You use a temp directory to store the file while downloading, then move it to the cache so the addition of the complete file is atomic. The file name of the temp file should be checked to validate that you don't overwrite another process' download.
Currently downloading urls should be registered with the server process (a simple list or set would work). New requests should be checked against that; if there is a matching url in there, the process must wait until that download is finished and that file should be delivered to both Alice and Bob. You need to store the local file path and the url it was downloaded from and checking against that when a request is made; there might be two foobar.iso files on the Internet or the network, and they may be different (such as in differently versioned directories). -- http://mail.python.org/mailman/listinfo/python-list