[simonchrz]

proxy mirror, mirror API jobs and schedules listed the versions of an unversioned PURL from the public registry, whatever upstream.* says. They now list them from the configured upstream, through the proxy's upstream client, so upstream.auth and the private address rules apply. npm packages in npm_routes are listed from their route.

• Listed from the configured upstream: npm, gem, golang, hex (hex_api), pub, pypi, maven, nuget, composer, cran and brew.
• cargo, conda and julia: the proxy's upstream doesn't serve the API the registries client lists from. Versions come from the public registry while the upstream is the default one; with another upstream the error asks for a version.
• Composer packages in composer_routes, and helm, swift, apk and the rest: the error asks for a version instead of the registries error. Fetching those is proxy mirror fails for pypi, conda, helm, composer, swift and others: resolver has no registries registered #414.

With PROXY_UPSTREAM_NPM=http://127.0.0.1:1, proxy mirror -dry-run pkg:npm/left-pad listed 15 versions on main and now fails on the unreachable upstream.

The second part of #524, packuments over 10 MiB, needs git-pkgs/registries#109 and a release, so this refs the issue rather than closing it.

[andrew]

This is waiting on git-pkgs/registries#99. The Maven client asks search.maven.org before the configured base URL, so with a custom upstream.maven unversioned PURLs still send coordinates to Central's search and can list Central's versions instead of the upstream's. Once #99 is fixed and released, this needs the registries bump.