package repository hardening