On: Docker update ToS: Image retention limits imposed on free accounts

[qppo]

You don't need to register an SSH key to download a public repo I thought

[timdorr → qppo]

Not an SSH key, but you do need an access token:

> You need an access token to publish, install, and delete packages in GitHub Packages.

https://docs.github.com/en/packages/using-github-packages-wi...

[qppo → timdorr]

...but not to download. You can clone a repo and download release artifacts without a PAT. That's only necessary for interacting with the API for actions that need authentication, which would be anything involving mutating a repository.

[timdorr → qppo]

Yes, you need one to download. Note that you'll get an auth prompt for this Registry API URL:

https://docker.pkg.github.com/v2/test/test/test/tags/list

> "code": "UNAUTHORIZED", "message": "GitHub Docker Registry needs login"

[akerl_ → qppo]

Using the GitHub Docker Registry requires auth, even just for downloads.

https://docs.github.com/en/packages/using-github-packages-wi...

GitHub Packages is different from GitHub Releases (and their artifacts) or cloning repos.

[mynameisvlad → qppo]

> You need an access token to publish, install, and delete packages in GitHub Packages.

Yes, you do.

[laurencerowe → timdorr]

GitHub access tokens are a bit of a nightmare since you can't limit the permissions for a token. Only workaround I've found is to create another GitHub user for an access token and restrict that user's access.