Repository: spack/spack

Issue:
Installation issue: py-configobj
### Issue
Installation fetches version 5.0.6 and fails with a ChecksumError: 

> Error: ChecksumError: sha256 checksum failed for /tmp/user/spack-stage/spack-stage-py-configobj-5.0.6-6uaczs2kvvkt6uh2hqiqnetlbrbkiqaz/v5.0.6.tar.gz
    Expected a2f5650770e1c87fb335af19a9b7eb73fc05ccf22144eb68db7d00cd2bcb0902 but got 2e140354efcca6f558ff9ee941b435ae09a617bc071797bef62c8d6ed2033d5e



### Steps to reproduce the issue
<!-- Fill in the exact spec you are trying to build and the relevant part of the error message -->
```console
$ spack install py-configobj
```

### Information on your system

<!-- Please include the output of `spack debug report` -->
* **Spack:** 0.14.2-828-f20202387
* **Python:** 3.6.9
* **Platform:** linux-ubuntu18.04-zen2


<!-- If you have any relevant configuration detail (custom `packages.yaml` or `modules.yaml`, etc.) you can add that here as well. -->


<!-- Some packages have maintainers who have volunteered to debug build failures. Run `spack maintainers <name-of-the-package>` and @mention them here if they exist. -->

### General information

- [x] I have run `spack debug report` and reported the version of Spack/Python/Platform
- [x] I have run `spack maintainers <name-of-the-package>` and @mentioned any maintainers
- [ ] I have uploaded the build log and environment files
- [x] I have searched the issues of this repo and believe this is not a duplicate



Discussion:
@Sinan81 I believe you wrote this package. Can you take a look? This is why I prefer to download Python packages from PyPI, where the checksum can't change like on GitHub.
Would either editing the package file or installing with no-checksum be a viable work-around? 
Sorry, just saw the discussion thread.

@elleryames you can install without checksum like
```
spack install --no-checksum py-configobj
```
@adamjstewart this package name rings a bell. I remember experiencing some issues with the version at pypi. Let me take a look at it.
From the corresponding PR https://github.com/spack/spack/pull/12639

> Turns out v 5.0.6 on PyPi was outdated (although the version number is same as the latest release github which is absolutely confusing). Neither version 4.7.2 nor v 5.0.6 on github depends on setuptools, hence mystery is solved.



Resolving patch:
diff --git a/var/spack/repos/builtin/packages/py-configobj/package.py b/var/spack/repos/builtin/packages/py-configobj/package.py
--- a/var/spack/repos/builtin/packages/py-configobj/package.py
+++ b/var/spack/repos/builtin/packages/py-configobj/package.py
@@ -16,15 +16,5 @@ class PyConfigobj(PythonPackage):
     version('5.0.6', sha256='a2f5650770e1c87fb335af19a9b7eb73fc05ccf22144eb68db7d00cd2bcb0902')
     version('4.7.2', sha256='515ff923462592e8321df8b48c47e3428f8d406ee22b8de77bef969d1af11171')
 
-    # The version on PyPi seems to be outdated (2014) although confusingly
-    # enough version number is the same as the latest release on github.
     depends_on('py-six', type=('build', 'run'))
     depends_on('python@2.7:2.8,3.4:', type=('build', 'run'))
-
-    def url_for_version(self, version):
-        if version <= Version('5.0.0'):
-            url = "https://pypi.io/packages/source/c/configobj/configobj-{0}.tar.gz"
-        else:
-            url = "https://github.com/DiffSK/configobj/archive/v{0}.tar.gz"
-
-        return url.format(version)


Test patch: