensure that all mock packages have a URL
- [x] ignore some special cases with multiple VCS fetchers

* url stats: add `--show-issues` option

`spack url stats` tells us how many URLs are using what protocol, type of checksum,
etc., but it previously did not tell us which packages and URLs had the issues. This
adds a `--show-issues` option to show URLs with insecure (`http`) URLs or `md5` hashes
(which are now deprecated by NIST).

70 files changed, 266 insertions, 169 deletions

diff --git a/lib/spack/spack/cmd/url.py b/lib/spack/spack/cmd/url.py
index 8d9232203f..e3182478ab 100644
--- a/lib/spack/spack/cmd/url.py
+++ b/lib/spack/spack/cmd/url.py
@@ -9,6 +9,7 @@ from collections import defaultdict
 
 import six.moves.urllib.parse as urllib_parse
 
+import llnl.util.tty.color as color
 from llnl.util import tty
 
 import spack.fetch_strategy as fs
@@ -80,9 +81,13 @@ def setup_parser(subparser):
         help='print a summary of how well we are parsing package urls')
 
     # Stats
-    sp.add_parser(
+    stats_parser = sp.add_parser(
         'stats',
         help='print statistics on versions and checksums for all packages')
+    stats_parser.add_argument(
+        "--show-issues", action="store_true",
+        help="show packages with issues (md5 hashes, http urls)"
+    )
 
 
 def url(parser, args):
@@ -262,6 +267,9 @@ def url_summary(args):
 
 
 def url_stats(args):
+    # dictionary of issue type -> package -> descriptions
+    issues = defaultdict(lambda: defaultdict(lambda: []))
+
     class UrlStats(object):
         def __init__(self):
             self.total = 0
@@ -270,7 +278,7 @@ def url_stats(args):
             self.url_type = defaultdict(lambda: 0)
             self.git_type = defaultdict(lambda: 0)
 
-        def add(self, fetcher):
+        def add(self, pkg_name, fetcher):
             self.total += 1
 
             url_type = fetcher.url_attr
@@ -284,10 +292,18 @@ def url_stats(args):
                     algo = 'no checksum'
                 self.checksums[algo] += 1
 
+                if algo == "md5":
+                    md5_hashes = issues["md5 hashes"]
+                    md5_hashes[pkg_name].append(fetcher.url)
+
                 # parse out the URL scheme (https/http/ftp/etc.)
                 urlinfo = urllib_parse.urlparse(fetcher.url)
                 self.schemes[urlinfo.scheme] += 1
 
+                if urlinfo.scheme == "http":
+                    http_urls = issues["http urls"]
+                    http_urls[pkg_name].append(fetcher.url)
+
             elif url_type == 'git':
                 if getattr(fetcher, 'commit', None):
                     self.git_type['commit'] += 1
@@ -305,13 +321,16 @@ def url_stats(args):
     for pkg in spack.repo.path.all_packages():
         npkgs += 1
 
-        for v, args in pkg.versions.items():
-            fetcher = fs.for_package_version(pkg, v)
-            version_stats.add(fetcher)
+        for v in pkg.versions:
+            try:
+                fetcher = fs.for_package_version(pkg, v)
+            except (fs.InvalidArgsError, fs.FetcherConflict):
+                continue
+            version_stats.add(pkg.name, fetcher)
 
         for _, resources in pkg.resources.items():
             for resource in resources:
-                resource_stats.add(resource.fetcher)
+                resource_stats.add(pkg.name, resource.fetcher)
 
     # print a nice summary table
     tty.msg("URL stats for %d packages:" % npkgs)
@@ -361,6 +380,21 @@ def url_stats(args):
         print_stat(4, git_type, "git_type")
     print_line()
 
+    if args.show_issues:
+        total_issues = sum(
+            len(issues)
+            for _, pkg_issues in issues.items()
+            for _, issues in pkg_issues.items()
+        )
+        print()
+        tty.msg("Found %d issues." % total_issues)
+        for issue_type, pkgs in issues.items():
+            tty.msg("Package URLs with %s" % issue_type)
+            for pkg, pkg_issues in pkgs.items():
+                color.cprint("    @*C{%s}" % pkg)
+                for issue in pkg_issues:
+                    print("      %s" % issue)
+
 
 def print_name_and_version(url):
     """Prints a URL. Underlines the detected name with dashes and
diff --git a/lib/spack/spack/test/cmd/url.py b/lib/spack/spack/test/cmd/url.py
index b5b2b9feba..f9179720b1 100644
--- a/lib/spack/spack/test/cmd/url.py
+++ b/lib/spack/spack/test/cmd/url.py
@@ -69,13 +69,15 @@ def test_url_with_no_version_fails():
         url('parse', 'http://www.netlib.org/voronoi/triangle.zip')
 
 
-@pytest.mark.maybeslow
-@pytest.mark.skipif(
+skip_python_26 = pytest.mark.skipif(
     sys.version_info < (2, 7),
     reason="Python 2.6 tests are run in a container, where "
            "networking is super slow"
 )
-def test_url_list():
+
+
+@skip_python_26
+def test_url_list(mock_packages):
     out = url('list')
     total_urls = len(out.split('\n'))
 
@@ -104,13 +106,8 @@ def test_url_list():
     assert 0 < correct_version_urls < total_urls
 
 
-@pytest.mark.maybeslow
-@pytest.mark.skipif(
-    sys.version_info < (2, 7),
-    reason="Python 2.6 tests are run in a container, where "
-           "networking is super slow"
-)
-def test_url_summary():
+@skip_python_26
+def test_url_summary(mock_packages):
     """Test the URL summary command."""
     # test url_summary, the internal function that does the work
     (total_urls, correct_names, correct_versions,
@@ -136,12 +133,8 @@ def test_url_summary():
     assert out_correct_versions == correct_versions
 
 
-@pytest.mark.skipif(
-    sys.version_info < (2, 7),
-    reason="Python 2.6 tests are run in a container, where "
-           "networking is super slow"
-)
-def test_url_stats(capfd):
+@skip_python_26
+def test_url_stats(capfd, mock_packages):
     with capfd.disabled():
         output = url('stats')
         npkgs = '%d packages' % len(spack.repo.all_package_names())
@@ -151,3 +144,20 @@ def test_url_stats(capfd):
         assert 'schemes' in output
         assert 'versions' in output
         assert 'resources' in output
+
+        output = url('stats', '--show-issues')
+        npkgs = '%d packages' % len(spack.repo.all_package_names())
+        assert npkgs in output
+        assert 'url' in output
+        assert 'git' in output
+        assert 'schemes' in output
+        assert 'versions' in output
+        assert 'resources' in output
+
+        assert 'Package URLs with md5 hashes' in output
+        assert 'needs-relocation' in output
+        assert 'https://cmake.org/files/v3.4/cmake-0.0.0.tar.gz' in output
+
+        assert 'Package URLs with http urls' in output
+        assert 'zmpi' in output
+        assert 'http://www.spack-fake-zmpi.org/downloads/zmpi-1.0.tar.gz' in output
diff --git a/lib/spack/spack/test/packages.py b/lib/spack/spack/test/packages.py
index 16e209c42c..4ebf1af69c 100644
--- a/lib/spack/spack/test/packages.py
+++ b/lib/spack/spack/test/packages.py
@@ -281,25 +281,28 @@ def test_git_url_top_level_url_versions(mock_packages, config):
 
     pkg = spack.repo.get('git-url-top-level')
 
+    # leading 62 zeros of sha256 hash
+    leading_zeros = '0' * 62
+
     fetcher = spack.fetch_strategy.for_package_version(pkg, '2.0')
     assert isinstance(fetcher, spack.fetch_strategy.URLFetchStrategy)
     assert fetcher.url == 'https://example.com/some/tarball-2.0.tar.gz'
-    assert fetcher.digest == 'abc20'
+    assert fetcher.digest == leading_zeros + '20'
 
     fetcher = spack.fetch_strategy.for_package_version(pkg, '2.1')
     assert isinstance(fetcher, spack.fetch_strategy.URLFetchStrategy)
     assert fetcher.url == 'https://example.com/some/tarball-2.1.tar.gz'
-    assert fetcher.digest == 'abc21'
+    assert fetcher.digest == leading_zeros + '21'
 
     fetcher = spack.fetch_strategy.for_package_version(pkg, '2.2')
     assert isinstance(fetcher, spack.fetch_strategy.URLFetchStrategy)
     assert fetcher.url == 'https://www.example.com/foo2.2.tar.gz'
-    assert fetcher.digest == 'abc22'
+    assert fetcher.digest == leading_zeros + '22'
 
     fetcher = spack.fetch_strategy.for_package_version(pkg, '2.3')
     assert isinstance(fetcher, spack.fetch_strategy.URLFetchStrategy)
     assert fetcher.url == 'https://www.example.com/foo2.3.tar.gz'
-    assert fetcher.digest == 'abc23'
+    assert fetcher.digest == leading_zeros + '23'
 
 
 def test_git_url_top_level_git_versions(mock_packages, config):
@@ -409,15 +412,15 @@ def test_fetch_options(mock_packages, config):
 
     fetcher = spack.fetch_strategy.for_package_version(pkg, '1.0')
     assert isinstance(fetcher, spack.fetch_strategy.URLFetchStrategy)
-    assert fetcher.digest == 'abc10'
+    assert fetcher.digest == '00000000000000000000000000000010'
     assert fetcher.extra_options == {'timeout': 42, 'cookie': 'foobar'}
 
     fetcher = spack.fetch_strategy.for_package_version(pkg, '1.1')
     assert isinstance(fetcher, spack.fetch_strategy.URLFetchStrategy)
-    assert fetcher.digest == 'abc11'
+    assert fetcher.digest == '00000000000000000000000000000011'
     assert fetcher.extra_options == {'timeout': 65}
 
     fetcher = spack.fetch_strategy.for_package_version(pkg, '1.2')
     assert isinstance(fetcher, spack.fetch_strategy.URLFetchStrategy)
-    assert fetcher.digest == 'abc12'
+    assert fetcher.digest == '00000000000000000000000000000012'
     assert fetcher.extra_options == {'cookie': 'baz'}
diff --git a/lib/spack/spack/test/url_fetch.py b/lib/spack/spack/test/url_fetch.py
index b0bd53af72..11a282dc2c 100644
--- a/lib/spack/spack/test/url_fetch.py
+++ b/lib/spack/spack/test/url_fetch.py
@@ -160,13 +160,21 @@ def test_fetch(
 
 
 @pytest.mark.parametrize('spec,url,digest', [
-    ('url-list-test @0.0.0', 'foo-0.0.0.tar.gz', 'abc000'),
-    ('url-list-test @1.0.0', 'foo-1.0.0.tar.gz', 'abc100'),
-    ('url-list-test @3.0', 'foo-3.0.tar.gz', 'abc30'),
-    ('url-list-test @4.5', 'foo-4.5.tar.gz', 'abc45'),
-    ('url-list-test @2.0.0b2', 'foo-2.0.0b2.tar.gz', 'abc200b2'),
-    ('url-list-test @3.0a1', 'foo-3.0a1.tar.gz', 'abc30a1'),
-    ('url-list-test @4.5-rc5', 'foo-4.5-rc5.tar.gz', 'abc45rc5'),
+    ('url-list-test @0.0.0', 'foo-0.0.0.tar.gz', '00000000000000000000000000000000'),
+    ('url-list-test @1.0.0', 'foo-1.0.0.tar.gz', '00000000000000000000000000000100'),
+    ('url-list-test @3.0', 'foo-3.0.tar.gz', '00000000000000000000000000000030'),
+    ('url-list-test @4.5', 'foo-4.5.tar.gz', '00000000000000000000000000000450'),
+    (
+        'url-list-test @2.0.0b2',
+        'foo-2.0.0b2.tar.gz',
+        '000000000000000000000000000200b2'
+    ),
+    ('url-list-test @3.0a1', 'foo-3.0a1.tar.gz', '000000000000000000000000000030a1'),
+    (
+        'url-list-test @4.5-rc5',
+        'foo-4.5-rc5.tar.gz',
+        '000000000000000000000000000045c5'
+    ),
 ])
 @pytest.mark.parametrize('_fetch_method', ['curl', 'urllib'])
 def test_from_list_url(mock_packages, config, spec, url, digest, _fetch_method):
diff --git a/share/spack/spack-completion.bash b/share/spack/spack-completion.bash
index 436ff345e7..8a392720d6 100755
--- a/share/spack/spack-completion.bash
+++ b/share/spack/spack-completion.bash
@@ -1798,7 +1798,7 @@ _spack_url_summary() {
 }
 
 _spack_url_stats() {
-    SPACK_COMPREPLY="-h --help"
+    SPACK_COMPREPLY="-h --help --show-issues"
 }
 
 _spack_verify() {
diff --git a/var/spack/repos/builtin.mock/packages/a/package.py b/var/spack/repos/builtin.mock/packages/a/package.py
index 37570ebf7a..436ac462cd 100644
--- a/var/spack/repos/builtin.mock/packages/a/package.py
+++ b/var/spack/repos/builtin.mock/packages/a/package.py
@@ -13,7 +13,7 @@ class A(AutotoolsPackage):
     url      = "http://www.example.com/a-1.0.tar.gz"
 
     version('1.0', '0123456789abcdef0123456789abcdef')
-    version('2.0', '2.0_a_hash')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     variant(
         'foo', description='',
diff --git a/var/spack/repos/builtin.mock/packages/archive-files/package.py b/var/spack/repos/builtin.mock/packages/archive-files/package.py
index 12d11e514c..3d2b6f0a5a 100644
--- a/var/spack/repos/builtin.mock/packages/archive-files/package.py
+++ b/var/spack/repos/builtin.mock/packages/archive-files/package.py
@@ -13,7 +13,7 @@ class ArchiveFiles(AutotoolsPackage):
     url = "http://www.example.com/a-1.0.tar.gz"
 
     version('1.0', '0123456789abcdef0123456789abcdef')
-    version('2.0', '2.0_a_hash')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     @property
     def archive_files(self):
diff --git a/var/spack/repos/builtin.mock/packages/build-error/package.py b/var/spack/repos/builtin.mock/packages/build-error/package.py
index 5f0c937786..78873d7fb9 100644
--- a/var/spack/repos/builtin.mock/packages/build-error/package.py
+++ b/var/spack/repos/builtin.mock/packages/build-error/package.py
@@ -12,7 +12,7 @@ class BuildError(Package):
     homepage = "http://www.example.com/trivial_install"
     url      = "http://www.unit-test-should-replace-this-url/trivial_install-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         with open('configure', 'w') as f:
diff --git a/var/spack/repos/builtin.mock/packages/build-warnings/package.py b/var/spack/repos/builtin.mock/packages/build-warnings/package.py
index f46452061f..28c2dd4ba4 100644
--- a/var/spack/repos/builtin.mock/packages/build-warnings/package.py
+++ b/var/spack/repos/builtin.mock/packages/build-warnings/package.py
@@ -12,7 +12,7 @@ class BuildWarnings(Package):
     homepage = "http://www.example.com/trivial_install"
     url      = "http://www.unit-test-should-replace-this-url/trivial_install-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         with open('configure', 'w') as f:
diff --git a/var/spack/repos/builtin.mock/packages/callpath/package.py b/var/spack/repos/builtin.mock/packages/callpath/package.py
index cf29e38dd9..cbd9e1afaa 100644
--- a/var/spack/repos/builtin.mock/packages/callpath/package.py
+++ b/var/spack/repos/builtin.mock/packages/callpath/package.py
@@ -10,9 +10,9 @@ class Callpath(Package):
     homepage = "https://github.com/tgamblin/callpath"
     url      = "http://github.com/tgamblin/callpath-1.0.tar.gz"
 
-    version(0.8, 'foobarbaz')
-    version(0.9, 'foobarbaz')
-    version(1.0, 'foobarbaz')
+    version(0.8, '0123456789abcdef0123456789abcdef')
+    version(0.9, '0123456789abcdef0123456789abcdef')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     depends_on("dyninst")
     depends_on("mpi")
diff --git a/var/spack/repos/builtin.mock/packages/conflict-parent/package.py b/var/spack/repos/builtin.mock/packages/conflict-parent/package.py
index 0961f8df1b..af296e3f53 100644
--- a/var/spack/repos/builtin.mock/packages/conflict-parent/package.py
+++ b/var/spack/repos/builtin.mock/packages/conflict-parent/package.py
@@ -10,9 +10,9 @@ class ConflictParent(Package):
     homepage = 'https://github.com/tgamblin/callpath'
     url = 'http://github.com/tgamblin/callpath-1.0.tar.gz'
 
-    version(0.8, 'foobarbaz')
-    version(0.9, 'foobarbaz')
-    version(1.0, 'foobarbaz')
+    version(0.8, '0123456789abcdef0123456789abcdef')
+    version(0.9, '0123456789abcdef0123456789abcdef')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     depends_on('conflict')
 
diff --git a/var/spack/repos/builtin.mock/packages/conflict/package.py b/var/spack/repos/builtin.mock/packages/conflict/package.py
index a4c81bc4d7..1937e31d80 100644
--- a/var/spack/repos/builtin.mock/packages/conflict/package.py
+++ b/var/spack/repos/builtin.mock/packages/conflict/package.py
@@ -10,9 +10,9 @@ class Conflict(Package):
     homepage = 'https://github.com/tgamblin/callpath'
     url = 'http://github.com/tgamblin/callpath-1.0.tar.gz'
 
-    version(0.8, 'foobarbaz')
-    version(0.9, 'foobarbaz')
-    version(1.0, 'foobarbaz')
+    version(0.8, '0123456789abcdef0123456789abcdef')
+    version(0.9, '0123456789abcdef0123456789abcdef')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     variant('foo', default=True, description='')
 
diff --git a/var/spack/repos/builtin.mock/packages/dependency-install/package.py b/var/spack/repos/builtin.mock/packages/dependency-install/package.py
index 35f627c92f..3a5157ca1c 100644
--- a/var/spack/repos/builtin.mock/packages/dependency-install/package.py
+++ b/var/spack/repos/builtin.mock/packages/dependency-install/package.py
@@ -12,8 +12,8 @@ class DependencyInstall(Package):
     homepage = "http://www.example.com"
     url      = "http://www.example.com/a-1.0.tar.gz"
 
-    version('1.0', 'hash1.0')
-    version('2.0', 'hash2.0')
+    version('1.0', '0123456789abcdef0123456789abcdef')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     def install(self, spec, prefix):
         touch(join_path(prefix, 'an_installation_file'))
diff --git a/var/spack/repos/builtin.mock/packages/dependent-of-dev-build/package.py b/var/spack/repos/builtin.mock/packages/dependent-of-dev-build/package.py
index 9b86790a78..9bb36f2af2 100644
--- a/var/spack/repos/builtin.mock/packages/dependent-of-dev-build/package.py
+++ b/var/spack/repos/builtin.mock/packages/dependent-of-dev-build/package.py
@@ -8,7 +8,7 @@ class DependentOfDevBuild(Package):
     homepage = "example.com"
     url = "fake.com"
 
-    version('0.0.0', sha256='0123456789abcdefgh')
+    version('0.0.0', sha256='0123456789abcdef0123456789abcdef')
 
     depends_on('dev-build-test-install')
 
diff --git a/var/spack/repos/builtin.mock/packages/dev-build-test-dependent/package.py b/var/spack/repos/builtin.mock/packages/dev-build-test-dependent/package.py
index 973bc22153..5056670b8f 100644
--- a/var/spack/repos/builtin.mock/packages/dev-build-test-dependent/package.py
+++ b/var/spack/repos/builtin.mock/packages/dev-build-test-dependent/package.py
@@ -8,7 +8,7 @@ class DevBuildTestDependent(Package):
     homepage = "example.com"
     url = "fake.com"
 
-    version('0.0.0', sha256='0123456789abcdefgh')
+    version('0.0.0', sha256='0123456789abcdef0123456789abcdef')
 
     phases = ['edit', 'install']
 
diff --git a/var/spack/repos/builtin.mock/packages/dev-build-test-install-phases/package.py b/var/spack/repos/builtin.mock/packages/dev-build-test-install-phases/package.py
index 7957325d21..72fe849ba3 100644
--- a/var/spack/repos/builtin.mock/packages/dev-build-test-install-phases/package.py
+++ b/var/spack/repos/builtin.mock/packages/dev-build-test-install-phases/package.py
@@ -10,7 +10,7 @@ class DevBuildTestInstallPhases(Package):
     homepage = "example.com"
     url = "fake.com"
 
-    version('0.0.0', sha256='0123456789abcdefgh')
+    version('0.0.0', sha256='0123456789abcdef0123456789abcdef')
 
     phases = ['one', 'two', 'three', 'install']
 
diff --git a/var/spack/repos/builtin.mock/packages/dev-build-test-install/package.py b/var/spack/repos/builtin.mock/packages/dev-build-test-install/package.py
index b72b090855..b1dc16c245 100644
--- a/var/spack/repos/builtin.mock/packages/dev-build-test-install/package.py
+++ b/var/spack/repos/builtin.mock/packages/dev-build-test-install/package.py
@@ -8,7 +8,7 @@ class DevBuildTestInstall(Package):
     homepage = "example.com"
     url = "fake.com"
 
-    version('0.0.0', sha256='0123456789abcdefgh')
+    version('0.0.0', sha256='0123456789abcdef0123456789abcdef')
 
     phases = ['edit', 'install']
 
diff --git a/var/spack/repos/builtin.mock/packages/direct-mpich/package.py b/var/spack/repos/builtin.mock/packages/direct-mpich/package.py
index 658b2d03f2..31cb572ca5 100644
--- a/var/spack/repos/builtin.mock/packages/direct-mpich/package.py
+++ b/var/spack/repos/builtin.mock/packages/direct-mpich/package.py
@@ -10,6 +10,6 @@ class DirectMpich(Package):
     homepage = "http://www.example.com"
     url      = "http://www.example.com/direct_mpich-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     depends_on('mpich')
diff --git a/var/spack/repos/builtin.mock/packages/dyninst/package.py b/var/spack/repos/builtin.mock/packages/dyninst/package.py
index ebaa2afe81..7758f1d6cb 100644
--- a/var/spack/repos/builtin.mock/packages/dyninst/package.py
+++ b/var/spack/repos/builtin.mock/packages/dyninst/package.py
@@ -10,11 +10,11 @@ class Dyninst(Package):
     homepage = "https://paradyn.org"
     url      = "http://www.paradyn.org/release8.1/DyninstAPI-8.1.1.tgz"
 
-    version('8.2',   'cxyzab',
+    version('8.2',   '0123456789abcdef0123456789abcdef',
             url='http://www.paradyn.org/release8.2/DyninstAPI-8.2.tgz')
-    version('8.1.2', 'bcxyza',
+    version('8.1.2', 'fedcba9876543210fedcba9876543210',
             url='http://www.paradyn.org/release8.1.2/DyninstAPI-8.1.2.tgz')
-    version('8.1.1', 'abcxyz',
+    version('8.1.1', '123456789abcdef0123456789abcdef0',
             url='http://www.paradyn.org/release8.1/DyninstAPI-8.1.1.tgz')
 
     depends_on("libelf")
diff --git a/var/spack/repos/builtin.mock/packages/extendee/package.py b/var/spack/repos/builtin.mock/packages/extendee/package.py
index edb2c8dd77..6bb6a7bad1 100644
--- a/var/spack/repos/builtin.mock/packages/extendee/package.py
+++ b/var/spack/repos/builtin.mock/packages/extendee/package.py
@@ -14,7 +14,7 @@ class Extendee(Package):
 
     extendable = True
 
-    version('1.0', 'hash-extendee-1.0')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/extension1/package.py b/var/spack/repos/builtin.mock/packages/extension1/package.py
index 9f0028888a..69443c1be5 100644
--- a/var/spack/repos/builtin.mock/packages/extension1/package.py
+++ b/var/spack/repos/builtin.mock/packages/extension1/package.py
@@ -16,8 +16,8 @@ class Extension1(Package):
 
     extends('extendee')
 
-    version('1.0', 'hash-extension1-1.0')
-    version('2.0', 'hash-extension1-2.0')
+    version('1.0', '0123456789abcdef0123456789abcdef')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/extension2/package.py b/var/spack/repos/builtin.mock/packages/extension2/package.py
index 4b661e0d55..6e2a4badef 100644
--- a/var/spack/repos/builtin.mock/packages/extension2/package.py
+++ b/var/spack/repos/builtin.mock/packages/extension2/package.py
@@ -18,7 +18,7 @@ class Extension2(Package):
     extends('extendee')
     depends_on('extension1', type=('build', 'run'))
 
-    version('1.0', 'hash-extension2-1.0')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/failing-build/package.py b/var/spack/repos/builtin.mock/packages/failing-build/package.py
index c8ffbf6610..f9063092f8 100644
--- a/var/spack/repos/builtin.mock/packages/failing-build/package.py
+++ b/var/spack/repos/builtin.mock/packages/failing-build/package.py
@@ -12,7 +12,7 @@ class FailingBuild(Package):
     homepage = "http://www.example.com/trivial_install"
     url      = "http://www.unit-test-should-replace-this-url/trivial_install-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         raise InstallError("Expected failure.")
diff --git a/var/spack/repos/builtin.mock/packages/fake/package.py b/var/spack/repos/builtin.mock/packages/fake/package.py
index 83ce64e3e5..2946656efe 100644
--- a/var/spack/repos/builtin.mock/packages/fake/package.py
+++ b/var/spack/repos/builtin.mock/packages/fake/package.py
@@ -10,4 +10,4 @@ class Fake(Package):
     homepage = "http://www.fake-spack-example.org"
     url      = "http://www.fake-spack-example.org/downloads/fake-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
diff --git a/var/spack/repos/builtin.mock/packages/fetch-options/package.py b/var/spack/repos/builtin.mock/packages/fetch-options/package.py
index 3c327010a3..2619ca6e87 100644
--- a/var/spack/repos/builtin.mock/packages/fetch-options/package.py
+++ b/var/spack/repos/builtin.mock/packages/fetch-options/package.py
@@ -17,6 +17,6 @@ class FetchOptions(Package):
     timeout = {'timeout': 65}
     cookie = {'cookie': 'baz'}
 
-    version('1.2', 'abc12', fetch_options=cookie)
-    version('1.1', 'abc11', fetch_options=timeout)
-    version('1.0', 'abc10')
+    version('1.2', '00000000000000000000000000000012', fetch_options=cookie)
+    version('1.1', '00000000000000000000000000000011', fetch_options=timeout)
+    version('1.0', '00000000000000000000000000000010')
diff --git a/var/spack/repos/builtin.mock/packages/fftw/package.py b/var/spack/repos/builtin.mock/packages/fftw/package.py
index e77f8412b3..b1dabe6754 100644
--- a/var/spack/repos/builtin.mock/packages/fftw/package.py
+++ b/var/spack/repos/builtin.mock/packages/fftw/package.py
@@ -10,8 +10,8 @@ class Fftw(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/fftw-1.0.tar.gz"
 
-    version(2.0, 'foobar')
-    version(1.0, 'foobar')
+    version(2.0, 'abcdef1234567890abcdef1234567890')
+    version(1.0, '1234567890abcdef1234567890abcdef')
 
     variant('mpi', default=False, description='Enable MPI')
 
diff --git a/var/spack/repos/builtin.mock/packages/find-externals1/package.py b/var/spack/repos/builtin.mock/packages/find-externals1/package.py
index 21294adf4d..0aab19bde5 100644
--- a/var/spack/repos/builtin.mock/packages/find-externals1/package.py
+++ b/var/spack/repos/builtin.mock/packages/find-externals1/package.py
@@ -13,7 +13,7 @@ class FindExternals1(AutotoolsPackage):
 
     url = "http://www.example.com/find-externals-1.0.tar.gz"
 
-    version('1.0', 'hash-1.0')
+    version('1.0', 'abcdef1234567890abcdef1234567890')
 
     @classmethod
     def determine_spec_details(cls, prefix, exes_in_prefix):
diff --git a/var/spack/repos/builtin.mock/packages/gcc/package.py b/var/spack/repos/builtin.mock/packages/gcc/package.py
index a76967c993..97e1325c61 100644
--- a/var/spack/repos/builtin.mock/packages/gcc/package.py
+++ b/var/spack/repos/builtin.mock/packages/gcc/package.py
@@ -13,8 +13,8 @@ class Gcc(Package):
     url      = "http://www.example.com/gcc-1.0.tar.gz"
 
     version('1.0', '0123456789abcdef0123456789abcdef')
-    version('2.0', '2.0_a_hash')
-    version('3.0', '3.0_a_hash')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
+    version('3.0', 'def0123456789abcdef0123456789abc')
 
     depends_on('conflict', when='@3.0')
 
diff --git a/var/spack/repos/builtin.mock/packages/git-url-top-level/package.py b/var/spack/repos/builtin.mock/packages/git-url-top-level/package.py
index e51cbe5160..94e9b4ff41 100644
--- a/var/spack/repos/builtin.mock/packages/git-url-top-level/package.py
+++ b/var/spack/repos/builtin.mock/packages/git-url-top-level/package.py
@@ -28,13 +28,35 @@ class GitUrlTopLevel(Package):
     version('3.0', tag='v3.0')
 
     # These resolve to URL fetchers
-    version('2.3', 'abc23', url='https://www.example.com/foo2.3.tar.gz')
-    version('2.2', sha256='abc22', url='https://www.example.com/foo2.2.tar.gz')
-    version('2.1', sha256='abc21')
-    version('2.0', 'abc20')
+    version(
+        '2.3', '0000000000000000000000000000000000000000000000000000000000000023',
+        url='https://www.example.com/foo2.3.tar.gz',
+    )
+    version(
+        '2.2',
+        sha256='0000000000000000000000000000000000000000000000000000000000000022',
+        url='https://www.example.com/foo2.2.tar.gz',
+    )
+    version(
+        '2.1',
+        sha256='0000000000000000000000000000000000000000000000000000000000000021',
+    )
+    version(
+        '2.0',
+        '0000000000000000000000000000000000000000000000000000000000000020',
+    )
 
     # These result in a FetcherConflict b/c we can't tell what to use
-    version('1.3', sha256='abc13', commit='abc13')
-    version('1.2', sha512='abc12', branch='releases/v1.2')
-    version('1.1', md5='abc11', tag='v1.1')
-    version('1.0', 'abc11', tag='abc123')
+    version(
+        '1.3',
+        sha256='f66bbef3ccb8b06542c57d69804c5b0aba72051f693c17761ad8525786d259fa',
+        commit='abc13'
+    )
+    version(
+        '1.2',
+        sha512='f66bbef3ccb8b06542c57d69804c5b0aba72051f693c17761ad8525786d259fa'
+        '9ed8f2e950a4fb8a4b936f33e689187784699357bc16e49f33dfcda8ab8b00e4',
+        branch='releases/v1.2'
+    )
+    version('1.1', md5='00000000000000000000000000000011', tag='v1.1')
+    version('1.0', '00000000000000000000000000000011', tag='abc123')
diff --git a/var/spack/repos/builtin.mock/packages/gmt/package.py b/var/spack/repos/builtin.mock/packages/gmt/package.py
index 444c3d3d95..efe1480c88 100644
--- a/var/spack/repos/builtin.mock/packages/gmt/package.py
+++ b/var/spack/repos/builtin.mock/packages/gmt/package.py
@@ -3,8 +3,10 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class Gmt(Package):
+    url = "http://www.example.com/"
+    url = "http://www.example.com/2.0.tar.gz"
 
-    version('2.0', 'abcdef')
-    version('1.0', 'abcdef')
+    version('2.0', 'abcdef1234567890abcdef1234567890')
+    version('1.0', 'abcdef1234567890abcdef1234567890')
 
     depends_on('mvdefaults', when='@1.0')
diff --git a/var/spack/repos/builtin.mock/packages/hdf5/package.py b/var/spack/repos/builtin.mock/packages/hdf5/package.py
index 6f4d2d1528..34aa76cfd6 100644
--- a/var/spack/repos/builtin.mock/packages/hdf5/package.py
+++ b/var/spack/repos/builtin.mock/packages/hdf5/package.py
@@ -8,7 +8,7 @@ class Hdf5(Package):
     homepage = "http://www.llnl.gov"
     url      = "http://www.llnl.gov/hdf5-1.0.tar.gz"
 
-    version(2.3, 'foobarbaz')
+    version(2.3, '0123456789abcdef0123456789abcdef')
 
     variant('mpi', default=True, description='Enable mpi')
 
diff --git a/var/spack/repos/builtin.mock/packages/impossible-concretization/package.py b/var/spack/repos/builtin.mock/packages/impossible-concretization/package.py
index bf665087f2..05aac5f953 100644
--- a/var/spack/repos/builtin.mock/packages/impossible-concretization/package.py
+++ b/var/spack/repos/builtin.mock/packages/impossible-concretization/package.py
@@ -10,6 +10,6 @@ class ImpossibleConcretization(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/example-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     conflicts('target=x86_64:')
diff --git a/var/spack/repos/builtin.mock/packages/indirect-mpich/package.py b/var/spack/repos/builtin.mock/packages/indirect-mpich/package.py
index 32f6d79a37..c49e7e49e0 100644
--- a/var/spack/repos/builtin.mock/packages/indirect-mpich/package.py
+++ b/var/spack/repos/builtin.mock/packages/indirect-mpich/package.py
@@ -14,7 +14,7 @@ class IndirectMpich(Package):
     homepage = "http://www.example.com"
     url      = "http://www.example.com/indirect_mpich-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     depends_on('mpi')
     depends_on('direct-mpich')
diff --git a/var/spack/repos/builtin.mock/packages/leaf-adds-virtual/package.py b/var/spack/repos/builtin.mock/packages/leaf-adds-virtual/package.py
index be4cc17711..689f315bd0 100644
--- a/var/spack/repos/builtin.mock/packages/leaf-adds-virtual/package.py
+++ b/var/spack/repos/builtin.mock/packages/leaf-adds-virtual/package.py
@@ -3,7 +3,10 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class LeafAddsVirtual(Package):
-    version('2.0', sha256='abcde')
-    version('1.0', sha256='abcde')
+    url = "http://www.example.com/"
+    url = "http://www.example.com/2.0.tar.gz"
+
+    version('2.0', 'abcdef1234567890abcdef1234567890')
+    version('1.0', 'abcdef1234567890abcdef1234567890')
 
     depends_on('blas', when='@2.0')
diff --git a/var/spack/repos/builtin.mock/packages/libdwarf/package.py b/var/spack/repos/builtin.mock/packages/libdwarf/package.py
index 8714b141b6..dcda3a2976 100644
--- a/var/spack/repos/builtin.mock/packages/libdwarf/package.py
+++ b/var/spack/repos/builtin.mock/packages/libdwarf/package.py
@@ -15,9 +15,9 @@ class Libdwarf(Package):
     list_url = homepage
 
     version(20130729, "64b42692e947d5180e162e46c689dfbf")
-    version(20130207, 'foobarbaz')
-    version(20111030, 'foobarbaz')
-    version(20070703, 'foobarbaz')
+    version(20130207, '0123456789abcdef0123456789abcdef')
+    version(20111030, '0123456789abcdef0123456789abcdef')
+    version(20070703, '0123456789abcdef0123456789abcdef')
 
     depends_on("libelf")
 
diff --git a/var/spack/repos/builtin.mock/packages/middle-adds-virtual/package.py b/var/spack/repos/builtin.mock/packages/middle-adds-virtual/package.py
index 884d8737c0..cc07608981 100644
--- a/var/spack/repos/builtin.mock/packages/middle-adds-virtual/package.py
+++ b/var/spack/repos/builtin.mock/packages/middle-adds-virtual/package.py
@@ -3,5 +3,9 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class MiddleAddsVirtual(Package):
-    version('1.0', sha256='abcde')
+    url = "http://www.example.com/"
+    url = "http://www.example.com/2.0.tar.gz"
+
+    version('1.0', 'abcdef1234567890abcdef1234567890')
+
     depends_on('leaf-adds-virtual')
diff --git a/var/spack/repos/builtin.mock/packages/mixedversions/package.py b/var/spack/repos/builtin.mock/packages/mixedversions/package.py
index 0198731c53..fd660f7f8f 100644
--- a/var/spack/repos/builtin.mock/packages/mixedversions/package.py
+++ b/var/spack/repos/builtin.mock/packages/mixedversions/package.py
@@ -9,6 +9,6 @@ from spack import *
 class Mixedversions(Package):
     url = "http://www.fake-mixedversions.org/downloads/mixedversions-1.0.tar.gz"
 
-    version('2.0.1', 'hashc')
-    version('2.0', 'hashb')
-    version('1.0.1', 'hasha')
+    version('2.0.1', '0000000000000000000000000000000c')
+    version('2.0', '0000000000000000000000000000000b')
+    version('1.0.1', '0000000000000000000000000000000a')
diff --git a/var/spack/repos/builtin.mock/packages/module-path-separator/package.py b/var/spack/repos/builtin.mock/packages/module-path-separator/package.py
index c20499754c..e88d377c84 100644
--- a/var/spack/repos/builtin.mock/packages/module-path-separator/package.py
+++ b/var/spack/repos/builtin.mock/packages/module-path-separator/package.py
@@ -10,7 +10,7 @@ class ModulePathSeparator(Package):
     homepage = "http://www.llnl.gov"
     url      = "http://www.llnl.gov/module-path-separator-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     def setup_environment(self, senv, renv):
         renv.append_path("COLON", "foo")
diff --git a/var/spack/repos/builtin.mock/packages/mpich/package.py b/var/spack/repos/builtin.mock/packages/mpich/package.py
index bcf70d7014..b110be5495 100644
--- a/var/spack/repos/builtin.mock/packages/mpich/package.py
+++ b/var/spack/repos/builtin.mock/packages/mpich/package.py
@@ -18,11 +18,11 @@ class Mpich(Package):
             description="Compile MPICH with debug flags.")
 
     version('3.0.4', '9c5d5d4fe1e17dd12153f40bc5b6dbc0')
-    version('3.0.3', 'foobarbaz')
-    version('3.0.2', 'foobarbaz')
-    version('3.0.1', 'foobarbaz')
-    version('3.0', 'foobarbaz')
-    version('1.0', 'foobarbas')
+    version('3.0.3', '0123456789abcdef0123456789abcdef')
+    version('3.0.2', '0123456789abcdef0123456789abcdef')
+    version('3.0.1', '0123456789abcdef0123456789abcdef')
+    version('3.0', '0123456789abcdef0123456789abcdef')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     provides('mpi@:3', when='@3:')
     provides('mpi@:1', when='@:1')
diff --git a/var/spack/repos/builtin.mock/packages/mpich2/package.py b/var/spack/repos/builtin.mock/packages/mpich2/package.py
index 4a4081e002..cf0d7534b0 100644
--- a/var/spack/repos/builtin.mock/packages/mpich2/package.py
+++ b/var/spack/repos/builtin.mock/packages/mpich2/package.py
@@ -15,11 +15,11 @@ class Mpich2(Package):
     tags = ['tag1', 'tag3']
 
     version('1.5', '9c5d5d4fe1e17dd12153f40bc5b6dbc0')
-    version('1.4', 'foobarbaz')
-    version('1.3', 'foobarbaz')
-    version('1.2', 'foobarbaz')
-    version('1.1', 'foobarbaz')
-    version('1.0', 'foobarbaz')
+    version('1.4', '0123456789abcdef0123456789abcdef')
+    version('1.3', '0123456789abcdef0123456789abcdef')
+    version('1.2', '0123456789abcdef0123456789abcdef')
+    version('1.1', '0123456789abcdef0123456789abcdef')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     provides('mpi@:2.0')
     provides('mpi@:2.1', when='@1.1:')
diff --git a/var/spack/repos/builtin.mock/packages/mpileaks/package.py b/var/spack/repos/builtin.mock/packages/mpileaks/package.py
index db148b3c1f..e0bff0673b 100644
--- a/var/spack/repos/builtin.mock/packages/mpileaks/package.py
+++ b/var/spack/repos/builtin.mock/packages/mpileaks/package.py
@@ -10,10 +10,10 @@ class Mpileaks(Package):
     homepage = "http://www.llnl.gov"
     url      = "http://www.llnl.gov/mpileaks-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
-    version(2.1, 'foobarbaz')
-    version(2.2, 'foobarbaz')
-    version(2.3, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
+    version(2.1, '0123456789abcdef0123456789abcdef')
+    version(2.2, '0123456789abcdef0123456789abcdef')
+    version(2.3, '0123456789abcdef0123456789abcdef')
 
     variant('debug', default=False, description='Debug variant')
     variant('opt',   default=False, description='Optimized variant')
diff --git a/var/spack/repos/builtin.mock/packages/multi-provider-mpi/package.py b/var/spack/repos/builtin.mock/packages/multi-provider-mpi/package.py
index 41c7df5578..58e83ae596 100644
--- a/var/spack/repos/builtin.mock/packages/multi-provider-mpi/package.py
+++ b/var/spack/repos/builtin.mock/packages/multi-provider-mpi/package.py
@@ -12,13 +12,13 @@ class MultiProviderMpi(Package):
     homepage = "http://www.spack-fake-mpi.org"
     url      = "http://www.spack-fake-mpi.org/downloads/multi-mpi-1.0.tar.gz"
 
-    version('2.0.0', 'foobarbaz')
-    version('1.10.3', 'foobarbaz')
-    version('1.10.2', 'foobarbaz')
-    version('1.10.1', 'foobarbaz')
-    version('1.10.0', 'foobarbaz')
-    version('1.8.8', 'foobarbaz')
-    version('1.6.5', 'foobarbaz')
+    version('2.0.0', '0123456789abcdef0123456789abcdef')
+    version('1.10.3', '0123456789abcdef0123456789abcdef')
+    version('1.10.2', '0123456789abcdef0123456789abcdef')
+    version('1.10.1', '0123456789abcdef0123456789abcdef')
+    version('1.10.0', '0123456789abcdef0123456789abcdef')
+    version('1.8.8', '0123456789abcdef0123456789abcdef')
+    version('1.6.5', '0123456789abcdef0123456789abcdef')
 
     provides('mpi@3.1', when='@2.0.0')
     provides('mpi@3.0', when='@1.10.3')
diff --git a/var/spack/repos/builtin.mock/packages/multivalue-variant/package.py b/var/spack/repos/builtin.mock/packages/multivalue-variant/package.py
index 34663434cb..65ca9d6854 100644
--- a/var/spack/repos/builtin.mock/packages/multivalue-variant/package.py
+++ b/var/spack/repos/builtin.mock/packages/multivalue-variant/package.py
@@ -10,10 +10,10 @@ class MultivalueVariant(Package):
     homepage = "http://www.llnl.gov"
     url = "http://www.llnl.gov/mpileaks-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
-    version(2.1, 'foobarbaz')
-    version(2.2, 'foobarbaz')
-    version(2.3, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
+    version(2.1, '0123456789abcdef0123456789abcdef')
+    version(2.2, '0123456789abcdef0123456789abcdef')
+    version(2.3, '0123456789abcdef0123456789abcdef')
 
     variant('debug', default=False, description='Debug variant')
     variant(
diff --git a/var/spack/repos/builtin.mock/packages/mvdefaults/package.py b/var/spack/repos/builtin.mock/packages/mvdefaults/package.py
index d6f7e7e0db..a45350a5c5 100644
--- a/var/spack/repos/builtin.mock/packages/mvdefaults/package.py
+++ b/var/spack/repos/builtin.mock/packages/mvdefaults/package.py
@@ -3,8 +3,10 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class Mvdefaults(Package):
+    homepage = "http://www.example.com"
+    url      = "http://www.example.com/mvdefaults-1.0.tar.gz"
 
-    version('1.0', 'abcdef')
+    version('1.0', 'abcdef1234567890abcdef1234567890')
 
     variant('foo', values=('a', 'b', 'c'), default=('a', 'b', 'c'),
             multi=True, description='')
diff --git a/var/spack/repos/builtin.mock/packages/override-context-templates/package.py b/var/spack/repos/builtin.mock/packages/override-context-templates/package.py
index 9d8e0bbbc4..f2f6f1c941 100644
--- a/var/spack/repos/builtin.mock/packages/override-context-templates/package.py
+++ b/var/spack/repos/builtin.mock/packages/override-context-templates/package.py
@@ -14,7 +14,7 @@ class OverrideContextTemplates(Package):
     homepage = "http://www.fake-spack-example.org"
     url      = "http://www.fake-spack-example.org/downloads/fake-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     tcl_template = 'extension.tcl'
     tcl_context = {'sentence': "sentence from package"}
diff --git a/var/spack/repos/builtin.mock/packages/override-module-templates/package.py b/var/spack/repos/builtin.mock/packages/override-module-templates/package.py
index 3f552a7cb6..16d453d5b3 100644
--- a/var/spack/repos/builtin.mock/packages/override-module-templates/package.py
+++ b/var/spack/repos/builtin.mock/packages/override-module-templates/package.py
@@ -10,7 +10,7 @@ class OverrideModuleTemplates(Package):
     homepage = "http://www.fake-spack-example.org"
     url      = "http://www.fake-spack-example.org/downloads/fake-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     tcl_template = 'override.txt'
     lmod_template = 'override.txt'
diff --git a/var/spack/repos/builtin.mock/packages/perl-extension/package.py b/var/spack/repos/builtin.mock/packages/perl-extension/package.py
index 61f4531c25..1aab8838c4 100644
--- a/var/spack/repos/builtin.mock/packages/perl-extension/package.py
+++ b/var/spack/repos/builtin.mock/packages/perl-extension/package.py
@@ -13,8 +13,8 @@ class PerlExtension(PerlPackage):
     homepage = "http://www.example.com"
     url      = "http://www.example.com/extension1-1.0.tar.gz"
 
-    version('1.0', 'hash-extension-1.0')
-    version('2.0', 'hash-extension-2.0')
+    version('1.0', '00000000000000000000000000000010')
+    version('2.0', '00000000000000000000000000000020')
 
     extends("perl")
 
diff --git a/var/spack/repos/builtin.mock/packages/perl/package.py b/var/spack/repos/builtin.mock/packages/perl/package.py
index 376ea976e2..0e1b2a0f67 100644
--- a/var/spack/repos/builtin.mock/packages/perl/package.py
+++ b/var/spack/repos/builtin.mock/packages/perl/package.py
@@ -12,4 +12,4 @@ class Perl(Package):
 
     extendable = True
 
-    version('0.0.0', 'hash')
+    version('0.0.0', 'abcdef1234567890abcdef1234567890')
diff --git a/var/spack/repos/builtin.mock/packages/printing-package/package.py b/var/spack/repos/builtin.mock/packages/printing-package/package.py
index f221123668..9ccdca49ea 100644
--- a/var/spack/repos/builtin.mock/packages/printing-package/package.py
+++ b/var/spack/repos/builtin.mock/packages/printing-package/package.py
@@ -14,7 +14,7 @@ class PrintingPackage(Package):
     homepage = "http://www.example.com/printing_package"
     url      = "http://www.unit-test-should-replace-this-url/trivial_install-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         print("BEFORE INSTALL")
diff --git a/var/spack/repos/builtin.mock/packages/py-extension1/package.py b/var/spack/repos/builtin.mock/packages/py-extension1/package.py
index bfee8f95e8..d7a88c5123 100644
--- a/var/spack/repos/builtin.mock/packages/py-extension1/package.py
+++ b/var/spack/repos/builtin.mock/packages/py-extension1/package.py
@@ -16,8 +16,8 @@ class PyExtension1(PythonPackage):
     # Override settings in base class
     maintainers = []
 
-    version('1.0', 'hash-extension1-1.0')
-    version('2.0', 'hash-extension1-2.0')
+    version('1.0', '00000000000000000000000000000110')
+    version('2.0', '00000000000000000000000000000120')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/py-extension2/package.py b/var/spack/repos/builtin.mock/packages/py-extension2/package.py
index 05ad308d15..e4663ca789 100644
--- a/var/spack/repos/builtin.mock/packages/py-extension2/package.py
+++ b/var/spack/repos/builtin.mock/packages/py-extension2/package.py
@@ -20,7 +20,7 @@ class PyExtension2(PythonPackage):
     extends("python")
     depends_on('py-extension1', type=('build', 'run'))
 
-    version('1.0', 'hash-extension2-1.0')
+    version('1.0', '00000000000000000000000000000210')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/py-extension3/package.py b/var/spack/repos/builtin.mock/packages/py-extension3/package.py
index 1c3da0fa2d..575d38866f 100644
--- a/var/spack/repos/builtin.mock/packages/py-extension3/package.py
+++ b/var/spack/repos/builtin.mock/packages/py-extension3/package.py
@@ -16,6 +16,6 @@ class PyExtension3(Package):
     depends_on('patchelf@0.9', when='@1.0:1.1 ^python@:2')
     depends_on('patchelf@0.10', when='@1.0:1.1 ^python@3:')
 
-    version('2.0', 'hash-extension3-1.0')
-    version('1.1', 'hash-extension3-1.0')
-    version('1.0', 'hash-extension3-1.0')
+    version('2.0', '00000000000000000000000000000320')
+    version('1.1', '00000000000000000000000000000311')
+    version('1.0', '00000000000000000000000000000310')
diff --git a/var/spack/repos/builtin.mock/packages/quantum-espresso/package.py b/var/spack/repos/builtin.mock/packages/quantum-espresso/package.py
index c61e1d1842..7cfff2ed63 100644
--- a/var/spack/repos/builtin.mock/packages/quantum-espresso/package.py
+++ b/var/spack/repos/builtin.mock/packages/quantum-espresso/package.py
@@ -10,7 +10,7 @@ class QuantumEspresso(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/qe-1.0.tar.gz"
 
-    version(1.0, 'foobar')
+    version(1.0, '1234567890abcdef1234567890abcdef')
 
     variant('invino', default=True, description='?')
     variant('veritas', default=True, description='?')
diff --git a/var/spack/repos/builtin.mock/packages/raiser/package.py b/var/spack/repos/builtin.mock/packages/raiser/package.py
index 9fd15341bf..323d7b194e 100644
--- a/var/spack/repos/builtin.mock/packages/raiser/package.py
+++ b/var/spack/repos/builtin.mock/packages/raiser/package.py
@@ -17,7 +17,7 @@ class Raiser(Package):
     url = "http://www.example.com/a-1.0.tar.gz"
 
     version('1.0', '0123456789abcdef0123456789abcdef')
-    version('2.0', '2.0_a_hash')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     variant(
         'exc_type',
diff --git a/var/spack/repos/builtin.mock/packages/requires-virtual/package.py b/var/spack/repos/builtin.mock/packages/requires-virtual/package.py
index 00398c4caf..b995f3ae3a 100644
--- a/var/spack/repos/builtin.mock/packages/requires-virtual/package.py
+++ b/var/spack/repos/builtin.mock/packages/requires-virtual/package.py
@@ -11,6 +11,6 @@ class RequiresVirtual(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/a-1.0.tar.gz"
 
-    version('2.0', '2.0_a_hash')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     depends_on('stuff')
diff --git a/var/spack/repos/builtin.mock/packages/root-adds-virtual/package.py b/var/spack/repos/builtin.mock/packages/root-adds-virtual/package.py
index 167a81ca67..88c80e9844 100644
--- a/var/spack/repos/builtin.mock/packages/root-adds-virtual/package.py
+++ b/var/spack/repos/builtin.mock/packages/root-adds-virtual/package.py
@@ -3,6 +3,9 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class RootAddsVirtual(Package):
-    version('1.0', sha256='abcde')
+    homepage = "http://www.example.com"
+    url = "http://www.example.com/root-adds-virtual-1.0.tar.gz"
+
+    version('1.0', sha256='abcdef0123456789abcdef0123456789')
 
     depends_on('middle-adds-virtual')
diff --git a/var/spack/repos/builtin.mock/packages/root/package.py b/var/spack/repos/builtin.mock/packages/root/package.py
index b0de915b29..31fd31a4e0 100644
--- a/var/spack/repos/builtin.mock/packages/root/package.py
+++ b/var/spack/repos/builtin.mock/packages/root/package.py
@@ -3,6 +3,9 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class Root(Package):
-    version('1.0', 'abcdef')
+    homepage = "http://www.example.com"
+    url = "http://www.example.com/root-1.0.tar.gz"
+
+    version('1.0', 'abcdef0123456789abcdef0123456789')
 
     depends_on('gmt')
diff --git a/var/spack/repos/builtin.mock/packages/singlevalue-variant/package.py b/var/spack/repos/builtin.mock/packages/singlevalue-variant/package.py
index 26d05ac296..15f6f58c42 100644
--- a/var/spack/repos/builtin.mock/packages/singlevalue-variant/package.py
+++ b/var/spack/repos/builtin.mock/packages/singlevalue-variant/package.py
@@ -8,7 +8,7 @@ class SinglevalueVariant(Package):
     homepage = "http://www.llnl.gov"
     url = "http://www.llnl.gov/mpileaks-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     variant(
         'fum',
diff --git a/var/spack/repos/builtin.mock/packages/test-error/package.py b/var/spack/repos/builtin.mock/packages/test-error/package.py
index b50dd1f43f..efce8bd0fb 100644
--- a/var/spack/repos/builtin.mock/packages/test-error/package.py
+++ b/var/spack/repos/builtin.mock/packages/test-error/package.py
@@ -12,7 +12,7 @@ class TestError(Package):
     homepage = "http://www.example.com/test-failure"
     url      = "http://www.test-failure.test/test-failure-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/test-fail/package.py b/var/spack/repos/builtin.mock/packages/test-fail/package.py
index 13e5b0608d..79abfae85e 100644
--- a/var/spack/repos/builtin.mock/packages/test-fail/package.py
+++ b/var/spack/repos/builtin.mock/packages/test-fail/package.py
@@ -12,7 +12,7 @@ class TestFail(Package):
     homepage = "http://www.example.com/test-failure"
     url      = "http://www.test-failure.test/test-failure-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/trigger-external-non-default-variant/package.py b/var/spack/repos/builtin.mock/packages/trigger-external-non-default-variant/package.py
index 8b2b2be70d..0f3a0426b4 100644
--- a/var/spack/repos/builtin.mock/packages/trigger-external-non-default-variant/package.py
+++ b/var/spack/repos/builtin.mock/packages/trigger-external-non-default-variant/package.py
@@ -7,6 +7,6 @@ class TriggerExternalNonDefaultVariant(Package):
     homepage = "http://www.example.com"
     url = "http://www.someurl.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     depends_on('external-non-default-variant')
diff --git a/var/spack/repos/builtin.mock/packages/trivial-install-test-package/package.py b/var/spack/repos/builtin.mock/packages/trivial-install-test-package/package.py
index 995a752b5b..0153bde87a 100644
--- a/var/spack/repos/builtin.mock/packages/trivial-install-test-package/package.py
+++ b/var/spack/repos/builtin.mock/packages/trivial-install-test-package/package.py
@@ -12,7 +12,7 @@ class TrivialInstallTestPackage(Package):
     homepage = "http://www.example.com/trivial_install"
     url      = "http://www.unit-test-should-replace-this-url/trivial_install-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         configure('--prefix=%s' % prefix)
diff --git a/var/spack/repos/builtin.mock/packages/trivial-smoke-test/package.py b/var/spack/repos/builtin.mock/packages/trivial-smoke-test/package.py
index 6dbdd07ea8..5d7c3adf78 100644
--- a/var/spack/repos/builtin.mock/packages/trivial-smoke-test/package.py
+++ b/var/spack/repos/builtin.mock/packages/trivial-smoke-test/package.py
@@ -11,7 +11,7 @@ class TrivialSmokeTest(Package):
     homepage = "http://www.example.com/trivial_test"
     url      = "http://www.unit-test-should-replace-this-url/trivial_test-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     test_source_filename = 'cached_file.in'
 
diff --git a/var/spack/repos/builtin.mock/packages/unsat-provider/package.py b/var/spack/repos/builtin.mock/packages/unsat-provider/package.py
index a801b2c547..c8aef3563e 100644
--- a/var/spack/repos/builtin.mock/packages/unsat-provider/package.py
+++ b/var/spack/repos/builtin.mock/packages/unsat-provider/package.py
@@ -7,7 +7,7 @@ class UnsatProvider(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/v1.0.tgz"
 
-    version('1.0', sha256='foobarbaz')
+    version('1.0', sha256='0123456789abcdef0123456789abcdef')
 
     variant('foo', default=True, description='')
 
diff --git a/var/spack/repos/builtin.mock/packages/unsat-virtual-dependency/package.py b/var/spack/repos/builtin.mock/packages/unsat-virtual-dependency/package.py
index 0d3a688565..03682da7cf 100644
--- a/var/spack/repos/builtin.mock/packages/unsat-virtual-dependency/package.py
+++ b/var/spack/repos/builtin.mock/packages/unsat-virtual-dependency/package.py
@@ -7,6 +7,6 @@ class UnsatVirtualDependency(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/v1.0.tgz"
 
-    version('1.0', sha256='foobarbaz')
+    version('1.0', sha256='0123456789abcdef0123456789abcdef')
 
     depends_on('unsatvdep')
diff --git a/var/spack/repos/builtin.mock/packages/url-list-test/package.py b/var/spack/repos/builtin.mock/packages/url-list-test/package.py
index 846a7bf18e..60a4279fc2 100644
--- a/var/spack/repos/builtin.mock/packages/url-list-test/package.py
+++ b/var/spack/repos/builtin.mock/packages/url-list-test/package.py
@@ -16,10 +16,10 @@ class UrlListTest(Package):
     list_url = 'file://' + web_data_path + '/index.html'
     list_depth = 3
 
-    version('0.0.0',   'abc000')
-    version('1.0.0',   'abc100')
-    version('3.0',     'abc30')
-    version('4.5',     'abc45')
-    version('2.0.0b2', 'abc200b2')
-    version('3.0a1',   'abc30a1')
-    version('4.5-rc5', 'abc45rc5')
+    version('0.0.0',   '00000000000000000000000000000000')
+    version('1.0.0',   '00000000000000000000000000000100')
+    version('3.0',     '00000000000000000000000000000030')
+    version('4.5',     '00000000000000000000000000000450')
+    version('2.0.0b2', '000000000000000000000000000200b2')
+    version('3.0a1',   '000000000000000000000000000030a1')
+    version('4.5-rc5', '000000000000000000000000000045c5')
diff --git a/var/spack/repos/builtin.mock/packages/url-only-override-with-gaps/package.py b/var/spack/repos/builtin.mock/packages/url-only-override-with-gaps/package.py
index 1b797ca3cd..c532539ee1 100644
--- a/var/spack/repos/builtin.mock/packages/url-only-override-with-gaps/package.py
+++ b/var/spack/repos/builtin.mock/packages/url-only-override-with-gaps/package.py
@@ -9,10 +9,13 @@ from spack import *
 class UrlOnlyOverrideWithGaps(Package):
     homepage = 'http://www.example.com'
 
-    version('1.0.5', 'abcdef0')
-    version('1.0.0', 'bcdef0a', url='http://a.example.com/url_override-1.0.0.tar.gz')
-    version('0.9.5', 'cdef0ab')
-    version('0.9.0', 'def0abc', url='http://b.example.com/url_override-0.9.0.tar.gz')
-    version('0.8.5', 'ef0abcd')
-    version('0.8.1', 'f0abcde', url='http://c.example.com/url_override-0.8.1.tar.gz')
-    version('0.7.0', '0abcdef')
+    version('1.0.5', 'abcdef0123456789abcdef0123456789')
+    version('1.0.0', 'bcdef0123456789abcdef0123456789a',
+            url='http://a.example.com/url_override-1.0.0.tar.gz')
+    version('0.9.5', 'cdef0123456789abcdef0123456789ab')
+    version('0.9.0', 'def0123456789abcdef0123456789abc',
+            url='http://b.example.com/url_override-0.9.0.tar.gz')
+    version('0.8.5', 'ef0123456789abcdef0123456789abcd')
+    version('0.8.1', 'f0123456789abcdef0123456789abcde',
+            url='http://c.example.com/url_override-0.8.1.tar.gz')
+    version('0.7.0', '0123456789abcdef0123456789abcdef')
diff --git a/var/spack/repos/builtin.mock/packages/url-only-override/package.py b/var/spack/repos/builtin.mock/packages/url-only-override/package.py
index 9a3d01036f..61c3b220d1 100644
--- a/var/spack/repos/builtin.mock/packages/url-only-override/package.py
+++ b/var/spack/repos/builtin.mock/packages/url-only-override/package.py
@@ -9,6 +9,6 @@ from spack import *
 class UrlOnlyOverride(Package):
     homepage = 'http://www.example.com'
 
-    version('1.0.0', 'cxyzab', url='http://a.example.com/url_override-1.0.0.tar.gz')
-    version('0.9.0', 'bcxyza', url='http://b.example.com/url_override-0.9.0.tar.gz')
-    version('0.8.1', 'cxyzab', url='http://c.example.com/url_override-0.8.1.tar.gz')
+    version('1.0.0', '0123456789abcdef0123456789abcdef', url='http://a.example.com/url_override-1.0.0.tar.gz')
+    version('0.9.0', 'fedcba9876543210fedcba9876543210', url='http://b.example.com/url_override-0.9.0.tar.gz')
+    version('0.8.1', '0123456789abcdef0123456789abcdef', url='http://c.example.com/url_override-0.8.1.tar.gz')
diff --git a/var/spack/repos/builtin.mock/packages/url_override/package.py b/var/spack/repos/builtin.mock/packages/url_override/package.py
index c68fd0edd0..fdbf31a002 100644
--- a/var/spack/repos/builtin.mock/packages/url_override/package.py
+++ b/var/spack/repos/builtin.mock/packages/url_override/package.py
@@ -10,6 +10,6 @@ class UrlOverride(Package):
     homepage = 'http://www.doesnotexist.org'
     url      = 'http://www.doesnotexist.org/url_override-1.0.0.tar.gz'
 
-    version('1.0.0', 'cxyzab')
-    version('0.9.0', 'bcxyza', url='http://www.anothersite.org/uo-0.9.0.tgz')
-    version('0.8.1', 'cxyzab')
+    version('1.0.0', '0123456789abcdef0123456789abcdef')
+    version('0.9.0', 'fedcba9876543210fedcba9876543210', url='http://www.anothersite.org/uo-0.9.0.tgz')
+    version('0.8.1', '0123456789abcdef0123456789abcdef')
diff --git a/var/spack/repos/builtin.mock/packages/zmpi/package.py b/var/spack/repos/builtin.mock/packages/zmpi/package.py
index af3bee6ef3..e50bc1ab9d 100644
--- a/var/spack/repos/builtin.mock/packages/zmpi/package.py
+++ b/var/spack/repos/builtin.mock/packages/zmpi/package.py
@@ -12,7 +12,7 @@ class Zmpi(Package):
     homepage = "http://www.spack-fake-zmpi.org"
     url      = "http://www.spack-fake-zmpi.org/downloads/zmpi-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     provides('mpi@:10.0')
     depends_on('fake')