Wheel cache origin mismatch warning exposes URL credentials

Description

WheelCache.record_download_origin() serializes origin.json using PEP 610, which correctly strips URL credentials. When the file already exists, however, it compares that stripped URL with the raw in-memory download_info.url and logs both values on a mismatch.

Re-recording the same authenticated archive therefore produces a false mismatch warning and includes the raw username and password in terminal or CI logs.

Expected behavior

The comparison and warning should use the same credential-stripped URL representation that is written to origin.json.

pip version

Current main (fc24f1eae / 26.3.dev0)

Python version

3.10.19

OS

macOS

How to reproduce

From a pip source checkout:

import logging
import tempfile

from pip._internal.cache import WheelCache
from pip._internal.models.direct_url import ArchiveInfo, DirectUrl

logging.basicConfig(level=logging.WARNING)
info = DirectUrl(
    url="https://user:[email protected]/pkg.tar.gz",
    archive_info=ArchiveInfo(),
)
with tempfile.TemporaryDirectory() as cache_dir:
    WheelCache.record_download_origin(cache_dir, info)
    WheelCache.record_download_origin(cache_dir, info)

Output

WARNING:pip._internal.cache:Origin URL https://example.test/pkg.tar.gz ... does not match download URL https://user:[email protected]/pkg.tar.gz. ...

I have a focused fix with regression coverage for both the false mismatch and credential redaction.

Code of Conduct

• I agree to follow the PSF Code of Conduct.