> A package redacted for legal reasons should still be able to be built too! Presumably one or the other side of the relevant suit will need the package as evidence!
This doesn't make sense if the legal reason is accidental release of secrets or PI, in which case you absolutely do not want to leave it up.
I'm not talking about things like github tokens here, those can be revoked. But actual secrets or PI where that isn't possible.
I mean, unless the party you’re concerned about having your secret is the maintainers of the package store itself, what’s the functional difference between “it’s deleted from our servers” and “it’s marked private so only the author [or admins of the author’s org, insofar as user accounts are org-bound] can still download it”?
If I inadvertently committed (arbitrary example) my tax returns to a repo I'd hope that the operators of the package repository would promptly destroy all copies in their possession.