Cannot install a collection (wrong hash) when there are multiple versions available in hosted galaxy repository.

[Ythogtha]

• What are you trying to do?
  I'm trying to use this plugin for hosted galaxy repository, on pre-version 0.3.0.
  I have two version of the same ansible collection : 1.0.0 and 1.0.1, added one after the other.
  When I try installing this collection with ansible-galaxy, I have a hash verification failure.
  Using the Nexus API, on an URL like this one : https://[mynexus]/repository/[my-repo-galaxy]/api/v2/collections/[namespace]/[name]/versions/1.0.1/ the result shows this :

{
  artifact: {sha: [sha of version 1.0.0]},
  download_url: [url of 1.0.1 file],
  href: [href finishing in 1.0.0],
  version: "1.0.1"
}

The sha is for the wrong version, it looks like - after some tests - it's using the first version added in the repository.
Starting from scratch (deleting and recreating the repository) and adding 1.0.1 before 1.0.0, the API answer for 1.0.0 shows sha of 1.0.1.

• What feature or behavior is this required for?
  Using the hosted repository with ansible-galaxy, and multiple versions of a collection.

• How could we solve this issue? (Not knowing is okay!)
  Finding out why the wrong sha is returned by the API and fixing it, I guess.
  I'm sorry I'm not familiar enough with either Java or Nexus to submit code...

• Anything else?
  Thanks :)

cc @DarthHater @bhamail @l3ender

[Ythogtha]

As a workaround, one could setup a galaxy-proxy repository alongside the galaxy-hosted, and use the galaxy-hosted as source for the galaxy-proxy.
Things looks like they are working as they should with this somewhat convoluted setup.

Edit: Turns out I was wrong, the proxy suffers the same issue as the hosted it refers to, hence no workaround.

[tree4125]

I ran into the same issue, just created a pull request to fix it. the issue was that the endpoint wasn't filtering on version so the query was returning all versions and the for loop right after was just grabbing the first item and breaking out of the loop.