Details
Description
Mirrored repos are not fully mirrored: they are still consulted directly. This really defeats the purpose of mirroring. In more detail, if a repo is mirrored, the mirror is added to the beginning of the list of remote repos, but the mirrored repo is left in the list. So for instance if you have configured your local nexus repo to block downloading of some urls, the presence of the original repo after the mirror will mean that the urls can be downloaded directly anyway.
Solution: remove the mirrored repos from the list of remote repos when adding the mirror.

proposed change:
diff --git a/pax-url-aether/src/main/java/org/ops4j/pax/url/mvn/internal/AetherBasedResolver.java b/pax-url-aether/src/main/java/org/ops4j/pax/url/mvn/internal/AetherBasedResolver.java
index b911d7e..2c2093b 100644
— a/pax-url-aether/src/main/java/org/ops4j/pax/url/mvn/internal/AetherBasedResolver.java
+++ b/pax-url-aether/src/main/java/org/ops4j/pax/url/mvn/internal/AetherBasedResolver.java
@@ -122,6 +122,7 @@ public class AetherBasedResolver { mirroedRepos.add( naming.get( rep ) ); }
mirror.setMirroredRepositories( mirroedRepos );
+ m_remoteRepos.removeAll(mirroedRepos);
m_remoteRepos.add( 0, mirror );
}