MeshDrop release readiness requires ghcr.io/sandwichfarm/meshdrop and target images to be publicly readable, or a documented alternative that proves anonymous install/pull behavior for the next v0.*.* release tag.
Current evidence in GSD:
npm run verify:ghcr-anonymous -- v0.1.5 fails with GHCR unauthorized.- Prior session token could not inspect or change package visibility via
gh api /orgs/sandwichfarm/packages/container/meshdrop because of missing package permissions.
Required unblocker:
- Make the relevant GHCR package(s) public, or document and implement the intended authenticated distribution path.
- Prove anonymous manifest readback for the next release tag from a clean environment.
- Keep release verification fail-loud when anonymous readback is expected but unavailable.
Acceptance:
npm run verify:ghcr-anonymous -- <next-release-tag> passes without GitHub credentials.- Release/readback docs name the exact image tags and digest evidence.
- If public GHCR is intentionally not supported, release docs and verifier behavior are updated so the product does not claim anonymous image availability.
MeshDrop release readiness requires
ghcr.io/sandwichfarm/meshdropand target images to be publicly readable, or a documented alternative that proves anonymous install/pull behavior for the nextv0.*.*release tag.Current evidence in GSD:
npm run verify:ghcr-anonymous -- v0.1.5fails with GHCRunauthorized.gh api /orgs/sandwichfarm/packages/container/meshdropbecause of missing package permissions.Required unblocker:
Acceptance:
npm run verify:ghcr-anonymous -- <next-release-tag>passes without GitHub credentials.