Reposilite should search all mirrors when looking up the last version of a package

[Jean-Daniel]

Request details

I use to have an artifactory virtual repository exposing both the Google maven repo (https://dl.google.com/android/maven2/) and maven central (https://repo1.maven.org/maven2/).

Unfortunately, both repositories exposes a bunch of deprecated packages, that use to be published in one repo, and are now published in the other.

When requesting the last version of a package like com.android.tools.build:gradle, if reposilite lookup maven central first, it find the version 2.3.3, and does no try to search for more recent version in the Google repo.

On the other side, when looking up for com.google.devtools.ksp:symbol-processing, this is the Google repo that return an old release.

Artifactory was handling it properly by returning the most recent version for both packages.

An other way to help mitigation this issue, would be to support a groups blacklist in the mirror setting to be able to tell reposilite to ignore some mirror for a specific package.

[dzikoysk]

Yeah, I think this kind of enhancement makes sense for such a weird scenarios. For now, I think you could try to use this functionality:

• https://reposilite.com/guide/mirrors#allowed-groups

to only list these particular artifact groups for each repo. A bit annoying, but should work as a quick solution.