When the collection contains image quay.io/second-image@sha256:1234535341312343 , and blockedImages contains quay.io/second-image:v1.0, even if this digest corresponds to the tag, the image will not be excluded from the mirror set.

It is very difficult to add an exact list of images to exclude from mirroring in ImageSetConfig's {{blockedImages}}, as the digests may change between one execution to the next. 

V1 of oc-mirror did allow the user to specify a regular expression in this list, which substantially facilitated the use of this functionality 
    

4.18
    

Always
    

    1. with the following imageSetConfig
kind: ImageSetConfiguration
apiVersion: mirror.openshift.io/v2alpha1
mirror:
  platform:
    channels:
    - name: stable-4.18
    blockedImages:
    - name: "(aws|gcp|azure|ibm|openstack)"
    2. oc-mirror --v2 -c isc.yaml --workspace file:///tmp/test docker://myregistry/myns --dry-run
    

Looking at the generated mapping.txt file, we see all images with names containing aws, azure, etc are still present in the file
    

the images corresponding to aws, gcp, etc (matching regex) are excluded from the file