Ah, I think I may see the problem. PackageDiff.private looks at the privacy of its SPR's upload_archive. Compare with lib/lp/security.py:ViewSourcePackageRelease, which considers an SPR to be public if any of the archives it's published in are public.
Ah, I think I may see the problem. PackageDiff.private looks at the privacy of its SPR's upload_archive. Compare with lib/lp/ security. py:ViewSourcePa ckageRelease, which considers an SPR to be public if any of the archives it's published in are public.