Spack ignores '-k' when searching 'list_url' #6708
Description
spack's latest version of r-dplyr (0.7.3) has been displaced by 0.7.4, which means spack has to search the archive path set by 'url_list' to find the tarball. Despite using -k, spack produces certificate errors when attempting to fetch.
Steps to reproduce the issue
$ spack -k fetch r-dplyr
==> Warning: You asked for --insecure. Will NOT check SSL certificates.
==> Fetching https://cran.rstudio.com/src/contrib/dplyr_0.7.3.tar.gz
curl: (22) The requested URL returned error: 404 Not Found
==> Fetching from https://cran.rstudio.com/src/contrib/dplyr_0.7.3.tar.gz failed.
==> Warning: Spack was unable to fetch url list due to a certificate verification problem. You can try running spack -k, which will not check SSL certificates. Use this at your own risk.
==> Warning: Spack was unable to fetch url list due to a certificate verification problem. You can try running spack -k, which will not check SSL certificates. Use this at your own risk.
==> Can not find version 0.7.3 in url_list
==> Error: All fetchers failed for r-dplyr-0.7.3-oenu3sxwamshghyxbtmsehm25vihbhvd
...