checks.network: key shared URL futures by verification method too

The https probe for http://foo.org was stored under https://foo.org, so
another package's https://foo.org check reused it: it was told https
was available, and a dead URL went unreported.

Signed-off-by: Arthur Zamarin <arthurzam@gentoo.org>

Author: arthurzam

NEWS.rst

@@ -21,6 +21,10 @@ pkgcheck 0.10.49 (unreleased)
 - SuspiciousSrcUriChange: no longer reported when a SRC_URI only switches from
   ``http://`` to ``https://`` (Arthur Zamarin)
 
+- HttpsUrlAvailable, DeadUrl: a package using an ``https://`` URL that another
+  package uses as ``http://`` is no longer told https is available, and is
+  reported as DeadUrl when that URL is dead (Arthur Zamarin)
+
 -----------------------------
 pkgcheck 0.10.48 (2026-10-08)
 -----------------------------

src/pkgcheck/checks/network.py

@@ -207,13 +207,16 @@ def _schedule_check(self, func, attr, url, executor, futures, **kwargs):
 
         Note that this tries to avoid hitting the network for the same URL
         twice using a mapping from requested URLs to future objects, adding
-        result-checking callbacks to the futures of existing URLs.
+        result-checking callbacks to the futures of existing URLs.  Futures are
+        keyed by verification method too, so an https:// probe for an http://
+        URL isn't mistaken for a check of the https:// URL itself.
         """
-        future = futures.get(url)
+        key = (func.__name__, url)
+        future = futures.get(key)
         if future is None:
             future = executor.submit(func, attr, url, **kwargs)
             future.add_done_callback(partial(self.task_done, None, None))
-            futures[url] = future
+            futures[key] = future
         else:
             future.add_done_callback(partial(self.task_done, kwargs["pkg"], attr))
 
@@ -234,7 +237,7 @@ def schedule(self, pkg, executor, futures):
             if url.startswith("http://")
         )
         for attr, orig_url, url in http_to_https_urls:
-            future = futures[orig_url]
+            future = futures[(self._http_check.__name__, orig_url)]
             self._schedule_check(
                 self._https_available_check,
                 attr,
@@ -421,11 +424,12 @@ def _schedule_check(self, filename, url, executor, futures, **kwargs):
         twice using a mapping from requested URLs to future objects, adding
         result-checking callbacks to the futures of existing URLs.
         """
-        future = futures.get(url)
+        key = (self._provenance_check.__name__, url)
+        future = futures.get(key)
         if future is None:
             future = executor.submit(self._provenance_check, filename, url, **kwargs)
             future.add_done_callback(partial(self.task_done, None, None))
-            futures[url] = future
+            futures[key] = future
         else:
             future.add_done_callback(partial(self.task_done, kwargs["pkg"], filename))
 

tests/checks/test_network.py

@@ -1,17 +1,22 @@
 import importlib.util
 import os
+import queue
 import tempfile
 import urllib.request
+from concurrent.futures import ThreadPoolExecutor
+from contextlib import contextmanager
 from functools import partial
 from operator import attrgetter
+from types import SimpleNamespace
 from unittest.mock import patch
 
 import pytest
+from pkgcore.test.misc import FakePkg
 from snakeoil.formatters import PlainTextFormatter
 
 from pkgcheck import objects, reporters, scan
 from pkgcheck.base import PkgcheckUserException
-from pkgcheck.checks import NetworkCheck
+from pkgcheck.checks import NetworkCheck, network
 from pkgcheck.checks.network import DeadUrl, FetchablesUrlCheck, HomepageUrlCheck
 from pkgcheck.packages import RawCPV
 
@@ -140,3 +145,37 @@ def test_scan_ftp(self, check, result):
                 else:
                     assert results == [expected_result]
                     assert self._render_results(results), "failed rendering results"
+
+
+@pytest.mark.parametrize("https_alive", (True, False))
+def test_https_probe_not_shared_with_https_url(https_alive):
+    """An http:// URL's https probe and another package's https:// URL are separate checks."""
+
+    @contextmanager
+    def get(url, **kwargs):
+        if url.startswith("https://") and not https_alive:
+            raise network.RequestError(None, "dead https")
+        yield SimpleNamespace(history=[])
+
+    check = object.__new__(HomepageUrlCheck)
+    check.session = SimpleNamespace(get=get)
+    check.results_q = queue.SimpleQueue()
+    futures = {}
+    http_pkg = FakePkg("cat/http-1", data={"HOMEPAGE": "http://foo.org/"})
+    https_pkg = FakePkg("cat/https-1", data={"HOMEPAGE": "https://foo.org/"})
+    with ThreadPoolExecutor(max_workers=1) as executor:
+        for pkg in (http_pkg, https_pkg):
+            check.schedule(pkg, executor, futures)
+
+    results = []
+    while not check.results_q.empty():
+        results.extend(check.results_q.get())
+    if https_alive:
+        expected = [
+            network.HttpsUrlAvailable(
+                "HOMEPAGE", "http://foo.org/", "https://foo.org/", pkg=http_pkg
+            )
+        ]
+    else:
+        expected = [network.DeadUrl("HOMEPAGE", "https://foo.org/", "dead https", pkg=https_pkg)]
+    assert results == expected