Description of problem:

In the case of "on demand" download policy, if there are multiple remote URL for the similar rpms (same NVERA but have different checksum), Pulp may pick the wrong remote URL to download the rpm.

This can happen when some third party repositories re-signed Red Hat rpm without changing the rpm name. Customer syncs both Red Hat repository and the third party repository containing the same rpm.


Steps to Reproduce:
1. Prepare any unsigned rpm, such as foo-1.0-1.noarch.rpm
2. Make a copy of the unsigned rpm and then sign it with a gpg key.
3. In the Satellite "/var/www/html/pub" directory, create the following 2 directories.
~~~
/var/www/html/pub/test_repo_redhat
/var/www/html/pub/test_repo_custom
~~~

4. Copy the signed rpm to both directories.
5. Run createrepo command in both directory.
6. In Satellite web ui, create the following 2 custom repositories:
~~~
name: test_repo_redhat
Upstream_url: http://your.satellite.fqdn/pub/test_repo_redhat/
Download policy: On demand

name: test_repo_custom
Upstream_url: http://your.satellite.fqdn/pub/test_repo_custom/
Download policy: On demand
~~~

7. Sync both repositories.
8. If you run the following sql query, you should get something like below:
~~~
Example:

Pulpcore=# select url, sha256 from core_remoteartifact where url ilike '%foo-1.0-1%';
                                                     url              |                              sha256                              
--------------------------------------------------------------------- +-----------------------------------------------------------------
 http://your.satellite.fqdn/pub/test_repo_redhat/foo-1.0-1.noarch.rpm | 6c3d14090ee0efdd7dba9fbabb5fb54bf403e76000e1137652dd62162ce3aa17
 http://your.satellite.fqdn/pub/test_repo_custom/foo-1.0-1.noarch.rpm | 6c3d14090ee0efdd7dba9fbabb5fb54bf403e76000e1137652dd62162ce3aa17
~~~

9. Remove everything in the "/var/www/html/pub/test_repo_custom" directory.
10. Copy the unsigned 'foo-1.0-1.noarch.rpm" to "/var/www/html/pub/test_repo_custom" directory and run createrepo.
11. Now sync the "test_repo_custom" repository again.
12. If you run the following sql query now, you should see the duplicate remote URL with new checksum (checksum of the unsigned rpm).
~~~
Example:

Pulpcore=# select url,sha256 from core_remoteartifact where url ilike '%foo-1.0-1%';
                                                     url              |                              sha256                              
--------------------------------------------------------------------- +-----------------------------------------------------------------
 http://your.satellite.fqdn/pub/test_repo_redhat/foo-1.0-1.noarch.rpm | 6c3d14090ee0efdd7dba9fbabb5fb54bf403e76000e1137652dd62162ce3aa17
 http://your.satellite.fqdn/pub/test_repo_custom/foo-1.0-1.noarch.rpm | 6c3d14090ee0efdd7dba9fbabb5fb54bf403e76000e1137652dd62162ce3aa17
 http://your.satellite.fqdn/pub/test_repo_custom/foo-1.0-1.noarch.rpm | ebebedda75647f51ef52499040d72ea704677ab0bc2f73bb312e9133b4a32f70
~~~


Actual results:
Download the rpm in "test_repo_redhat" repository will get the wrong rpm. Expected "6c3d14090ee0efdd7dba9fbabb5fb54bf403e76000e1137652dd62162ce3aa17"(signed rpm) but got "ebebedda75647f51ef52499040d72ea704677ab0bc2f73bb312e9133b4a32f70"(unsigned rpm)
~~~
Example:

# curl -k https://your.satellite.fqdn/pulp/content/org/Library/custom/custom/test_repo_redhat/Packages/f/foo-1.0-1.noarch.rpm | sha256sum
ebebedda75647f51ef52499040d72ea704677ab0bc2f73bb312e9133b4a32f70

# curl -k https://your.satellite.fqdn/pulp/content/org/Library/custom/custom/test_repo_redhat/repodata/xxxxxxx-primary.xml.gz | gunzip | grep "checksum"
<checksum type="sha256" pkgid="YES">6c3d14090ee0efdd7dba9fbabb5fb54bf403e76000e1137652dd62162ce3aa17</checksum>
~~~


Expected results:
Downloaded rpm match the repo metadata.