Private repository container package is visible outside of repository #13560

New Issue

GiteaMirror · 2025-11-02T10:46:02-06:00

GiteaMirror commented

2025-11-02 10:46:02 -06:00

Originally created by @stuzer05 on GitHub (Oct 2, 2024).

Description

I have private user repository and I pushed docker continer to gitea. Then I linked container package to private repo. But everyone can see and pull my "private" container.

How to make public repo packages public and private repo packages private?

Gitea Version

1.23.0+dev-535-g70b7df0e5e

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

docker

Database

None

Originally created by @stuzer05 on GitHub (Oct 2, 2024). ### Description I have private user repository and I pushed docker continer to gitea. Then I linked container package to private repo. But everyone can see and pull my "private" container. How to make public repo packages public and private repo packages private? ### Gitea Version 1.23.0+dev-535-g70b7df0e5e ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? docker ### Database None

GiteaMirror added the type/proposal label 2025-11-02 10:46:03 -06:00

GiteaMirror commented

2025-11-02 10:46:04 -06:00

@techknowlogick commented on GitHub (Oct 2, 2024):

To confirm, your user visibility is public and the repo is private?

@techknowlogick commented on GitHub (Oct 2, 2024): To confirm, your user visibility is public and the repo is private?

GiteaMirror commented

2025-11-02 10:46:04 -06:00

@stuzer05 commented on GitHub (Oct 3, 2024):

To confirm, your user visibility is public and the repo is private?

My user visibility is public and repo is private, yes

@stuzer05 commented on GitHub (Oct 3, 2024): > To confirm, your user visibility is public and the repo is private? My user visibility is public and repo is private, yes

GiteaMirror commented

2025-11-02 10:46:04 -06:00

@lunny commented on GitHub (Oct 7, 2024):

The packages visibility is derived from user/org's even they are linked to repositories. This is by design at least for current.

@lunny commented on GitHub (Oct 7, 2024): The packages visibility is derived from user/org's even they are linked to repositories. This is by design at least for current.

GiteaMirror commented

2025-11-02 10:46:04 -06:00

@stuzer05 commented on GitHub (Oct 7, 2024):

The packages visibility is derived from user/org's even they are linked to repositories. This is by design at least for current.

Think it would make sense if package is linked to private repo, package would be hidden accordingly. Should I make a pr?

@stuzer05 commented on GitHub (Oct 7, 2024): > The packages visibility is derived from user/org's even they are linked to repositories. This is by design at least for current. Think it would make sense if package is linked to private repo, package would be hidden accordingly. Should I make a pr?

GiteaMirror commented

2025-11-02 10:46:04 -06:00

@lunny commented on GitHub (Oct 7, 2024):

The packages visibility is derived from user/org's even they are linked to repositories. This is by design at least for current.

Think it would make sense if package is linked to private repo, package would be hidden accordingly. Should I make a pr?

Please have more proposals and discussion here before you create a pull request.

It seems reasonable from me to change the visibility of the package to derieve the repository's after it has been linked to a repository. But then maybe we need a new table to store the permission of the package? Otherwise, it's difficult when list packages from organization or user and also for exploring packages feature in the future.

@lunny commented on GitHub (Oct 7, 2024): > > The packages visibility is derived from user/org's even they are linked to repositories. This is by design at least for current. > > Think it would make sense if package is linked to private repo, package would be hidden accordingly. Should I make a pr? Please have more proposals and discussion here before you create a pull request. It seems reasonable from me to change the visibility of the package to derieve the repository's after it has been linked to a repository. But then maybe we need a new table to store the permission of the package? Otherwise, it's difficult when list packages from organization or user and also for exploring packages feature in the future.

GiteaMirror commented

2025-11-02 10:46:04 -06:00

@techknowlogick commented on GitHub (Oct 7, 2024):

Sadly this is more difficult than it appears at first glance as many of the package types support listing of the packages, and if the visibility is based on if a user can see it or not then potentially indexes need to be computed on demand, and for things such as cargo where the index is stored in a git repo, then that's X new repos that need to be created (similar for apt/rpm where they sign the index).

This would be a welcome addition, as others have also requested it. I just wanted to give you a heads up on somethings you would need to consider before diving in.

@techknowlogick commented on GitHub (Oct 7, 2024): Sadly this is more difficult than it appears at first glance as many of the package types support listing of the packages, and if the visibility is based on if a user can see it or not then potentially indexes need to be computed on demand, and for things such as cargo where the index is stored in a git repo, then that's X new repos that need to be created (similar for apt/rpm where they sign the index). This would be a welcome addition, as others have also requested it. I just wanted to give you a heads up on somethings you would need to consider before diving in.

GiteaMirror commented

2025-11-02 10:46:04 -06:00

@stuzer05 commented on GitHub (Oct 8, 2024):

Sadly this is more difficult than it appears at first glance as many of the package types support listing of the packages, and if the visibility is based on if a user can see it or not then potentially indexes need to be computed on demand, and for things such as cargo where the index is stored in a git repo, then that's X new repos that need to be created (similar for apt/rpm where they sign the index).

This would be a welcome addition, as others have also requested it. I just wanted to give you a heads up on somethings you would need to consider before diving in.

You are absolutely right, it is indeed a lot harder than i appeared

@stuzer05 commented on GitHub (Oct 8, 2024): > Sadly this is more difficult than it appears at first glance as many of the package types support listing of the packages, and if the visibility is based on if a user can see it or not then potentially indexes need to be computed on demand, and for things such as cargo where the index is stored in a git repo, then that's X new repos that need to be created (similar for apt/rpm where they sign the index). > > This would be a welcome addition, as others have also requested it. I just wanted to give you a heads up on somethings you would need to consider before diving in. You are absolutely right, it is indeed a lot harder than i appeared

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#13560