url stats: add `--show-issues` option (#25792)

* tests: make `spack url [stats|summary]` work on mock packages

Mock packages have historically had mock hashes, but this means they're also invalid
as far as Spack's hash detection is concerned.

- [x] convert all hashes in mock package to md5 or sha256
- [x] ensure that all mock packages have a URL
- [x] ignore some special cases with multiple VCS fetchers

* url stats: add `--show-issues` option

`spack url stats` tells us how many URLs are using what protocol, type of checksum,
etc., but it previously did not tell us which packages and URLs had the issues. This
adds a `--show-issues` option to show URLs with insecure (`http`) URLs or `md5` hashes
(which are now deprecated by NIST).

65 files changed, 174 insertions, 132 deletions

diff --git a/var/spack/repos/builtin.mock/packages/a/package.py b/var/spack/repos/builtin.mock/packages/a/package.py
index 37570ebf7a..436ac462cd 100644
--- a/var/spack/repos/builtin.mock/packages/a/package.py
+++ b/var/spack/repos/builtin.mock/packages/a/package.py
@@ -13,7 +13,7 @@ class A(AutotoolsPackage):
     url      = "http://www.example.com/a-1.0.tar.gz"
 
     version('1.0', '0123456789abcdef0123456789abcdef')
-    version('2.0', '2.0_a_hash')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     variant(
         'foo', description='',
diff --git a/var/spack/repos/builtin.mock/packages/archive-files/package.py b/var/spack/repos/builtin.mock/packages/archive-files/package.py
index 12d11e514c..3d2b6f0a5a 100644
--- a/var/spack/repos/builtin.mock/packages/archive-files/package.py
+++ b/var/spack/repos/builtin.mock/packages/archive-files/package.py
@@ -13,7 +13,7 @@ class ArchiveFiles(AutotoolsPackage):
     url = "http://www.example.com/a-1.0.tar.gz"
 
     version('1.0', '0123456789abcdef0123456789abcdef')
-    version('2.0', '2.0_a_hash')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     @property
     def archive_files(self):
diff --git a/var/spack/repos/builtin.mock/packages/build-error/package.py b/var/spack/repos/builtin.mock/packages/build-error/package.py
index 5f0c937786..78873d7fb9 100644
--- a/var/spack/repos/builtin.mock/packages/build-error/package.py
+++ b/var/spack/repos/builtin.mock/packages/build-error/package.py
@@ -12,7 +12,7 @@ class BuildError(Package):
     homepage = "http://www.example.com/trivial_install"
     url      = "http://www.unit-test-should-replace-this-url/trivial_install-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         with open('configure', 'w') as f:
diff --git a/var/spack/repos/builtin.mock/packages/build-warnings/package.py b/var/spack/repos/builtin.mock/packages/build-warnings/package.py
index f46452061f..28c2dd4ba4 100644
--- a/var/spack/repos/builtin.mock/packages/build-warnings/package.py
+++ b/var/spack/repos/builtin.mock/packages/build-warnings/package.py
@@ -12,7 +12,7 @@ class BuildWarnings(Package):
     homepage = "http://www.example.com/trivial_install"
     url      = "http://www.unit-test-should-replace-this-url/trivial_install-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         with open('configure', 'w') as f:
diff --git a/var/spack/repos/builtin.mock/packages/callpath/package.py b/var/spack/repos/builtin.mock/packages/callpath/package.py
index cf29e38dd9..cbd9e1afaa 100644
--- a/var/spack/repos/builtin.mock/packages/callpath/package.py
+++ b/var/spack/repos/builtin.mock/packages/callpath/package.py
@@ -10,9 +10,9 @@ class Callpath(Package):
     homepage = "https://github.com/tgamblin/callpath"
     url      = "http://github.com/tgamblin/callpath-1.0.tar.gz"
 
-    version(0.8, 'foobarbaz')
-    version(0.9, 'foobarbaz')
-    version(1.0, 'foobarbaz')
+    version(0.8, '0123456789abcdef0123456789abcdef')
+    version(0.9, '0123456789abcdef0123456789abcdef')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     depends_on("dyninst")
     depends_on("mpi")
diff --git a/var/spack/repos/builtin.mock/packages/conflict-parent/package.py b/var/spack/repos/builtin.mock/packages/conflict-parent/package.py
index 0961f8df1b..af296e3f53 100644
--- a/var/spack/repos/builtin.mock/packages/conflict-parent/package.py
+++ b/var/spack/repos/builtin.mock/packages/conflict-parent/package.py
@@ -10,9 +10,9 @@ class ConflictParent(Package):
     homepage = 'https://github.com/tgamblin/callpath'
     url = 'http://github.com/tgamblin/callpath-1.0.tar.gz'
 
-    version(0.8, 'foobarbaz')
-    version(0.9, 'foobarbaz')
-    version(1.0, 'foobarbaz')
+    version(0.8, '0123456789abcdef0123456789abcdef')
+    version(0.9, '0123456789abcdef0123456789abcdef')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     depends_on('conflict')
 
diff --git a/var/spack/repos/builtin.mock/packages/conflict/package.py b/var/spack/repos/builtin.mock/packages/conflict/package.py
index a4c81bc4d7..1937e31d80 100644
--- a/var/spack/repos/builtin.mock/packages/conflict/package.py
+++ b/var/spack/repos/builtin.mock/packages/conflict/package.py
@@ -10,9 +10,9 @@ class Conflict(Package):
     homepage = 'https://github.com/tgamblin/callpath'
     url = 'http://github.com/tgamblin/callpath-1.0.tar.gz'
 
-    version(0.8, 'foobarbaz')
-    version(0.9, 'foobarbaz')
-    version(1.0, 'foobarbaz')
+    version(0.8, '0123456789abcdef0123456789abcdef')
+    version(0.9, '0123456789abcdef0123456789abcdef')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     variant('foo', default=True, description='')
 
diff --git a/var/spack/repos/builtin.mock/packages/dependency-install/package.py b/var/spack/repos/builtin.mock/packages/dependency-install/package.py
index 35f627c92f..3a5157ca1c 100644
--- a/var/spack/repos/builtin.mock/packages/dependency-install/package.py
+++ b/var/spack/repos/builtin.mock/packages/dependency-install/package.py
@@ -12,8 +12,8 @@ class DependencyInstall(Package):
     homepage = "http://www.example.com"
     url      = "http://www.example.com/a-1.0.tar.gz"
 
-    version('1.0', 'hash1.0')
-    version('2.0', 'hash2.0')
+    version('1.0', '0123456789abcdef0123456789abcdef')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     def install(self, spec, prefix):
         touch(join_path(prefix, 'an_installation_file'))
diff --git a/var/spack/repos/builtin.mock/packages/dependent-of-dev-build/package.py b/var/spack/repos/builtin.mock/packages/dependent-of-dev-build/package.py
index 9b86790a78..9bb36f2af2 100644
--- a/var/spack/repos/builtin.mock/packages/dependent-of-dev-build/package.py
+++ b/var/spack/repos/builtin.mock/packages/dependent-of-dev-build/package.py
@@ -8,7 +8,7 @@ class DependentOfDevBuild(Package):
     homepage = "example.com"
     url = "fake.com"
 
-    version('0.0.0', sha256='0123456789abcdefgh')
+    version('0.0.0', sha256='0123456789abcdef0123456789abcdef')
 
     depends_on('dev-build-test-install')
 
diff --git a/var/spack/repos/builtin.mock/packages/dev-build-test-dependent/package.py b/var/spack/repos/builtin.mock/packages/dev-build-test-dependent/package.py
index 973bc22153..5056670b8f 100644
--- a/var/spack/repos/builtin.mock/packages/dev-build-test-dependent/package.py
+++ b/var/spack/repos/builtin.mock/packages/dev-build-test-dependent/package.py
@@ -8,7 +8,7 @@ class DevBuildTestDependent(Package):
     homepage = "example.com"
     url = "fake.com"
 
-    version('0.0.0', sha256='0123456789abcdefgh')
+    version('0.0.0', sha256='0123456789abcdef0123456789abcdef')
 
     phases = ['edit', 'install']
 
diff --git a/var/spack/repos/builtin.mock/packages/dev-build-test-install-phases/package.py b/var/spack/repos/builtin.mock/packages/dev-build-test-install-phases/package.py
index 7957325d21..72fe849ba3 100644
--- a/var/spack/repos/builtin.mock/packages/dev-build-test-install-phases/package.py
+++ b/var/spack/repos/builtin.mock/packages/dev-build-test-install-phases/package.py
@@ -10,7 +10,7 @@ class DevBuildTestInstallPhases(Package):
     homepage = "example.com"
     url = "fake.com"
 
-    version('0.0.0', sha256='0123456789abcdefgh')
+    version('0.0.0', sha256='0123456789abcdef0123456789abcdef')
 
     phases = ['one', 'two', 'three', 'install']
 
diff --git a/var/spack/repos/builtin.mock/packages/dev-build-test-install/package.py b/var/spack/repos/builtin.mock/packages/dev-build-test-install/package.py
index b72b090855..b1dc16c245 100644
--- a/var/spack/repos/builtin.mock/packages/dev-build-test-install/package.py
+++ b/var/spack/repos/builtin.mock/packages/dev-build-test-install/package.py
@@ -8,7 +8,7 @@ class DevBuildTestInstall(Package):
     homepage = "example.com"
     url = "fake.com"
 
-    version('0.0.0', sha256='0123456789abcdefgh')
+    version('0.0.0', sha256='0123456789abcdef0123456789abcdef')
 
     phases = ['edit', 'install']
 
diff --git a/var/spack/repos/builtin.mock/packages/direct-mpich/package.py b/var/spack/repos/builtin.mock/packages/direct-mpich/package.py
index 658b2d03f2..31cb572ca5 100644
--- a/var/spack/repos/builtin.mock/packages/direct-mpich/package.py
+++ b/var/spack/repos/builtin.mock/packages/direct-mpich/package.py
@@ -10,6 +10,6 @@ class DirectMpich(Package):
     homepage = "http://www.example.com"
     url      = "http://www.example.com/direct_mpich-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     depends_on('mpich')
diff --git a/var/spack/repos/builtin.mock/packages/dyninst/package.py b/var/spack/repos/builtin.mock/packages/dyninst/package.py
index ebaa2afe81..7758f1d6cb 100644
--- a/var/spack/repos/builtin.mock/packages/dyninst/package.py
+++ b/var/spack/repos/builtin.mock/packages/dyninst/package.py
@@ -10,11 +10,11 @@ class Dyninst(Package):
     homepage = "https://paradyn.org"
     url      = "http://www.paradyn.org/release8.1/DyninstAPI-8.1.1.tgz"
 
-    version('8.2',   'cxyzab',
+    version('8.2',   '0123456789abcdef0123456789abcdef',
             url='http://www.paradyn.org/release8.2/DyninstAPI-8.2.tgz')
-    version('8.1.2', 'bcxyza',
+    version('8.1.2', 'fedcba9876543210fedcba9876543210',
             url='http://www.paradyn.org/release8.1.2/DyninstAPI-8.1.2.tgz')
-    version('8.1.1', 'abcxyz',
+    version('8.1.1', '123456789abcdef0123456789abcdef0',
             url='http://www.paradyn.org/release8.1/DyninstAPI-8.1.1.tgz')
 
     depends_on("libelf")
diff --git a/var/spack/repos/builtin.mock/packages/extendee/package.py b/var/spack/repos/builtin.mock/packages/extendee/package.py
index edb2c8dd77..6bb6a7bad1 100644
--- a/var/spack/repos/builtin.mock/packages/extendee/package.py
+++ b/var/spack/repos/builtin.mock/packages/extendee/package.py
@@ -14,7 +14,7 @@ class Extendee(Package):
 
     extendable = True
 
-    version('1.0', 'hash-extendee-1.0')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/extension1/package.py b/var/spack/repos/builtin.mock/packages/extension1/package.py
index 9f0028888a..69443c1be5 100644
--- a/var/spack/repos/builtin.mock/packages/extension1/package.py
+++ b/var/spack/repos/builtin.mock/packages/extension1/package.py
@@ -16,8 +16,8 @@ class Extension1(Package):
 
     extends('extendee')
 
-    version('1.0', 'hash-extension1-1.0')
-    version('2.0', 'hash-extension1-2.0')
+    version('1.0', '0123456789abcdef0123456789abcdef')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/extension2/package.py b/var/spack/repos/builtin.mock/packages/extension2/package.py
index 4b661e0d55..6e2a4badef 100644
--- a/var/spack/repos/builtin.mock/packages/extension2/package.py
+++ b/var/spack/repos/builtin.mock/packages/extension2/package.py
@@ -18,7 +18,7 @@ class Extension2(Package):
     extends('extendee')
     depends_on('extension1', type=('build', 'run'))
 
-    version('1.0', 'hash-extension2-1.0')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/failing-build/package.py b/var/spack/repos/builtin.mock/packages/failing-build/package.py
index c8ffbf6610..f9063092f8 100644
--- a/var/spack/repos/builtin.mock/packages/failing-build/package.py
+++ b/var/spack/repos/builtin.mock/packages/failing-build/package.py
@@ -12,7 +12,7 @@ class FailingBuild(Package):
     homepage = "http://www.example.com/trivial_install"
     url      = "http://www.unit-test-should-replace-this-url/trivial_install-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         raise InstallError("Expected failure.")
diff --git a/var/spack/repos/builtin.mock/packages/fake/package.py b/var/spack/repos/builtin.mock/packages/fake/package.py
index 83ce64e3e5..2946656efe 100644
--- a/var/spack/repos/builtin.mock/packages/fake/package.py
+++ b/var/spack/repos/builtin.mock/packages/fake/package.py
@@ -10,4 +10,4 @@ class Fake(Package):
     homepage = "http://www.fake-spack-example.org"
     url      = "http://www.fake-spack-example.org/downloads/fake-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
diff --git a/var/spack/repos/builtin.mock/packages/fetch-options/package.py b/var/spack/repos/builtin.mock/packages/fetch-options/package.py
index 3c327010a3..2619ca6e87 100644
--- a/var/spack/repos/builtin.mock/packages/fetch-options/package.py
+++ b/var/spack/repos/builtin.mock/packages/fetch-options/package.py
@@ -17,6 +17,6 @@ class FetchOptions(Package):
     timeout = {'timeout': 65}
     cookie = {'cookie': 'baz'}
 
-    version('1.2', 'abc12', fetch_options=cookie)
-    version('1.1', 'abc11', fetch_options=timeout)
-    version('1.0', 'abc10')
+    version('1.2', '00000000000000000000000000000012', fetch_options=cookie)
+    version('1.1', '00000000000000000000000000000011', fetch_options=timeout)
+    version('1.0', '00000000000000000000000000000010')
diff --git a/var/spack/repos/builtin.mock/packages/fftw/package.py b/var/spack/repos/builtin.mock/packages/fftw/package.py
index e77f8412b3..b1dabe6754 100644
--- a/var/spack/repos/builtin.mock/packages/fftw/package.py
+++ b/var/spack/repos/builtin.mock/packages/fftw/package.py
@@ -10,8 +10,8 @@ class Fftw(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/fftw-1.0.tar.gz"
 
-    version(2.0, 'foobar')
-    version(1.0, 'foobar')
+    version(2.0, 'abcdef1234567890abcdef1234567890')
+    version(1.0, '1234567890abcdef1234567890abcdef')
 
     variant('mpi', default=False, description='Enable MPI')
 
diff --git a/var/spack/repos/builtin.mock/packages/find-externals1/package.py b/var/spack/repos/builtin.mock/packages/find-externals1/package.py
index 21294adf4d..0aab19bde5 100644
--- a/var/spack/repos/builtin.mock/packages/find-externals1/package.py
+++ b/var/spack/repos/builtin.mock/packages/find-externals1/package.py
@@ -13,7 +13,7 @@ class FindExternals1(AutotoolsPackage):
 
     url = "http://www.example.com/find-externals-1.0.tar.gz"
 
-    version('1.0', 'hash-1.0')
+    version('1.0', 'abcdef1234567890abcdef1234567890')
 
     @classmethod
     def determine_spec_details(cls, prefix, exes_in_prefix):
diff --git a/var/spack/repos/builtin.mock/packages/gcc/package.py b/var/spack/repos/builtin.mock/packages/gcc/package.py
index a76967c993..97e1325c61 100644
--- a/var/spack/repos/builtin.mock/packages/gcc/package.py
+++ b/var/spack/repos/builtin.mock/packages/gcc/package.py
@@ -13,8 +13,8 @@ class Gcc(Package):
     url      = "http://www.example.com/gcc-1.0.tar.gz"
 
     version('1.0', '0123456789abcdef0123456789abcdef')
-    version('2.0', '2.0_a_hash')
-    version('3.0', '3.0_a_hash')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
+    version('3.0', 'def0123456789abcdef0123456789abc')
 
     depends_on('conflict', when='@3.0')
 
diff --git a/var/spack/repos/builtin.mock/packages/git-url-top-level/package.py b/var/spack/repos/builtin.mock/packages/git-url-top-level/package.py
index e51cbe5160..94e9b4ff41 100644
--- a/var/spack/repos/builtin.mock/packages/git-url-top-level/package.py
+++ b/var/spack/repos/builtin.mock/packages/git-url-top-level/package.py
@@ -28,13 +28,35 @@ class GitUrlTopLevel(Package):
     version('3.0', tag='v3.0')
 
     # These resolve to URL fetchers
-    version('2.3', 'abc23', url='https://www.example.com/foo2.3.tar.gz')
-    version('2.2', sha256='abc22', url='https://www.example.com/foo2.2.tar.gz')
-    version('2.1', sha256='abc21')
-    version('2.0', 'abc20')
+    version(
+        '2.3', '0000000000000000000000000000000000000000000000000000000000000023',
+        url='https://www.example.com/foo2.3.tar.gz',
+    )
+    version(
+        '2.2',
+        sha256='0000000000000000000000000000000000000000000000000000000000000022',
+        url='https://www.example.com/foo2.2.tar.gz',
+    )
+    version(
+        '2.1',
+        sha256='0000000000000000000000000000000000000000000000000000000000000021',
+    )
+    version(
+        '2.0',
+        '0000000000000000000000000000000000000000000000000000000000000020',
+    )
 
     # These result in a FetcherConflict b/c we can't tell what to use
-    version('1.3', sha256='abc13', commit='abc13')
-    version('1.2', sha512='abc12', branch='releases/v1.2')
-    version('1.1', md5='abc11', tag='v1.1')
-    version('1.0', 'abc11', tag='abc123')
+    version(
+        '1.3',
+        sha256='f66bbef3ccb8b06542c57d69804c5b0aba72051f693c17761ad8525786d259fa',
+        commit='abc13'
+    )
+    version(
+        '1.2',
+        sha512='f66bbef3ccb8b06542c57d69804c5b0aba72051f693c17761ad8525786d259fa'
+        '9ed8f2e950a4fb8a4b936f33e689187784699357bc16e49f33dfcda8ab8b00e4',
+        branch='releases/v1.2'
+    )
+    version('1.1', md5='00000000000000000000000000000011', tag='v1.1')
+    version('1.0', '00000000000000000000000000000011', tag='abc123')
diff --git a/var/spack/repos/builtin.mock/packages/gmt/package.py b/var/spack/repos/builtin.mock/packages/gmt/package.py
index 444c3d3d95..efe1480c88 100644
--- a/var/spack/repos/builtin.mock/packages/gmt/package.py
+++ b/var/spack/repos/builtin.mock/packages/gmt/package.py
@@ -3,8 +3,10 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class Gmt(Package):
+    url = "http://www.example.com/"
+    url = "http://www.example.com/2.0.tar.gz"
 
-    version('2.0', 'abcdef')
-    version('1.0', 'abcdef')
+    version('2.0', 'abcdef1234567890abcdef1234567890')
+    version('1.0', 'abcdef1234567890abcdef1234567890')
 
     depends_on('mvdefaults', when='@1.0')
diff --git a/var/spack/repos/builtin.mock/packages/hdf5/package.py b/var/spack/repos/builtin.mock/packages/hdf5/package.py
index 6f4d2d1528..34aa76cfd6 100644
--- a/var/spack/repos/builtin.mock/packages/hdf5/package.py
+++ b/var/spack/repos/builtin.mock/packages/hdf5/package.py
@@ -8,7 +8,7 @@ class Hdf5(Package):
     homepage = "http://www.llnl.gov"
     url      = "http://www.llnl.gov/hdf5-1.0.tar.gz"
 
-    version(2.3, 'foobarbaz')
+    version(2.3, '0123456789abcdef0123456789abcdef')
 
     variant('mpi', default=True, description='Enable mpi')
 
diff --git a/var/spack/repos/builtin.mock/packages/impossible-concretization/package.py b/var/spack/repos/builtin.mock/packages/impossible-concretization/package.py
index bf665087f2..05aac5f953 100644
--- a/var/spack/repos/builtin.mock/packages/impossible-concretization/package.py
+++ b/var/spack/repos/builtin.mock/packages/impossible-concretization/package.py
@@ -10,6 +10,6 @@ class ImpossibleConcretization(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/example-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     conflicts('target=x86_64:')
diff --git a/var/spack/repos/builtin.mock/packages/indirect-mpich/package.py b/var/spack/repos/builtin.mock/packages/indirect-mpich/package.py
index 32f6d79a37..c49e7e49e0 100644
--- a/var/spack/repos/builtin.mock/packages/indirect-mpich/package.py
+++ b/var/spack/repos/builtin.mock/packages/indirect-mpich/package.py
@@ -14,7 +14,7 @@ class IndirectMpich(Package):
     homepage = "http://www.example.com"
     url      = "http://www.example.com/indirect_mpich-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     depends_on('mpi')
     depends_on('direct-mpich')
diff --git a/var/spack/repos/builtin.mock/packages/leaf-adds-virtual/package.py b/var/spack/repos/builtin.mock/packages/leaf-adds-virtual/package.py
index be4cc17711..689f315bd0 100644
--- a/var/spack/repos/builtin.mock/packages/leaf-adds-virtual/package.py
+++ b/var/spack/repos/builtin.mock/packages/leaf-adds-virtual/package.py
@@ -3,7 +3,10 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class LeafAddsVirtual(Package):
-    version('2.0', sha256='abcde')
-    version('1.0', sha256='abcde')
+    url = "http://www.example.com/"
+    url = "http://www.example.com/2.0.tar.gz"
+
+    version('2.0', 'abcdef1234567890abcdef1234567890')
+    version('1.0', 'abcdef1234567890abcdef1234567890')
 
     depends_on('blas', when='@2.0')
diff --git a/var/spack/repos/builtin.mock/packages/libdwarf/package.py b/var/spack/repos/builtin.mock/packages/libdwarf/package.py
index 8714b141b6..dcda3a2976 100644
--- a/var/spack/repos/builtin.mock/packages/libdwarf/package.py
+++ b/var/spack/repos/builtin.mock/packages/libdwarf/package.py
@@ -15,9 +15,9 @@ class Libdwarf(Package):
     list_url = homepage
 
     version(20130729, "64b42692e947d5180e162e46c689dfbf")
-    version(20130207, 'foobarbaz')
-    version(20111030, 'foobarbaz')
-    version(20070703, 'foobarbaz')
+    version(20130207, '0123456789abcdef0123456789abcdef')
+    version(20111030, '0123456789abcdef0123456789abcdef')
+    version(20070703, '0123456789abcdef0123456789abcdef')
 
     depends_on("libelf")
 
diff --git a/var/spack/repos/builtin.mock/packages/middle-adds-virtual/package.py b/var/spack/repos/builtin.mock/packages/middle-adds-virtual/package.py
index 884d8737c0..cc07608981 100644
--- a/var/spack/repos/builtin.mock/packages/middle-adds-virtual/package.py
+++ b/var/spack/repos/builtin.mock/packages/middle-adds-virtual/package.py
@@ -3,5 +3,9 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class MiddleAddsVirtual(Package):
-    version('1.0', sha256='abcde')
+    url = "http://www.example.com/"
+    url = "http://www.example.com/2.0.tar.gz"
+
+    version('1.0', 'abcdef1234567890abcdef1234567890')
+
     depends_on('leaf-adds-virtual')
diff --git a/var/spack/repos/builtin.mock/packages/mixedversions/package.py b/var/spack/repos/builtin.mock/packages/mixedversions/package.py
index 0198731c53..fd660f7f8f 100644
--- a/var/spack/repos/builtin.mock/packages/mixedversions/package.py
+++ b/var/spack/repos/builtin.mock/packages/mixedversions/package.py
@@ -9,6 +9,6 @@ from spack import *
 class Mixedversions(Package):
     url = "http://www.fake-mixedversions.org/downloads/mixedversions-1.0.tar.gz"
 
-    version('2.0.1', 'hashc')
-    version('2.0', 'hashb')
-    version('1.0.1', 'hasha')
+    version('2.0.1', '0000000000000000000000000000000c')
+    version('2.0', '0000000000000000000000000000000b')
+    version('1.0.1', '0000000000000000000000000000000a')
diff --git a/var/spack/repos/builtin.mock/packages/module-path-separator/package.py b/var/spack/repos/builtin.mock/packages/module-path-separator/package.py
index c20499754c..e88d377c84 100644
--- a/var/spack/repos/builtin.mock/packages/module-path-separator/package.py
+++ b/var/spack/repos/builtin.mock/packages/module-path-separator/package.py
@@ -10,7 +10,7 @@ class ModulePathSeparator(Package):
     homepage = "http://www.llnl.gov"
     url      = "http://www.llnl.gov/module-path-separator-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     def setup_environment(self, senv, renv):
         renv.append_path("COLON", "foo")
diff --git a/var/spack/repos/builtin.mock/packages/mpich/package.py b/var/spack/repos/builtin.mock/packages/mpich/package.py
index bcf70d7014..b110be5495 100644
--- a/var/spack/repos/builtin.mock/packages/mpich/package.py
+++ b/var/spack/repos/builtin.mock/packages/mpich/package.py
@@ -18,11 +18,11 @@ class Mpich(Package):
             description="Compile MPICH with debug flags.")
 
     version('3.0.4', '9c5d5d4fe1e17dd12153f40bc5b6dbc0')
-    version('3.0.3', 'foobarbaz')
-    version('3.0.2', 'foobarbaz')
-    version('3.0.1', 'foobarbaz')
-    version('3.0', 'foobarbaz')
-    version('1.0', 'foobarbas')
+    version('3.0.3', '0123456789abcdef0123456789abcdef')
+    version('3.0.2', '0123456789abcdef0123456789abcdef')
+    version('3.0.1', '0123456789abcdef0123456789abcdef')
+    version('3.0', '0123456789abcdef0123456789abcdef')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     provides('mpi@:3', when='@3:')
     provides('mpi@:1', when='@:1')
diff --git a/var/spack/repos/builtin.mock/packages/mpich2/package.py b/var/spack/repos/builtin.mock/packages/mpich2/package.py
index 4a4081e002..cf0d7534b0 100644
--- a/var/spack/repos/builtin.mock/packages/mpich2/package.py
+++ b/var/spack/repos/builtin.mock/packages/mpich2/package.py
@@ -15,11 +15,11 @@ class Mpich2(Package):
     tags = ['tag1', 'tag3']
 
     version('1.5', '9c5d5d4fe1e17dd12153f40bc5b6dbc0')
-    version('1.4', 'foobarbaz')
-    version('1.3', 'foobarbaz')
-    version('1.2', 'foobarbaz')
-    version('1.1', 'foobarbaz')
-    version('1.0', 'foobarbaz')
+    version('1.4', '0123456789abcdef0123456789abcdef')
+    version('1.3', '0123456789abcdef0123456789abcdef')
+    version('1.2', '0123456789abcdef0123456789abcdef')
+    version('1.1', '0123456789abcdef0123456789abcdef')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     provides('mpi@:2.0')
     provides('mpi@:2.1', when='@1.1:')
diff --git a/var/spack/repos/builtin.mock/packages/mpileaks/package.py b/var/spack/repos/builtin.mock/packages/mpileaks/package.py
index db148b3c1f..e0bff0673b 100644
--- a/var/spack/repos/builtin.mock/packages/mpileaks/package.py
+++ b/var/spack/repos/builtin.mock/packages/mpileaks/package.py
@@ -10,10 +10,10 @@ class Mpileaks(Package):
     homepage = "http://www.llnl.gov"
     url      = "http://www.llnl.gov/mpileaks-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
-    version(2.1, 'foobarbaz')
-    version(2.2, 'foobarbaz')
-    version(2.3, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
+    version(2.1, '0123456789abcdef0123456789abcdef')
+    version(2.2, '0123456789abcdef0123456789abcdef')
+    version(2.3, '0123456789abcdef0123456789abcdef')
 
     variant('debug', default=False, description='Debug variant')
     variant('opt',   default=False, description='Optimized variant')
diff --git a/var/spack/repos/builtin.mock/packages/multi-provider-mpi/package.py b/var/spack/repos/builtin.mock/packages/multi-provider-mpi/package.py
index 41c7df5578..58e83ae596 100644
--- a/var/spack/repos/builtin.mock/packages/multi-provider-mpi/package.py
+++ b/var/spack/repos/builtin.mock/packages/multi-provider-mpi/package.py
@@ -12,13 +12,13 @@ class MultiProviderMpi(Package):
     homepage = "http://www.spack-fake-mpi.org"
     url      = "http://www.spack-fake-mpi.org/downloads/multi-mpi-1.0.tar.gz"
 
-    version('2.0.0', 'foobarbaz')
-    version('1.10.3', 'foobarbaz')
-    version('1.10.2', 'foobarbaz')
-    version('1.10.1', 'foobarbaz')
-    version('1.10.0', 'foobarbaz')
-    version('1.8.8', 'foobarbaz')
-    version('1.6.5', 'foobarbaz')
+    version('2.0.0', '0123456789abcdef0123456789abcdef')
+    version('1.10.3', '0123456789abcdef0123456789abcdef')
+    version('1.10.2', '0123456789abcdef0123456789abcdef')
+    version('1.10.1', '0123456789abcdef0123456789abcdef')
+    version('1.10.0', '0123456789abcdef0123456789abcdef')
+    version('1.8.8', '0123456789abcdef0123456789abcdef')
+    version('1.6.5', '0123456789abcdef0123456789abcdef')
 
     provides('mpi@3.1', when='@2.0.0')
     provides('mpi@3.0', when='@1.10.3')
diff --git a/var/spack/repos/builtin.mock/packages/multivalue-variant/package.py b/var/spack/repos/builtin.mock/packages/multivalue-variant/package.py
index 34663434cb..65ca9d6854 100644
--- a/var/spack/repos/builtin.mock/packages/multivalue-variant/package.py
+++ b/var/spack/repos/builtin.mock/packages/multivalue-variant/package.py
@@ -10,10 +10,10 @@ class MultivalueVariant(Package):
     homepage = "http://www.llnl.gov"
     url = "http://www.llnl.gov/mpileaks-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
-    version(2.1, 'foobarbaz')
-    version(2.2, 'foobarbaz')
-    version(2.3, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
+    version(2.1, '0123456789abcdef0123456789abcdef')
+    version(2.2, '0123456789abcdef0123456789abcdef')
+    version(2.3, '0123456789abcdef0123456789abcdef')
 
     variant('debug', default=False, description='Debug variant')
     variant(
diff --git a/var/spack/repos/builtin.mock/packages/mvdefaults/package.py b/var/spack/repos/builtin.mock/packages/mvdefaults/package.py
index d6f7e7e0db..a45350a5c5 100644
--- a/var/spack/repos/builtin.mock/packages/mvdefaults/package.py
+++ b/var/spack/repos/builtin.mock/packages/mvdefaults/package.py
@@ -3,8 +3,10 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class Mvdefaults(Package):
+    homepage = "http://www.example.com"
+    url      = "http://www.example.com/mvdefaults-1.0.tar.gz"
 
-    version('1.0', 'abcdef')
+    version('1.0', 'abcdef1234567890abcdef1234567890')
 
     variant('foo', values=('a', 'b', 'c'), default=('a', 'b', 'c'),
             multi=True, description='')
diff --git a/var/spack/repos/builtin.mock/packages/override-context-templates/package.py b/var/spack/repos/builtin.mock/packages/override-context-templates/package.py
index 9d8e0bbbc4..f2f6f1c941 100644
--- a/var/spack/repos/builtin.mock/packages/override-context-templates/package.py
+++ b/var/spack/repos/builtin.mock/packages/override-context-templates/package.py
@@ -14,7 +14,7 @@ class OverrideContextTemplates(Package):
     homepage = "http://www.fake-spack-example.org"
     url      = "http://www.fake-spack-example.org/downloads/fake-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     tcl_template = 'extension.tcl'
     tcl_context = {'sentence': "sentence from package"}
diff --git a/var/spack/repos/builtin.mock/packages/override-module-templates/package.py b/var/spack/repos/builtin.mock/packages/override-module-templates/package.py
index 3f552a7cb6..16d453d5b3 100644
--- a/var/spack/repos/builtin.mock/packages/override-module-templates/package.py
+++ b/var/spack/repos/builtin.mock/packages/override-module-templates/package.py
@@ -10,7 +10,7 @@ class OverrideModuleTemplates(Package):
     homepage = "http://www.fake-spack-example.org"
     url      = "http://www.fake-spack-example.org/downloads/fake-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     tcl_template = 'override.txt'
     lmod_template = 'override.txt'
diff --git a/var/spack/repos/builtin.mock/packages/perl-extension/package.py b/var/spack/repos/builtin.mock/packages/perl-extension/package.py
index 61f4531c25..1aab8838c4 100644
--- a/var/spack/repos/builtin.mock/packages/perl-extension/package.py
+++ b/var/spack/repos/builtin.mock/packages/perl-extension/package.py
@@ -13,8 +13,8 @@ class PerlExtension(PerlPackage):
     homepage = "http://www.example.com"
     url      = "http://www.example.com/extension1-1.0.tar.gz"
 
-    version('1.0', 'hash-extension-1.0')
-    version('2.0', 'hash-extension-2.0')
+    version('1.0', '00000000000000000000000000000010')
+    version('2.0', '00000000000000000000000000000020')
 
     extends("perl")
 
diff --git a/var/spack/repos/builtin.mock/packages/perl/package.py b/var/spack/repos/builtin.mock/packages/perl/package.py
index 376ea976e2..0e1b2a0f67 100644
--- a/var/spack/repos/builtin.mock/packages/perl/package.py
+++ b/var/spack/repos/builtin.mock/packages/perl/package.py
@@ -12,4 +12,4 @@ class Perl(Package):
 
     extendable = True
 
-    version('0.0.0', 'hash')
+    version('0.0.0', 'abcdef1234567890abcdef1234567890')
diff --git a/var/spack/repos/builtin.mock/packages/printing-package/package.py b/var/spack/repos/builtin.mock/packages/printing-package/package.py
index f221123668..9ccdca49ea 100644
--- a/var/spack/repos/builtin.mock/packages/printing-package/package.py
+++ b/var/spack/repos/builtin.mock/packages/printing-package/package.py
@@ -14,7 +14,7 @@ class PrintingPackage(Package):
     homepage = "http://www.example.com/printing_package"
     url      = "http://www.unit-test-should-replace-this-url/trivial_install-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         print("BEFORE INSTALL")
diff --git a/var/spack/repos/builtin.mock/packages/py-extension1/package.py b/var/spack/repos/builtin.mock/packages/py-extension1/package.py
index bfee8f95e8..d7a88c5123 100644
--- a/var/spack/repos/builtin.mock/packages/py-extension1/package.py
+++ b/var/spack/repos/builtin.mock/packages/py-extension1/package.py
@@ -16,8 +16,8 @@ class PyExtension1(PythonPackage):
     # Override settings in base class
     maintainers = []
 
-    version('1.0', 'hash-extension1-1.0')
-    version('2.0', 'hash-extension1-2.0')
+    version('1.0', '00000000000000000000000000000110')
+    version('2.0', '00000000000000000000000000000120')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/py-extension2/package.py b/var/spack/repos/builtin.mock/packages/py-extension2/package.py
index 05ad308d15..e4663ca789 100644
--- a/var/spack/repos/builtin.mock/packages/py-extension2/package.py
+++ b/var/spack/repos/builtin.mock/packages/py-extension2/package.py
@@ -20,7 +20,7 @@ class PyExtension2(PythonPackage):
     extends("python")
     depends_on('py-extension1', type=('build', 'run'))
 
-    version('1.0', 'hash-extension2-1.0')
+    version('1.0', '00000000000000000000000000000210')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/py-extension3/package.py b/var/spack/repos/builtin.mock/packages/py-extension3/package.py
index 1c3da0fa2d..575d38866f 100644
--- a/var/spack/repos/builtin.mock/packages/py-extension3/package.py
+++ b/var/spack/repos/builtin.mock/packages/py-extension3/package.py
@@ -16,6 +16,6 @@ class PyExtension3(Package):
     depends_on('patchelf@0.9', when='@1.0:1.1 ^python@:2')
     depends_on('patchelf@0.10', when='@1.0:1.1 ^python@3:')
 
-    version('2.0', 'hash-extension3-1.0')
-    version('1.1', 'hash-extension3-1.0')
-    version('1.0', 'hash-extension3-1.0')
+    version('2.0', '00000000000000000000000000000320')
+    version('1.1', '00000000000000000000000000000311')
+    version('1.0', '00000000000000000000000000000310')
diff --git a/var/spack/repos/builtin.mock/packages/quantum-espresso/package.py b/var/spack/repos/builtin.mock/packages/quantum-espresso/package.py
index c61e1d1842..7cfff2ed63 100644
--- a/var/spack/repos/builtin.mock/packages/quantum-espresso/package.py
+++ b/var/spack/repos/builtin.mock/packages/quantum-espresso/package.py
@@ -10,7 +10,7 @@ class QuantumEspresso(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/qe-1.0.tar.gz"
 
-    version(1.0, 'foobar')
+    version(1.0, '1234567890abcdef1234567890abcdef')
 
     variant('invino', default=True, description='?')
     variant('veritas', default=True, description='?')
diff --git a/var/spack/repos/builtin.mock/packages/raiser/package.py b/var/spack/repos/builtin.mock/packages/raiser/package.py
index 9fd15341bf..323d7b194e 100644
--- a/var/spack/repos/builtin.mock/packages/raiser/package.py
+++ b/var/spack/repos/builtin.mock/packages/raiser/package.py
@@ -17,7 +17,7 @@ class Raiser(Package):
     url = "http://www.example.com/a-1.0.tar.gz"
 
     version('1.0', '0123456789abcdef0123456789abcdef')
-    version('2.0', '2.0_a_hash')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     variant(
         'exc_type',
diff --git a/var/spack/repos/builtin.mock/packages/requires-virtual/package.py b/var/spack/repos/builtin.mock/packages/requires-virtual/package.py
index 00398c4caf..b995f3ae3a 100644
--- a/var/spack/repos/builtin.mock/packages/requires-virtual/package.py
+++ b/var/spack/repos/builtin.mock/packages/requires-virtual/package.py
@@ -11,6 +11,6 @@ class RequiresVirtual(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/a-1.0.tar.gz"
 
-    version('2.0', '2.0_a_hash')
+    version('2.0', 'abcdef0123456789abcdef0123456789')
 
     depends_on('stuff')
diff --git a/var/spack/repos/builtin.mock/packages/root-adds-virtual/package.py b/var/spack/repos/builtin.mock/packages/root-adds-virtual/package.py
index 167a81ca67..88c80e9844 100644
--- a/var/spack/repos/builtin.mock/packages/root-adds-virtual/package.py
+++ b/var/spack/repos/builtin.mock/packages/root-adds-virtual/package.py
@@ -3,6 +3,9 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class RootAddsVirtual(Package):
-    version('1.0', sha256='abcde')
+    homepage = "http://www.example.com"
+    url = "http://www.example.com/root-adds-virtual-1.0.tar.gz"
+
+    version('1.0', sha256='abcdef0123456789abcdef0123456789')
 
     depends_on('middle-adds-virtual')
diff --git a/var/spack/repos/builtin.mock/packages/root/package.py b/var/spack/repos/builtin.mock/packages/root/package.py
index b0de915b29..31fd31a4e0 100644
--- a/var/spack/repos/builtin.mock/packages/root/package.py
+++ b/var/spack/repos/builtin.mock/packages/root/package.py
@@ -3,6 +3,9 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR MIT)
 class Root(Package):
-    version('1.0', 'abcdef')
+    homepage = "http://www.example.com"
+    url = "http://www.example.com/root-1.0.tar.gz"
+
+    version('1.0', 'abcdef0123456789abcdef0123456789')
 
     depends_on('gmt')
diff --git a/var/spack/repos/builtin.mock/packages/singlevalue-variant/package.py b/var/spack/repos/builtin.mock/packages/singlevalue-variant/package.py
index 26d05ac296..15f6f58c42 100644
--- a/var/spack/repos/builtin.mock/packages/singlevalue-variant/package.py
+++ b/var/spack/repos/builtin.mock/packages/singlevalue-variant/package.py
@@ -8,7 +8,7 @@ class SinglevalueVariant(Package):
     homepage = "http://www.llnl.gov"
     url = "http://www.llnl.gov/mpileaks-1.0.tar.gz"
 
-    version(1.0, 'foobarbaz')
+    version(1.0, '0123456789abcdef0123456789abcdef')
 
     variant(
         'fum',
diff --git a/var/spack/repos/builtin.mock/packages/test-error/package.py b/var/spack/repos/builtin.mock/packages/test-error/package.py
index b50dd1f43f..efce8bd0fb 100644
--- a/var/spack/repos/builtin.mock/packages/test-error/package.py
+++ b/var/spack/repos/builtin.mock/packages/test-error/package.py
@@ -12,7 +12,7 @@ class TestError(Package):
     homepage = "http://www.example.com/test-failure"
     url      = "http://www.test-failure.test/test-failure-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/test-fail/package.py b/var/spack/repos/builtin.mock/packages/test-fail/package.py
index 13e5b0608d..79abfae85e 100644
--- a/var/spack/repos/builtin.mock/packages/test-fail/package.py
+++ b/var/spack/repos/builtin.mock/packages/test-fail/package.py
@@ -12,7 +12,7 @@ class TestFail(Package):
     homepage = "http://www.example.com/test-failure"
     url      = "http://www.test-failure.test/test-failure-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         mkdirp(prefix.bin)
diff --git a/var/spack/repos/builtin.mock/packages/trigger-external-non-default-variant/package.py b/var/spack/repos/builtin.mock/packages/trigger-external-non-default-variant/package.py
index 8b2b2be70d..0f3a0426b4 100644
--- a/var/spack/repos/builtin.mock/packages/trigger-external-non-default-variant/package.py
+++ b/var/spack/repos/builtin.mock/packages/trigger-external-non-default-variant/package.py
@@ -7,6 +7,6 @@ class TriggerExternalNonDefaultVariant(Package):
     homepage = "http://www.example.com"
     url = "http://www.someurl.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     depends_on('external-non-default-variant')
diff --git a/var/spack/repos/builtin.mock/packages/trivial-install-test-package/package.py b/var/spack/repos/builtin.mock/packages/trivial-install-test-package/package.py
index 995a752b5b..0153bde87a 100644
--- a/var/spack/repos/builtin.mock/packages/trivial-install-test-package/package.py
+++ b/var/spack/repos/builtin.mock/packages/trivial-install-test-package/package.py
@@ -12,7 +12,7 @@ class TrivialInstallTestPackage(Package):
     homepage = "http://www.example.com/trivial_install"
     url      = "http://www.unit-test-should-replace-this-url/trivial_install-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     def install(self, spec, prefix):
         configure('--prefix=%s' % prefix)
diff --git a/var/spack/repos/builtin.mock/packages/trivial-smoke-test/package.py b/var/spack/repos/builtin.mock/packages/trivial-smoke-test/package.py
index 6dbdd07ea8..5d7c3adf78 100644
--- a/var/spack/repos/builtin.mock/packages/trivial-smoke-test/package.py
+++ b/var/spack/repos/builtin.mock/packages/trivial-smoke-test/package.py
@@ -11,7 +11,7 @@ class TrivialSmokeTest(Package):
     homepage = "http://www.example.com/trivial_test"
     url      = "http://www.unit-test-should-replace-this-url/trivial_test-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     test_source_filename = 'cached_file.in'
 
diff --git a/var/spack/repos/builtin.mock/packages/unsat-provider/package.py b/var/spack/repos/builtin.mock/packages/unsat-provider/package.py
index a801b2c547..c8aef3563e 100644
--- a/var/spack/repos/builtin.mock/packages/unsat-provider/package.py
+++ b/var/spack/repos/builtin.mock/packages/unsat-provider/package.py
@@ -7,7 +7,7 @@ class UnsatProvider(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/v1.0.tgz"
 
-    version('1.0', sha256='foobarbaz')
+    version('1.0', sha256='0123456789abcdef0123456789abcdef')
 
     variant('foo', default=True, description='')
 
diff --git a/var/spack/repos/builtin.mock/packages/unsat-virtual-dependency/package.py b/var/spack/repos/builtin.mock/packages/unsat-virtual-dependency/package.py
index 0d3a688565..03682da7cf 100644
--- a/var/spack/repos/builtin.mock/packages/unsat-virtual-dependency/package.py
+++ b/var/spack/repos/builtin.mock/packages/unsat-virtual-dependency/package.py
@@ -7,6 +7,6 @@ class UnsatVirtualDependency(Package):
     homepage = "http://www.example.com"
     url = "http://www.example.com/v1.0.tgz"
 
-    version('1.0', sha256='foobarbaz')
+    version('1.0', sha256='0123456789abcdef0123456789abcdef')
 
     depends_on('unsatvdep')
diff --git a/var/spack/repos/builtin.mock/packages/url-list-test/package.py b/var/spack/repos/builtin.mock/packages/url-list-test/package.py
index 846a7bf18e..60a4279fc2 100644
--- a/var/spack/repos/builtin.mock/packages/url-list-test/package.py
+++ b/var/spack/repos/builtin.mock/packages/url-list-test/package.py
@@ -16,10 +16,10 @@ class UrlListTest(Package):
     list_url = 'file://' + web_data_path + '/index.html'
     list_depth = 3
 
-    version('0.0.0',   'abc000')
-    version('1.0.0',   'abc100')
-    version('3.0',     'abc30')
-    version('4.5',     'abc45')
-    version('2.0.0b2', 'abc200b2')
-    version('3.0a1',   'abc30a1')
-    version('4.5-rc5', 'abc45rc5')
+    version('0.0.0',   '00000000000000000000000000000000')
+    version('1.0.0',   '00000000000000000000000000000100')
+    version('3.0',     '00000000000000000000000000000030')
+    version('4.5',     '00000000000000000000000000000450')
+    version('2.0.0b2', '000000000000000000000000000200b2')
+    version('3.0a1',   '000000000000000000000000000030a1')
+    version('4.5-rc5', '000000000000000000000000000045c5')
diff --git a/var/spack/repos/builtin.mock/packages/url-only-override-with-gaps/package.py b/var/spack/repos/builtin.mock/packages/url-only-override-with-gaps/package.py
index 1b797ca3cd..c532539ee1 100644
--- a/var/spack/repos/builtin.mock/packages/url-only-override-with-gaps/package.py
+++ b/var/spack/repos/builtin.mock/packages/url-only-override-with-gaps/package.py
@@ -9,10 +9,13 @@ from spack import *
 class UrlOnlyOverrideWithGaps(Package):
     homepage = 'http://www.example.com'
 
-    version('1.0.5', 'abcdef0')
-    version('1.0.0', 'bcdef0a', url='http://a.example.com/url_override-1.0.0.tar.gz')
-    version('0.9.5', 'cdef0ab')
-    version('0.9.0', 'def0abc', url='http://b.example.com/url_override-0.9.0.tar.gz')
-    version('0.8.5', 'ef0abcd')
-    version('0.8.1', 'f0abcde', url='http://c.example.com/url_override-0.8.1.tar.gz')
-    version('0.7.0', '0abcdef')
+    version('1.0.5', 'abcdef0123456789abcdef0123456789')
+    version('1.0.0', 'bcdef0123456789abcdef0123456789a',
+            url='http://a.example.com/url_override-1.0.0.tar.gz')
+    version('0.9.5', 'cdef0123456789abcdef0123456789ab')
+    version('0.9.0', 'def0123456789abcdef0123456789abc',
+            url='http://b.example.com/url_override-0.9.0.tar.gz')
+    version('0.8.5', 'ef0123456789abcdef0123456789abcd')
+    version('0.8.1', 'f0123456789abcdef0123456789abcde',
+            url='http://c.example.com/url_override-0.8.1.tar.gz')
+    version('0.7.0', '0123456789abcdef0123456789abcdef')
diff --git a/var/spack/repos/builtin.mock/packages/url-only-override/package.py b/var/spack/repos/builtin.mock/packages/url-only-override/package.py
index 9a3d01036f..61c3b220d1 100644
--- a/var/spack/repos/builtin.mock/packages/url-only-override/package.py
+++ b/var/spack/repos/builtin.mock/packages/url-only-override/package.py
@@ -9,6 +9,6 @@ from spack import *
 class UrlOnlyOverride(Package):
     homepage = 'http://www.example.com'
 
-    version('1.0.0', 'cxyzab', url='http://a.example.com/url_override-1.0.0.tar.gz')
-    version('0.9.0', 'bcxyza', url='http://b.example.com/url_override-0.9.0.tar.gz')
-    version('0.8.1', 'cxyzab', url='http://c.example.com/url_override-0.8.1.tar.gz')
+    version('1.0.0', '0123456789abcdef0123456789abcdef', url='http://a.example.com/url_override-1.0.0.tar.gz')
+    version('0.9.0', 'fedcba9876543210fedcba9876543210', url='http://b.example.com/url_override-0.9.0.tar.gz')
+    version('0.8.1', '0123456789abcdef0123456789abcdef', url='http://c.example.com/url_override-0.8.1.tar.gz')
diff --git a/var/spack/repos/builtin.mock/packages/url_override/package.py b/var/spack/repos/builtin.mock/packages/url_override/package.py
index c68fd0edd0..fdbf31a002 100644
--- a/var/spack/repos/builtin.mock/packages/url_override/package.py
+++ b/var/spack/repos/builtin.mock/packages/url_override/package.py
@@ -10,6 +10,6 @@ class UrlOverride(Package):
     homepage = 'http://www.doesnotexist.org'
     url      = 'http://www.doesnotexist.org/url_override-1.0.0.tar.gz'
 
-    version('1.0.0', 'cxyzab')
-    version('0.9.0', 'bcxyza', url='http://www.anothersite.org/uo-0.9.0.tgz')
-    version('0.8.1', 'cxyzab')
+    version('1.0.0', '0123456789abcdef0123456789abcdef')
+    version('0.9.0', 'fedcba9876543210fedcba9876543210', url='http://www.anothersite.org/uo-0.9.0.tgz')
+    version('0.8.1', '0123456789abcdef0123456789abcdef')
diff --git a/var/spack/repos/builtin.mock/packages/zmpi/package.py b/var/spack/repos/builtin.mock/packages/zmpi/package.py
index af3bee6ef3..e50bc1ab9d 100644
--- a/var/spack/repos/builtin.mock/packages/zmpi/package.py
+++ b/var/spack/repos/builtin.mock/packages/zmpi/package.py
@@ -12,7 +12,7 @@ class Zmpi(Package):
     homepage = "http://www.spack-fake-zmpi.org"
     url      = "http://www.spack-fake-zmpi.org/downloads/zmpi-1.0.tar.gz"
 
-    version('1.0', 'foobarbaz')
+    version('1.0', '0123456789abcdef0123456789abcdef')
 
     provides('mpi@:10.0')
     depends_on('fake')