Not to beat a dead horse, but this situation is exactly why I can't take arguments of "you should always use distro repos, they have been vetted and are safe, and avoid public registries" very seriously