@alalazo I think the urls extension from #13881 to allow backup urls
for fetching doesn't work. I'm following the directions from:

https://spack.readthedocs.io/en/latest/packaging_guide.html#mirrors-of-the-main-url

Here's a simple example using bzip2. I'm using spack 87e69ee
from today, 2020-03-11.

Use bzip2, comment out all but version 1.0.8, and change url to urls
(plural) to a list of two urls.

  urls = [
      'https://sourceware.org/pub/bzip2/bzip2-1.0.8.tar.gz',
      'ftp://sourceware.org/pub/bzip2/bzip2-1.0.8.tar.gz',
  ]
  ...
  version('1.0.8', sha256='...')
  # version('1.0.7', sha256='...')
  # version('1.0.6', sha256='...')

This case is just one version and two urls, that is, more urls than
versions. This case mostly works.

spack info bzip2

Preferred version:  
    1.0.8    https://sourceware.org/pub/bzip2/bzip2-1.0.8.tar.gz

Safe versions:  
    1.0.8    ftp://sourceware.org/pub/bzip2/bzip2-1.0.8.tar.gz

Although this mostly works (and does fetch with https), it's kinda
wonky because 'preferred' says https and 'safe' says ftp for the same
version.

But now, return versions 1.0.7 and 1.0.6, so we have 3 versions and
two urls and I get this error.

spack info bzip2

Preferred version:  
    1.0.8    https://sourceware.org/pub/bzip2/bzip2-1.0.8.tar.gz

Safe versions:  
    1.0.8    ftp://sourceware.org/pub/bzip2/bzip2-1.0.8.tar.gz
==> Error: pop from empty list

The problem seems to happen whenever there are more versions than
urls. This suggests that something is pairing the list of versions
with the list of urls. That is, walking down both lists and
complaining when urls runs out before versions.

Instead, it should be more of a cross product. That is, any version
should be fetchable from anything on the list of backup urls.