@alalazo @adamjstewart

We can't do this for every crazy download site out there. But PyPI is important and provides lots of stuff to Spack. So let's get it right... here is the link describing their XMLRPC API:
https://wiki.python.org/moin/PyPIXmlRpc

1. We can use this to create a url_for_version() method that will call the API's release_urls(package_name, version) to determine the download URL. It should NOT download the checksum at install time, since the whole point is to CHECK it at install time.

2. This new url_for_version would come standard in the PyPIPackage base class. Or... we provide it as a method and ask Package authors to write url_for_version = pypi_url_for_version as needed.

3. We can use the API to improve automagic generation of PyPI packages. The auto-generator would query it for a bunch of URLs and checksums. If we're clever enough with picking apart package.py files, we could even have a procedure that auto-updates a package.py file for new versions of the package.