Private repository container package is visible outside of repository

[stuzer05]

Description

I have private user repository and I pushed docker continer to gitea. Then I linked container package to private repo. But everyone can see and pull my "private" container.

How to make public repo packages public and private repo packages private?

Gitea Version

1.23.0+dev-535-g70b7df0e5e

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

docker

Database

None

[techknowlogick]

To confirm, your user visibility is public and the repo is private?

[stuzer05]

To confirm, your user visibility is public and the repo is private?

My user visibility is public and repo is private, yes

[lunny]

The packages visibility is derived from user/org's even they are linked to repositories. This is by design at least for current.

[stuzer05]

The packages visibility is derived from user/org's even they are linked to repositories. This is by design at least for current.

Think it would make sense if package is linked to private repo, package would be hidden accordingly. Should I make a pr?

[lunny]

The packages visibility is derived from user/org's even they are linked to repositories. This is by design at least for current.

Think it would make sense if package is linked to private repo, package would be hidden accordingly. Should I make a pr?

Please have more proposals and discussion here before you create a pull request.

It seems reasonable from me to change the visibility of the package to derieve the repository's after it has been linked to a repository. But then maybe we need a new table to store the permission of the package? Otherwise, it's difficult when list packages from organization or user and also for exploring packages feature in the future.

[techknowlogick]

Sadly this is more difficult than it appears at first glance as many of the package types support listing of the packages, and if the visibility is based on if a user can see it or not then potentially indexes need to be computed on demand, and for things such as cargo where the index is stored in a git repo, then that's X new repos that need to be created (similar for apt/rpm where they sign the index).

This would be a welcome addition, as others have also requested it. I just wanted to give you a heads up on somethings you would need to consider before diving in.

[stuzer05]

Sadly this is more difficult than it appears at first glance as many of the package types support listing of the packages, and if the visibility is based on if a user can see it or not then potentially indexes need to be computed on demand, and for things such as cargo where the index is stored in a git repo, then that's X new repos that need to be created (similar for apt/rpm where they sign the index).

This would be a welcome addition, as others have also requested it. I just wanted to give you a heads up on somethings you would need to consider before diving in.

You are absolutely right, it is indeed a lot harder than i appeared