fix(cache): use urlparse for case-insensitive HTTP scheme check

Xaenalt · claude · cursoragent · Xaenalt · commit 28678d6ca6f6 · 2026-06-30T10:04:36.000-04:00
Co-Authored-By: Claude &lt;claude@anthropic.com&gt;
Signed-off-by: Sean Pryor &lt;spryor@redhat.com&gt;
Co-authored-by: Cursor &lt;cursoragent@cursor.com&gt;
diff --git a/src/fromager/cache.py b/src/fromager/cache.py
@@ -590,7 +590,7 @@ def _parse_project_page(html: str, base_url: str) -> list[ArtifactInfo]:
                 url = url_part
 
             # Reject plaintext HTTP URLs that lack integrity metadata
-            if url.startswith("http://") and not sha256:
+            if urlparse(url).scheme.lower() == "http" and not sha256:
                 logger.warning(
                     "skipping insecure artifact %r (http without sha256)", filename
                 )

Original file line number	Diff line number	Diff line change
`@@ -590,7 +590,7 @@ def _parse_project_page(html: str, base_url: str) -> list[ArtifactInfo]:`
`590`	`590`	`url = url_part`
`591`	`591`
`592`	`592`	`# Reject plaintext HTTP URLs that lack integrity metadata`
`593`		`- if url.startswith("http://") and not sha256:`
	`593`	`+ if urlparse(url).scheme.lower() == "http" and not sha256:`
`594`	`594`	`logger.warning(`
`595`	`595`	`"skipping insecure artifact %r (http without sha256)", filename`
`596`	`596`	`)`